The Part 135 SMS deadline is a single date — May 28, 2027 — for every existing operator, with no fleet-size threshold and no phased schedule (14 CFR §5.9). Plan backward from it: around 24 months out, run a gap analysis and sign your safety policy; by 12 months out, your full system should be live and generating records; by 6 months out, run a complete cycle and assemble the evidence; then declare. The reason the timeline is long is that you cannot declare an SMS you just built — §5.71 requires processes that acquire safety data over time, and §5.97(b) keeps safety-assurance records for five years. You need months of real operating evidence behind the declaration.
If you only read one companion piece first, read the FAA Part 135 SMS 2027 deadline explainer to confirm exactly who is covered and by when. Then use this page to schedule the work, the how-to-implement-SMS roadmap to build each component, and a SMS gap analysis to size your starting point.
Why you have to plan an SMS timeline backward — and start earlier than feels necessary
Most operators read “May 28, 2027” and mentally file it as a document-due date — write the manual, submit the form, done. That instinct is exactly what blows the timeline. An SMS is not a deliverable you produce; it is a system you operate. And 14 CFR Part 5 is written so that the proof of an SMS is the record it generates while running, not the binder that describes it.
You cannot declare an SMS you stood up last week
Section 5.71 requires you to “develop and maintain processes and systems to acquire data” — monitoring, auditing, incident investigation, and a confidential employee reporting system — and then analyze that data (§5.71(b)). Section 5.97(b) requires safety-assurance outputs to be retained for a minimum of 5 years. A system declared the day after it was built has no monitoring data, no audit cycle, no hazard reports, and no management reviews. It is a description of an SMS, not a working one — and that gap is what surveillance is designed to find.
That single fact reshapes the whole schedule. The framework — safety policy, the SRM and safety-assurance processes, the training, the SMS documentation under §5.95 — is the part you can build in a few months. The part that takes time is letting the system run long enough to produce a credible body of evidence: hazards reported and dispositioned, an internal audit performed and its findings closed, performance monitored, management reviews held. There is no shortcut for elapsed operating time. So you count backward from May 28, 2027 and front-load the build, leaving the maximum runway for the system to actually operate before you declare.
One reassurance for smaller operators: this is not as daunting as it sounds, and a gap analysis usually shows you already do a lot of this informally — you brief hazards, you talk through risk, you fix discrepancies. SMS formalizes and records what good operators already practice. The timeline below assumes you start from a partial baseline, not zero. (For the FAA's development methodology and how it evaluates an SMS, see FAA guidance in Advisory Circular 120-92D and FAA Notice 8900.700.)
The Part 135 SMS timeline: 24, 12, and 6 months out from May 28, 2027
The month markers below are planning anchors pinned to the single statutory deadline (§5.9). They are not regulatory sub-deadlines — there is exactly one compliance date — but they are how operators who finish comfortably actually sequence the work. If today is later than a given marker, compress, but keep the order: foundation, then engines, then a live operating cycle, then the declaration.
Gap analysis, accountable executive & signed safety policy
14 CFR §5.21 · §5.23 · §5.25Find out how big the build is, then lay the foundation. You cannot schedule a program you have not measured, and you cannot run an SMS without naming who is accountable for it.
What to do in this window
- 1Run an SMS gap analysis against all four Part 5 components — what you have, what is partial, what is missing.
- 2Designate one accountable executive (§5.25): the individual who controls the financial and human resources and holds ultimate responsibility for safety performance.
- 3Draft and sign the safety policy (§5.21): safety objectives, a safety reporting policy, a non-punitive disciplinary policy, an emergency response plan, and the accountable executive’s signature.
- 4Set your declaration target inside May 28, 2027 and build the backward schedule from it.
Evidence you should have by the end of this window
- Completed gap-analysis punch list
- Accountable executive designation
- Signed, dated safety policy statement
Build Safety Risk Management & stand up Safety Assurance
14 CFR §5.51–§5.55 · §5.71–§5.75Build the two engines that actually produce evidence. SRM finds and controls hazards; safety assurance verifies the controls work — and §5.71 specifically requires processes that acquire data over time.
