The FAA's 2024 Safety Management System final rule requires qualifying Part 135 certificate holders to implement a fully operational SMS under 14 CFR Part 5 by May 28, 2027. The SMS must cover four components — Safety Policy, Safety Risk Management, Safety Assurance, and Safety Promotion — and each component generates specific records the FAA inspects during surveillance. The rule applies to all Part 135 certificate holders regardless of fleet size (no aircraft-count or IFR threshold), plus Part 91.147 air-tour operators; single-pilot operators get scaled requirements but the same deadline. A declaration of compliance is due to the FAA by that date.
Why the 2027 SMS Deadline Is the Biggest Regulatory Wave in Part 135 History
Part 121 air carriers have operated under SMS mandates since 2018. The 2024 final rule extending those requirements to Part 135 on-demand charter and commuter operators represents the largest new compliance obligation the sector has faced in decades. Unlike a new training requirement or a records format change, SMS is a system — it must be built, documented, operated, and evidenced before the deadline.
The regulatory foundation is 14 CFR Part 5, which was first established as part of the FAA's implementation of ICAO's SMS framework. Part 5 sits separately from Part 135's operating rules — it is not a subpart of Part 135 but a standalone regulation that defines the SMS framework applicable to certificate holders covered by the rule. The 2024 final rule amended the Part 5 applicability section (§5.1) to cover Part 135 certificate holders, and added §5.9, which sets the compliance requirements and the May 28, 2027 date.
What makes SMS structurally different from prior compliance requirements is the documentation density. A functioning SMS does not just require policies — it requires evidence that the policies are being executed. Every hazard assessment, every internal audit, every safety meeting, every corrective action generates a record that the FAA's principal inspector can request. Part 135 operators who implement an SMS without a disciplined records system will discover the problem at their first SMS surveillance evaluation, not before.
SMS is not a safety program — it is evidence that your safety program exists and works
The FAA does not audit whether your flights are safe. It audits whether your SMS documentation demonstrates that you have a systematic process for identifying hazards, assessing risks, monitoring performance, and training people. The records are the proof. An excellent operational safety record without SMS documentation is still a compliance failure under Part 5.
There is no aircraft-count threshold within Part 135 — the 2024 rule amended the Part 5 applicability (14 CFR §5.1) to cover every Part 135 certificate holder, along with Part 91.147 air-tour operators and certain Part 21 holders. Fleet size and operation type change how much the SMS scales — single-pilot operators get reduced requirements — but not whether the rule applies or when: the compliance date is May 28, 2027 for all affected operators. Operators should still confirm their specific obligations with their assigned FSDO principal inspector rather than relying on a general reading of the rule.
The Four SMS Components Under 14 CFR Part 5
Part 5 organizes the SMS around four components, each with its own subpart. Together they form a closed-loop system: policy sets the intent, risk management identifies and controls hazards, safety assurance verifies the system works, and safety promotion ensures everyone can operate it. Understanding what each component requires — and what records it generates — is the starting point for building an SMS that survives FAA scrutiny.
Safety Policy
14 CFR §5.21–§5.27Establishes management commitment and SMS governance. Requires a signed safety policy, accountable executive designation, and defined safety objectives.
Records this component generates (what the FAA inspects)
- Signed safety policy statement (accountable executive)
- Accountable executive designation letter
- SMS manual with organizational structure
- Safety objectives and performance targets
- SMS responsibilities matrix by role
Safety Risk Management
14 CFR §5.51–§5.57Requires systematic hazard identification and risk assessment before implementing operational changes — the analytical engine of the SMS.
Records this component generates (what the FAA inspects)
- Hazard identification worksheets for operational changes
- Risk assessment matrices with likelihood and severity ratings
- Risk control decisions and implementation records
- Change management documentation for operations affecting safety
- Residual risk acceptance documentation (per the §5.55 risk-acceptance process)
Safety Assurance
14 CFR §5.71–§5.75The continuous monitoring layer — internal audits, safety performance indicators, and management review that confirm the SMS is actually working.
Records this component generates (what the FAA inspects)
- Internal safety audit reports with findings and corrective actions
- Safety performance indicator data (trend tracking)
- Management review meeting minutes and outcomes
- Corrective and preventive action plans with closure dates
- Operational surveillance and analysis outputs
Safety Promotion
14 CFR §5.91–§5.93Training, communication, and competency — every person in the SMS must understand their role and demonstrate that understanding through documented training.
Records this component generates (what the FAA inspects)
- SMS initial training completion records for all personnel
- Recurrent SMS training records
- Competency assessment documentation
- Safety communication logs (bulletins, newsletters, safety meetings)
- Training curriculum and course materials
The SMS Records Problem: Volume, Retention, and Retrieval
An operational SMS at a 10-aircraft Part 135 operation generates hundreds of records per year. Safety assurance alone — the audit cycle, corrective actions, and management reviews — typically produces 40–80 distinct records annually depending on the operator's surveillance schedule. Add safety promotion training records for every pilot, dispatcher, and maintenance contact, and the annual record volume is comparable to what a mid-size trucking company generates for FMCSA compliance.
