Direct answer
Every Part 135 certificate holder, any fleet size, must have a Safety Management System in place by May 28, 2027 (14 CFR 5.1, 5.9), with an accountable executive who signs the safety policy and holds final authority (5.25). The SMS has four parts, safety policy, safety risk management, safety assurance and safety promotion, and each one produces records the FAA will ask to see.
Have every pilot's checks and medicals current and the records behind your SMS filed and dated. Start with the Crew Records Setup: send your crew records as they are, and FileFlo dates each one against the rule and names every gap.
30 days, every dollar back: if you are not happy with the Crew Records Setup within 30 days of purchase, FileFlo refunds the full Setup price.
Or have FileFlo run it for you: the FileFlo Aviation Compliance Department, $2,500 a month, first month free if you start by Dec 31, Setup included. Start the department within 30 days of your Setup report and your Setup fee counts toward your first department month.
What it means for your business
- Your charter sales
- Charter brokers and their customers read your rating. It is how a broker shows a customer that someone checked the operator.
- Your certificate
- The rating sits beside the FAA, not in place of it. Every Part 135 certificate holder, any fleet size, must have its SMS in place by May 28, 2027 (14 CFR 5.9).
- Your crews
- A check or a medical found expired in the sample is a finding, and a pilot off the schedule until it is fixed.
- Your DO's week
- The auditor samples by pilot and by aircraft. Every record that cannot be produced is your Director of Operations hunting the week before.
What FileFlo does about it, today
- Each pilot's checks, recurrent training and medical are computed from the records you hold and cited to the rule, in calendar months with base-month crediting.
- The pilot and the office are asked at 45, 14 and 3 days before a check, medical or annual is due, with office copies to the Director of Operations.
- An export of crew currency, training and aircraft records as of one date, tagged to the Wyvern Wingman clauses and the ARGUS audit categories, prepared for the audit. It is the evidence, not a certification.
- An audit packet with the per-pilot currency matrix and each document's standing, and an inspector link scoped to one tail or one crew.
- OpSpecs, manuals, management personnel records, SMS documents and the Part 120 program documents are filed and shown as on file.
- In the FileFlo Aviation Compliance Department, FileFlo runs the crew-records side of your Director of Operations, Chief Pilot and Safety Manager jobs, chases every check and medical before it is due and keeps the monthly ARGUS and Wyvern upkeep list. Your signers stay the signers.
FileFlo is the compliance desk beside your Director of Operations.
Done for you: The FileFlo Aviation Compliance Department: $2,500 a month for up to 10 aircraft, with a 3-month minimum. The Aviation Compliance Department
Why the 2027 SMS Deadline Is the Biggest Regulatory Wave in Part 135 History
Part 121 air carriers have operated under SMS mandates since 2018. The 2024 final rule extending those requirements to Part 135 on-demand charter and commuter operators represents the largest new compliance obligation the sector has faced in decades. Unlike a new training requirement or a records format change, SMS is a system, it must be built, documented, operated, and evidenced before the deadline.
The regulatory foundation is 14 CFR Part 5, which was first established as part of the FAA's implementation of ICAO's SMS framework. Part 5 sits separately from Part 135's operating rules, it is not a subpart of Part 135 but a standalone regulation that defines the SMS framework applicable to certificate holders covered by the rule. The 2024 final rule amended the Part 5 applicability section (§5.1) to cover Part 135 certificate holders, and added §5.9, which sets the compliance requirements and the May 28, 2027 date.
What makes SMS structurally different from prior compliance requirements is the documentation density. A functioning SMS does not just require policies, it requires evidence that the policies are being executed. Every hazard assessment, every internal audit, every safety meeting, every corrective action generates a record that the FAA's principal inspector can request. Part 135 operators who implement an SMS without a disciplined records system will discover the problem at their first SMS surveillance evaluation, not before.
SMS is not a safety program, it is evidence that your safety program exists and works
The FAA does not audit whether your flights are safe. It audits whether your SMS documentation demonstrates that you have a systematic process for identifying hazards, assessing risks, monitoring performance, and training people. The records are the proof. An excellent operational safety record without SMS documentation is still a compliance failure under Part 5.
There is no aircraft-count threshold within Part 135, the 2024 rule amended the Part 5 applicability (14 CFR §5.1) to cover every Part 135 certificate holder, along with Part 91.147 air-tour operators and certain Part 21 holders. Fleet size and operation type change how much the SMS scales, single-pilot operators get reduced requirements, but not whether the rule applies or when: the compliance date is May 28, 2027 for all affected operators. Operators should still confirm their specific obligations with their assigned FSDO principal inspector rather than relying on a general reading of the rule.