What to do in this window
- 1Write your system description (§5.53) and define when SRM applies (§5.51): new systems, changes, new procedures, and hazards surfaced by assurance.
- 2Build a repeatable hazard-identification method and a likelihood-by-severity risk-assessment scheme, with documented risk controls (§5.55).
- 3Stand up safety assurance (§5.71): monitoring of operational processes, an internal audit program, incident/accident investigation, and a confidential employee reporting system.
- 4Begin analyzing the data you collect (§5.71(b)) and feeding findings back into SRM — this is the loop that has to run before you declare.
Evidence you should have by the end of this window
- System description document(s)
- Hazard worksheets & risk assessments
- Internal audit program with first findings
- Confidential report intake/disposition log
System is LIVE & generating records — deliver Safety Promotion
14 CFR §5.91 · §5.93 · §5.71The pivotal milestone. By twelve months out the SMS should not be a draft on a shelf — it should be running and producing real records, with everyone trained to operate it.
What to do in this window
- 1Deliver initial SMS training (§5.91) so each person identified in §5.23 attains the competencies for their SMS duties.
- 2Open your safety communication channels (§5.93): bulletins, safety meetings, lessons learned.
- 3Confirm hazard reports are coming in, audits are being performed, and monitoring data is being captured — the system is operating, not just documented.
- 4Hold your first management reviews and direct corrective action on any substandard performance.
Evidence you should have by the end of this window
- Initial SMS training completions per person
- Safety communication logs
- Live hazard reports & monitoring data
- First management-review minutes
Full operating cycle, close findings & prepare the declaration
14 CFR §5.95 · §5.97Prove the system runs, end to end. Six months out you are not building anymore — you are demonstrating a closed loop and assembling the evidence the FAA will ask for.
What to do in this window
- 1Run the system through at least one complete cycle: hazards reported, risks assessed, controls applied, audits performed, findings closed, reviews held.
- 2Maintain SMS documentation under §5.95 (safety policy + processes) with version control.
- 3Confirm §5.97 retention is in place: SRM outputs as long as relevant, safety-assurance outputs for 5 years, training for the duration of employment, communications for 24 months.
- 4Assemble a complete, four-component evidence set so the declaration is backed by records, not promises.
Evidence you should have by the end of this window
- Closed-loop corrective actions
- Version-controlled SMS documentation (§5.95)
- Complete §5.97 record set, retained correctly
- Declaration-ready evidence binder
The single compliance date — one date, all existing operators, no fleet-size phasing. By now your SMS has been operating long enough to stand behind the declaration.
What to do in this window
- 1Submit your declaration of compliance to the FAA on or before May 28, 2027 (§5.9(a)).
- 2Be ready to make SMS information available to the Administrator on request (§5.9(d)).
- 3Keep operating and keep the records — the obligation continues for as long as you hold the authorization (§5.9(c)).
- 4Confirm your specific submission path and any FSDO-specific expectations directly with your principal inspector.
Evidence you should have by the end of this window
- Submitted declaration of compliance
- Ongoing §5.97 record set
- Continuous SMS operation evidence
Notice where the weight sits: the build (24 to ~12 months out) is finite work, but the live-operation window (~12 months out to the deadline) is where the records that actually pass surveillance accumulate. If you are reading this in 2026, you are already inside the 24-month window — the practical move is to run a gap analysis this month and lock your backward schedule. For the component-by-component build mechanics, follow the how-to-implement-SMS roadmap, and for the precise list of what each component must record, the Part 135 SMS recordkeeping requirements guide.