The challenge is not volume — it is retrieval under inspection. When a FAA Principal Operations Inspector conducts an SMS surveillance evaluation, they ask for specific records: the risk assessment for a recent operational change, the corrective action for a prior audit finding, the training records for all crew members who participated in the last safety promotion activity. Operators who store these records in shared drives and email chains discover the retrieval problem for the first time during the evaluation — typically while the inspector is waiting.
Safety Policy Records
- Accountable executive designation
- Signed safety policy (date-versioned)
- SMS manual with revision history
- Organizational safety responsibilities
Safety Risk Management Records
- Hazard identification worksheets
- Risk matrices with ratings
- Risk control acceptance records
- Change management documentation
Safety Assurance Records
- Internal audit reports + findings
- Safety performance indicator trends
- Corrective action plans + closures
- Management review minutes
Safety Promotion Records
- SMS training completions per employee
- Competency assessments
- Safety communication logs
- Training curriculum documentation
SMS records also interact with the records Part 135 operators already maintain. A safety risk assessment for a new route or a new aircraft type will reference the aircraft's §135.21 General Operations Manual and the aircraft's airworthiness documentation. Training records in the Safety Promotion component link to the same personnel records used for pilot currency tracking under §135.293 and §135.297. The SMS does not create a parallel record-keeping universe — it creates additional record obligations that sit alongside and reference the existing compliance stack.
The four-component → records linkage at a glance
| Component | Primary CFR | Key Record Type |
|---|---|---|
| Safety Policy | §5.21–§5.27 | Signed policy statement, accountable executive designation, SMS manual |
| Safety Risk Management | §5.51–§5.57 | Hazard worksheets, risk matrices, risk control acceptance letters |
| Safety Assurance | §5.71–§5.75 | Audit reports, corrective actions, SPI trend data, management review minutes |
| Safety Promotion | §5.91–§5.93 | Training completion records, competency assessments, communication logs |
Where FileFlo Fits: The Compliance Evidence Layer, Not the SMS Itself
FileFlo holds the proof — it does not provide or run the SMS
FileFlo is a compliance document intelligence platform — a read-only proof layer that sits alongside your SMS software, operations platform, and dispatch stack. It classifies 600+ document types against the governing CFR, tracks expirations, and generates inspector-format audit binders. It does not replace your SMS, provide a safety program, or act as dispatch or FOS. It holds the documents that prove your SMS exists and is operating.
The Part 135 SMS deadline creates a document management challenge that is structurally different from what most operators have faced before. Prior compliance requirements — pilot currency, operations manual revision control under §135.21, maintenance records — generated records that were largely static once created. SMS records are dynamic: risk assessments are updated when operations change, corrective actions have open-closed status, training records accumulate recurrently, and audit reports form a cycle that references prior findings.
FileFlo's document classification engine parses uploaded compliance records against the governing regulation and files them in the correct location automatically. An accountable executive designation letter uploaded to FileFlo is classified against §5.25 requirements. An internal audit report is tagged to Safety Assurance. A safety promotion training certificate is associated with both the individual and the §5.91 training program record. When a FAA principal inspector requests documentation during an SMS surveillance evaluation, the audit binder — organized by Part 5 component — can be generated in under 60 seconds rather than assembled by hand across shared drives and email threads.
Document Classification Against 14 CFR Part 5
Every SMS record — risk assessments, training completions, audit reports, corrective actions — is automatically classified against the specific Part 5 section it satisfies. No manual filing. No records misrouted to the wrong component.
Expiration Tracking for Recurrent SMS Records
Safety Promotion training records carry recurrence cycles. Safety Assurance audit schedules create expected record dates. FileFlo surfaces upcoming gaps 90, 60, and 30 days before they become compliance findings rather than after.
One-Click SMS Evidence Binder
When your FAA Principal Operations Inspector requests SMS documentation, FileFlo generates a complete, Part 5-organized evidence binder — all four components, indexed by section. The same binder also supports ACSF, IS-BAO, and ARGUS Gold audit preparation.
Cross-Regulation Coverage for the Full Part 135 Compliance Stack
FileFlo classifies records against the full Part 135 compliance footprint alongside Part 5: §135.21 GOM/GMM revision history, pilot currency under §135.293 and §135.297, §135.63 recordkeeping, and drug and alcohol program records under Part 120.
Starter Plan
$89/mo
Up to 100 documents/month · 3 users
For solo owner-operators and small teams starting their SMS documentation program.
Professional Plan
$299/mo
Unlimited documents + users · audit trail · employee auto-detection
For Part 135 operators managing the full SMS evidence load across all four components.
Check your FAA readiness before the inspector does
FileFlo's free FAA readiness score tool takes 3 minutes and surfaces the document gaps most likely to generate findings during a Part 5 SMS surveillance evaluation or Part 135 renewal. No signup required. Free.
