EASA Part-IS Copilot

Part-IS is the information security part of the EU aviation regulatory framework, introduced by Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203. It obliges aviation organisations to identify and manage information security risks that could affect aviation safety, with the scope driven by a documented risk assessment rather than a fixed asset list. The Delegated Regulation has applied to organisations in its scope since 16 October 2025; the Implementing Regulation, which carries the requirements for maintenance, airworthiness management, and air operations organisations plus the authority requirements, applies from 22 February 2026.

Covered organisations include maintenance organisations (Part-145), continuing airworthiness management organisations (CAMO), air operators under Part-ORO, design and production organisations, and declared organisations such as NCC and SPO operators and apron management providers; the full category list lives in the scope articles of the two regulations and EASA's applicability FAQs. Exclusions depend on the organisation category and include organisations dealing only with ELA1 or ELA2 aircraft, Part-ML light work, declared training organisations (DTO), and declared design organisations. A third-country airline's AOC itself is out of scope, but the branches it covers under separate EASA certificates, such as Part-145 maintenance or training approvals, are in.

It turns the Part-IS requirements into working documentation: scope determination across your approvals, risk assessment drafts centred on safety consequences, ISMM structure, change management, incident reporting procedures, and supplier interface treatment. It also organises the evidence path authorities expect on the Present, Suitable, Operational, Effective (PSOE) implementation ladder.

No. EASA's published FAQ says the Part-IS management-system requirements largely align with ISO/IEC 27001, but Part-IS adds provisions specific to aviation safety, and aviation safety must sit inside your organisational risk management. An existing ISO 27001 ISMS can be adapted and extended to the Part-IS scope after a gap analysis, which is exactly the mapping work this Copilot supports. Compliance with NIS 2 does not automatically satisfy Part-IS either.