The retention clocks that make the timeline real (14 CFR §5.97)
The reason “just build it at the end” fails is written into the retention rules. Section 5.95 requires you to develop and maintain SMS documentation — your safety policy and your SMS processes and procedures. Section 5.97 then sets how long the records must be kept, and the safety-assurance line in particular only makes sense if the system has been running for a while.
| Record category | CFR | Minimum retention |
|---|---|---|
| Safety risk management outputs (hazard analyses, risk assessments, controls) | §5.97(a) | As long as the control remains relevant to the operation |
| Safety assurance outputs (audits, evaluations, monitoring & performance data) | §5.97(b) | Minimum of 5 years |
| Personnel SMS training records | §5.97(c) | As long as the individual is employed |
| Communication records | §5.97(d) | Minimum of 24 consecutive calendar months |
Retention periods per 14 CFR §5.97. SMS documentation (safety policy + processes) must be developed and maintained under the companion section, §5.95.
Read the second row again. Safety-assurance outputs — your audit reports and monitoring data — are five-year documents. The day you declare, the FAA expects a body of that evidence to already exist, which is impossible if the system only started running the week before. That is the mechanical reason the timeline is measured in months and years, not weeks. The earlier your system goes live (the ~12-month marker), the deeper the record set you can show at the deadline. For how these clocks fit your whole certificate, see the aviation records retention schedule and what records a Part 135 operator must keep.
See where you stand on the timeline — in about 3 minutes
FileFlo's free FAA readiness score surfaces the documentation gaps most likely to generate findings during a Part 5 SMS surveillance evaluation or a Part 135 renewal — a fast way to sanity-check how far along your evidence really is. No signup required.
5-day free trial · No credit card required · Cancel anytime
Five timeline mistakes that put the May 2027 deadline at risk
Treating May 28, 2027 as a document-due date
It is the date a fully operating SMS must be implemented and declared, not the date you start writing one. The FAA evaluates the running system and its records (§5.97), not just the documentation (§5.95). Working backward from the deadline — not toward it — is the whole game.
Building the binder, then trying to declare immediately
A manual dated last week with no monitoring data, no completed audit cycle, and no hazard reports is not a working SMS. Section 5.71 requires processes that acquire data over time and §5.97(b) keeps that data five years — you need months of real operation behind the declaration.
Skipping the gap analysis and over- or under-scoping
Without a gap analysis you cannot size the build, so you either panic-buy a turnkey program you do not need or under-build and fail surveillance. Measure first, around the 24-month mark, then schedule.
Assuming single-pilot status buys more time
Section 5.9(e) scales the SMS down for qualifying single-pilot operations — it does not move the May 28, 2027 deadline. A right-sized SMS is still an SMS, and it still needs an operating record.
Letting the evidence pile up somewhere it cannot be produced
Even a system that has run for a year fails surveillance if the records live across email, shared drives, and a safety manager’s laptop. The retrieval problem appears the moment the inspector asks for a specific record — and the longer your timeline, the more evidence there is to lose track of.
Keep going: related Part 135 reading
Where FileFlo fits: the running evidence behind the declaration
FileFlo does not build or run your SMS — it accumulates and proves your SMS records on demand
Be precise about the boundary, because it matters most on SMS. FileFlo is a compliance document intelligence platform — a read-only proof layer. It is not an SMS platform, it does not run your safety management system, it does not author your SMS manual, and it does not replace your safety manager or accountable executive. You (and your SMS software or consultant) build and operate the system. FileFlo classifies, indexes, version-controls, and tracks the expirations on the records that system produces — from day one — so when the FAA asks for them at the deadline, you can produce a complete, dated history.
The timeline is exactly why the document layer matters. An SMS that has to operate for months before you declare generates a continuous stream of dated evidence — hazard reports trickling in, audit findings opening and closing, recurrent training accumulating, monitoring data piling up. That running record is your proof that the system was alive well before May 28, 2027, not stood up the week before. FileFlo captures it as it happens, so the depth of your evidence reflects the depth of your actual operation.
Captures the running record from day one
The moment your system goes live, FileFlo classifies each SMS artifact against the Part 5 section it satisfies and timestamps it. By the deadline you have a dated, continuous history — the evidence that your SMS was operating, not just documented.