5-day free trial · No credit card required · Cancel anytime
Frequently Asked Questions
What is the FAA SMS deadline for Part 135 operators?
Under the FAA's 2024 Safety Management System final rule (published April 26, 2024; effective May 28, 2024), all Part 135 certificate holders must develop and implement an SMS — and submit a declaration of compliance to the FAA — by May 28, 2027. The rule applies to every Part 135 operator regardless of fleet size (roughly 1,800+ operators per the rule's Regulatory Impact Analysis), along with Part 91.147 air-tour operators and certain Part 21 certificate holders; there is no aircraft-count or IFR threshold. The FAA set a single 36-month compliance window, extended from the 24 months originally proposed. Single-pilot operators — organizations where one pilot performs all necessary SMS functions — are exempted by §5.9 from several specific Part 5 sections, but face the same May 28, 2027 deadline, not a later one. The governing regulation is 14 CFR Part 5.
What are the four components of an FAA-compliant SMS under 14 CFR Part 5?
The four SMS components mandated by 14 CFR Part 5 are: (1) Safety Policy — the accountable executive designation, safety objectives, and SMS documentation (§5.21–§5.27); (2) Safety Risk Management — the hazard identification and risk assessment processes for operational changes (§5.51–§5.57); (3) Safety Assurance — the continuous monitoring, performance measurement, and internal audit program that verifies the SMS is working (§5.71–§5.75); and (4) Safety Promotion — the training program, safety communication channels, and competency records that ensure everyone operating the SMS understands their role (§5.91–§5.93). Each component generates specific records that the FAA expects to see during surveillance.
What records does an SMS generate that the FAA will inspect?
An operational SMS generates a dense paper trail across all four components. Safety Policy records include the signed safety policy statement, accountable executive designation letter, and SMS manual. Safety Risk Management records include completed hazard identification worksheets, risk assessment matrices, and risk control decisions for each analyzed change or operational event. Safety Assurance records include internal audit reports, safety performance indicator data, corrective action plans, and the outputs of management reviews. Safety Promotion records include employee SMS training completion records, competency assessments, safety communication logs (newsletters, safety bulletins, meeting minutes), and training curriculum documentation. These records are what a FAA Principal Operations Inspector reviews during an SMS surveillance evaluation — they are the proof the safety program exists, not the program itself.
Does 14 CFR Part 5 apply to Part 91 or Part 145 operators?
The 2024 SMS final rule expanded Part 5 applicability to include Part 135 certificate holders (on-demand charter, air taxi, and commuter operators). Part 145 certificated repair stations are not currently required to implement an SMS under 14 CFR Part 5, though the FAA encourages voluntary adoption through its SMS Voluntary Program, and U.S. repair stations holding EASA Part-145 approval face SMS requirements separately through the FAA-EASA bilateral framework. Most Part 91 operators are not subject to Part 5 — but Part 91.147 air tour operators ARE covered by the 2024 rule, as are certain Part 21 design and production certificate holders. Part 121 air carriers have been required to comply with Part 5 SMS since 2018. Within Part 135 there is no applicability threshold: the rule covers every Part 135 certificate holder regardless of aircraft count or operation type, with a single May 28, 2027 compliance date.
How long must Part 135 operators retain SMS records?
The SMS record retention requirements are set out in 14 CFR §5.97, and they are concrete. Safety Risk Management outputs — hazard analyses, risk assessments, and risk control decisions — must be retained for as long as the risk control remains relevant to the operation (§5.97(a)). Safety Assurance outputs — audits, evaluations, monitoring data, and safety performance assessments — must be retained for a minimum of 5 years (§5.97(b)). SMS training records for each individual must be retained for as long as that individual is employed (§5.97(c)). Records of safety communications under §5.93 and hazard notifications under §5.57 must be retained for a minimum of 24 consecutive calendar months (§5.97(d)). Practical takeaway: an internal audit record is a 5-year document, and a risk assessment for an active operational change stays on file as long as the change (and its controls) remain in effect.
What is an accountable executive under 14 CFR Part 5?
Under 14 CFR §5.25, a Part 135 certificate holder must designate an accountable executive — a single individual who has control of the human and financial resources necessary to carry out the SMS, and who retains ultimate responsibility for the safety performance of the operations. The accountable executive must have signed the safety policy statement (§5.21(b)) and is the person the FAA holds responsible during surveillance; identifying them by name and title in the SMS documentation is standard FAA-guidance practice (AC 120-92). Because §5.25 requires final authority over operations AND control of the financial and human resources, at most Part 135 operators this is the owner, CEO, or president — the individual who controls the money and the operation — rather than the Director of Operations. The designation must be formal and documented, not simply assumed by role.
Don't let your SMS documentation fall behind the deadline
FileFlo classifies every SMS record against the correct Part 5 section automatically, surfaces expiring training and audit records before they become findings, and generates a complete FAA-organized evidence binder in 60 seconds. Starter at $89/mo · Professional at $299/mo · No credit card required.
5-day free trial · No credit card required · Cancel anytime