The Four SMS Components Under 14 CFR Part 5
Part 5 organizes the SMS around four components, each with its own subpart. Together they form a closed-loop system: policy sets the intent, risk management identifies and controls hazards, safety assurance verifies the system works, and safety promotion ensures everyone can operate it. Understanding what each component requires, and what records it generates, is the starting point for building an SMS that survives FAA scrutiny.
Safety Policy
14 CFR §5.21-§5.27Establishes management commitment and SMS governance. Requires a signed safety policy, accountable executive designation, and defined safety objectives.
Records this component generates (what the FAA inspects)
- Signed safety policy statement (accountable executive)
- Accountable executive designation letter
- SMS manual with organizational structure
- Safety objectives and performance targets
- SMS responsibilities matrix by role
Safety Risk Management
14 CFR §5.51-§5.57Requires systematic hazard identification and risk assessment before implementing operational changes, the analytical engine of the SMS.
Records this component generates (what the FAA inspects)
- Hazard identification worksheets for operational changes
- Risk assessment matrices with likelihood and severity ratings
- Risk control decisions and implementation records
- Change management documentation for operations affecting safety
- Residual risk acceptance documentation (per the §5.55 risk-acceptance process)
Safety Assurance
14 CFR §5.71-§5.75The continuous monitoring layer, internal audits, safety performance indicators, and management review that confirm the SMS is actually working.
Records this component generates (what the FAA inspects)
- Internal safety audit reports with findings and corrective actions
- Safety performance indicator data (trend tracking)
- Management review meeting minutes and outcomes
- Corrective and preventive action plans with closure dates
- Operational surveillance and analysis outputs
Safety Promotion
14 CFR §5.91-§5.93Training, communication, and competency, every person in the SMS must understand their role and demonstrate that understanding through documented training.
Records this component generates (what the FAA inspects)
- SMS initial training completion records for all personnel
- Recurrent SMS training records
- Competency assessment documentation
- Safety communication logs (bulletins, newsletters, safety meetings)
- Training curriculum and course materials
The SMS Records Problem: Volume, Retention, and Retrieval
An operational SMS at a 10-aircraft Part 135 operation generates hundreds of records per year. Safety assurance alone (the audit cycle, corrective actions, and management reviews) typically produces 40-80 distinct records annually depending on the operator's surveillance schedule. Add safety promotion training records for every pilot, dispatcher, and maintenance contact, and the annual record volume is comparable to what a mid-size trucking company generates for FMCSA compliance.
The challenge is not volume, it is retrieval under inspection. When a FAA Principal Operations Inspector conducts an SMS surveillance evaluation, they ask for specific records: the risk assessment for a recent operational change, the corrective action for a prior audit finding, the training records for all crew members who participated in the last safety promotion activity. Operators who store these records in shared drives and email chains discover the retrieval problem for the first time during the evaluation, typically while the inspector is waiting.
Safety Policy Records
- Accountable executive designation
- Signed safety policy (date-versioned)
- SMS manual with revision history
- Organizational safety responsibilities
Safety Risk Management Records
- Hazard identification worksheets
- Risk matrices with ratings
- Risk control acceptance records
- Change management documentation
Safety Assurance Records
- Internal audit reports + findings
- Safety performance indicator trends
- Corrective action plans + closures
- Management review minutes
Safety Promotion Records
- SMS training completions per employee
- Competency assessments
- Safety communication logs
- Training curriculum documentation
SMS records also interact with the records Part 135 operators already maintain. A safety risk assessment for a new route or a new aircraft type will reference the aircraft's §135.21 General Operations Manual and the aircraft's airworthiness documentation. Training records in the Safety Promotion component link to the same personnel records used for pilot currency tracking under §135.293 and §135.297. The SMS does not create a parallel record-keeping universe, it creates additional record obligations that sit alongside and reference the existing compliance stack.
The four-component → records linkage at a glance
| Component | Primary CFR | Key Record Type |
|---|---|---|
| Safety Policy | §5.21-§5.27 | Signed policy statement, accountable executive designation, SMS manual |
| Safety Risk Management | §5.51-§5.57 | Hazard worksheets, risk matrices, risk control acceptance letters |
| Safety Assurance | §5.71-§5.75 | Audit reports, corrective actions, SPI trend data, management review minutes |
| Safety Promotion | §5.91-§5.93 | Training completion records, competency assessments, communication logs |
Frequently Asked Questions
What is the FAA SMS deadline for Part 135 operators?