Tracks the §5.97 retention clocks across the whole timeline
Safety-assurance outputs are 5-year documents; training runs as long as the person is employed; communications run 24 months. FileFlo tracks those clocks and surfaces upcoming gaps — recurrent training, the next audit cycle — at 90, 60, and 30 days, so nothing lapses during your long build window.
Produces a declaration-ready, Part 5-organized evidence binder
When it is time to declare — or when your principal inspector requests SMS documentation — FileFlo assembles a complete, four-component binder indexed by section, instead of you hand-assembling it across drives. The same binder supports ACSF, IS-BAO, and ARGUS audit prep.
Covers the rest of the Part 135 stack alongside Part 5
SMS records sit next to the records you already keep. FileFlo also classifies pilot currency, GOM/GMM revision history, maintenance and airworthiness records, and drug & alcohol program records — one proof layer across the whole certificate.
Starter Plan
$89/mo
Up to 100 documents/month · 3 users
For solo owner-operators and small teams starting their SMS documentation program early.
Professional Plan
$299/mo
Unlimited documents + users · audit trail · employee auto-detection
For Part 135 operators managing the full SMS evidence load across the whole build-to-declaration timeline.
Frequently Asked Questions
When is the Part 135 SMS deadline?
May 28, 2027. Under 14 CFR §5.9(a), every operator already authorized to conduct operations under Part 135 — or holding a §91.147 air-tour Letter of Authorization — before May 28, 2024 must develop and implement a Part 5-compliant Safety Management System and submit a declaration of compliance no later than May 28, 2027. It is a single compliance date that applies to all affected Part 135 operators regardless of fleet size: there is no aircraft-count threshold and no phased, per-size schedule. Anyone applying for a new Part 135 or §91.147 authorization on or after May 28, 2024 must already have an SMS at the time of application (§5.9(b)).
What is the Part 135 SMS implementation timeline?
Work backward from May 28, 2027 and the timeline becomes clear, because of one fact most countdowns miss: you cannot declare an SMS you stood up last week. 14 CFR §5.71 requires processes that acquire and analyze safety data over time, and §5.97(b) requires you to retain safety-assurance outputs for a minimum of 5 years — which means your SMS has to be operating and generating real records (hazard reports, audits, monitoring data, management reviews) well before you declare. A workable schedule: at roughly 24 months out, run a gap analysis and stand up your safety policy and accountable executive; by ~18 months, build your safety risk management and safety assurance processes; by ~12 months, the system should be live and producing records; by ~6 months, run the system through a full cycle, close findings, and prepare the declaration; then declare on or before May 28, 2027. Confirm your specific path with your assigned FSDO.
Is Part 135 SMS mandatory?
Yes. The FAA's 2024 final rule amended 14 CFR Part 5 so that the SMS requirement, which Part 121 air carriers have had for years, now applies to all Part 135 certificate holders, §91.147 air-tour operators, and certain Part 21 certificate holders. Part 5 §5.1 sets the applicability and §5.9 sets the compliance dates. There is no opt-out and no minimum fleet size — a single-aircraft, single-pilot Part 135 operator is covered just like a 60-aircraft fleet. The only flexibility is scaling: §5.9(e) exempts certain single-pilot organizations from specific Part 5 sections so the system is right-sized, but the obligation and the May 28, 2027 deadline still apply.
How long does it take to implement a Part 135 SMS?
Plan on building the framework over a few months — but plan on operating it for many more before you declare, and that second number is the one that drives the timeline. Drafting the four-component framework (safety policy, safety risk management, safety assurance, safety promotion) and the SMS documentation under §5.95 is achievable in a few months for most operators. The longer requirement is accumulating a credible operating record: §5.71 requires monitoring, auditing, and a confidential employee reporting system that produce data over time, and §5.97(b) keeps safety-assurance outputs for 5 years. A binder dated last week with no hazard reports, no audit cycle, and no management reviews is not a working SMS. Most operators should treat the full effort as a 12- to 24-month program, not a sprint to a manual.