Under the FAA's 2024 Safety Management System final rule (published April 26, 2024; effective May 28, 2024), all Part 135 certificate holders must develop and implement an SMS, and submit a declaration of compliance to the FAA, by May 28, 2027. The rule applies to every Part 135 operator regardless of fleet size (roughly 1,800+ operators per the rule's Regulatory Impact Analysis), along with Part 91.147 air-tour operators and certain Part 21 certificate holders; there is no aircraft-count or IFR threshold. The FAA set a single 36-month compliance window, extended from the 24 months originally proposed. Single-pilot operators, organizations where one pilot performs all necessary SMS functions, are exempted by §5.9 from several specific Part 5 sections, but face the same May 28, 2027 deadline, not a later one. The governing regulation is 14 CFR Part 5.
What are the four components of an FAA-compliant SMS under 14 CFR Part 5?
The four SMS components mandated by 14 CFR Part 5 are: (1) Safety Policy, the accountable executive designation, safety objectives, and SMS documentation (§5.21-§5.27); (2) Safety Risk Management, the hazard identification and risk assessment processes for operational changes (§5.51-§5.57); (3) Safety Assurance, the continuous monitoring, performance measurement, and internal audit program that verifies the SMS is working (§5.71-§5.75); and (4) Safety Promotion, the training program, safety communication channels, and competency records that ensure everyone operating the SMS understands their role (§5.91-§5.93). Each component generates specific records that the FAA expects to see during surveillance.
What records does an SMS generate that the FAA will inspect?
An operational SMS generates a dense paper trail across all four components. Safety Policy records include the signed safety policy statement, accountable executive designation letter, and SMS manual. Safety Risk Management records include completed hazard identification worksheets, risk assessment matrices, and risk control decisions for each analyzed change or operational event. Safety Assurance records include internal audit reports, safety performance indicator data, corrective action plans, and the outputs of management reviews. Safety Promotion records include employee SMS training completion records, competency assessments, safety communication logs (newsletters, safety bulletins, meeting minutes), and training curriculum documentation. These records are what a FAA Principal Operations Inspector reviews during an SMS surveillance evaluation, they are the proof the safety program exists, not the program itself.
Does 14 CFR Part 5 apply to Part 91 or Part 145 operators?
The 2024 SMS final rule expanded Part 5 applicability to include Part 135 certificate holders (on-demand charter, air taxi, and commuter operators). Part 145 certificated repair stations are not currently required to implement an SMS under 14 CFR Part 5, though the FAA encourages voluntary adoption through its SMS Voluntary Program, and U.S. repair stations holding EASA Part-145 approval face SMS requirements separately through the FAA-EASA bilateral framework. Most Part 91 operators are not subject to Part 5, but Part 91.147 air tour operators ARE covered by the 2024 rule, as are certain Part 21 design and production certificate holders. Part 121 air carriers have been required to comply with Part 5 SMS since 2018. Within Part 135 there is no applicability threshold: the rule covers every Part 135 certificate holder regardless of aircraft count or operation type, with a single May 28, 2027 compliance date.
How long must Part 135 operators retain SMS records?
The SMS record retention requirements are set out in 14 CFR §5.97, and they are concrete. Safety Risk Management outputs (hazard analyses, risk assessments, and risk control decisions) must be retained for as long as the risk control remains relevant to the operation (§5.97(a)). Safety Assurance outputs (audits, evaluations, monitoring data, and safety performance assessments) must be retained for a minimum of 5 years (§5.97(b)). SMS training records for each individual must be retained for as long as that individual is employed (§5.97(c)). Records of safety communications under §5.93 and hazard notifications under §5.57 must be retained for a minimum of 24 consecutive calendar months (§5.97(d)). Practical takeaway: an internal audit record is a 5-year document, and a risk assessment for an active operational change stays on file as long as the change (and its controls) remain in effect.
What is an accountable executive under 14 CFR Part 5?
Under 14 CFR §5.25, a Part 135 certificate holder must designate an accountable executive, a single individual who has control of the human and financial resources necessary to carry out the SMS, and who retains ultimate responsibility for the safety performance of the operations. The accountable executive must have signed the safety policy statement (§5.21(b)) and is the person the FAA holds responsible during surveillance; identifying them by name and title in the SMS documentation is standard FAA-guidance practice (AC 120-92). Because §5.25 requires final authority over operations AND control of the financial and human resources, at most Part 135 operators this is the owner, CEO, or president, the individual who controls the money and the operation, rather than the Director of Operations. The designation must be formal and documented, not simply assumed by role.