What should I do 24, 12, and 6 months out from the SMS deadline?
At 24 months out (roughly mid-2025): run an SMS gap analysis against 14 CFR Part 5, designate your accountable executive (§5.25), and write and sign the safety policy (§5.21). At 12 months out (roughly mid-2026): your four components should be built and the system should be live — safety risk management identifying hazards (§5.51–§5.55), safety assurance monitoring and auditing with a confidential reporting channel (§5.71), and SMS training delivered (§5.91) — so it is actually generating records. At 6 months out (late 2026 / early 2027): run the live system through at least one full cycle, close your audit findings, hold management reviews, confirm your §5.97 retention is in place, and assemble the evidence for your declaration of compliance. Then declare on or before May 28, 2027 (§5.9). If you are reading this in 2026, you are already inside the 24-month window — start now.
Does a single-pilot Part 135 operator need an SMS, and is the deadline different?
Yes, and no — the deadline is the same. A single-pilot Part 135 operator is covered by the rule and faces the same May 28, 2027 compliance date as everyone else. Section 5.9(e) does not give single-pilot operations a later deadline; it exempts certain single-pilot organizations (where one pilot is the sole individual performing all necessary functions) from specific Part 5 requirements, scaling the SMS to the size of the operation. So a single-pilot operator still implements an SMS by May 28, 2027 — just a right-sized one — and still needs an operating record behind it. Confirm exactly which sections apply with your assigned FSDO, and see our dedicated guidance on single-pilot Part 135 SMS.
How much does it cost to implement a Part 135 SMS?
There is no FAA fee for the SMS itself — the cost is your time plus whatever tools and outside help you choose, and starting earlier lowers it. The main drivers are building the four-component framework, the staff hours to operate it (hazard reporting, audits, management reviews, recurrent training) over the months before you declare, and software to manage SMS workflow and keep the records audit-ready. Compressing a 24-month program into a panic at month three usually costs more, because rushed consulting and crash builds are expensive. FileFlo is not an SMS platform and does not price your SMS build — it is the document layer at $89/mo (Starter) or $299/mo (Professional) that classifies, version-controls, and proves your SMS records on demand. See our deeper Part 135 SMS cost breakdown for the line items.
What is a gap analysis in aviation SMS, and when should I do it?
A gap analysis is the first real step of the timeline: a structured comparison of your current operation against every requirement of 14 CFR Part 5, producing a punch list of what you already have, what you have partially, and what is missing across all four components. It tells you how big your build actually is before you commit a schedule and budget — and for operators who already run informal safety practices, it often reveals you are further along than you feared. Do it as early as possible, ideally around the 24-month mark, because everything downstream (your build plan, your hire/consult decisions, your declaration date) depends on knowing the size of the gap. See our dedicated Part 135 SMS gap analysis guide for how to run one.
Chad Griffith
Founder, FileFlo — compliance document intelligence
This article is written from a compliance-document perspective — how Part 135 operators keep SMS records audit-ready under 14 CFR Part 5. It is not legal advice, and it is not safety-program or SMS-development consulting. The 24/12/6-month markers are planning guidance pinned to the single statutory deadline; the only regulatory date is May 28, 2027 (§5.9). FileFlo does not stand up your SMS, author your SMS manual, or replace your safety manager. Always confirm your specific obligations, compliance path, and deadline with your assigned FSDO principal inspector and qualified aviation counsel. Regulatory citations were verified against the Cornell Legal Information Institute eCFR text; FAA Advisory Circular 120-92D and FAA Notice 8900.700 are FAA guidance, not regulation.
Start the clock now. Let FileFlo keep the evidence.
You run the SMS through its 24-to-6-month timeline; FileFlo captures every record as it happens, classifies it against the right Part 5 section, tracks the §5.97 retention clocks, and produces a declaration-ready evidence binder when May 28, 2027 arrives. Starter at $89/mo · Professional at $299/mo · No credit card required.
5-day free trial · No credit card required · Cancel anytime