SMS recordkeeping under 14 CFR Part 5 has two layers. Under §5.95 you must develop and maintain SMS documentation — the safety policy and the SMS processes and procedures (your SMS manual). Under §5.97 you must retain the records the SMS generates: safety risk management outputs (kept as long as the control stays relevant), safety assurance outputs (minimum 5 years), each individual's training record (as long as they are employed), and safety communication records (minimum 24 months). Every Part 135 operator must have this in place by May 28, 2027 — the documentation describes the system, the records prove it is running.
New to the 2027 mandate itself? Start with the FAA Part 135 SMS 2027 deadline explainer for the four-component overview, then come back here for the records detail. For the full Part 135 records picture beyond SMS, see what records a Part 135 operator must keep.
SMS Recordkeeping Is Two Obligations, Not One
The single most common misunderstanding about Part 5 recordkeeping is treating “the SMS manual” and “the SMS records” as the same thing. They are governed by two different sections, and an FAA surveillance evaluation looks for both.
§5.95 — SMS Documentation
The descriptive layer. §5.95 requires you to develop and maintain documentation consisting of (a) the safety policy and (b) the SMS processes and procedures. This is your SMS manual: the document that explains how your organization runs safety policy, safety risk management, safety assurance, and safety promotion.
Question it answers: “How is your SMS supposed to work?”
§5.97 — SMS Records
The evidentiary layer. §5.97 requires you to retain the outputs the SMS produces as it operates — hazard analyses, audit reports, training records, communication logs — for the specific periods the rule sets. These records are the proof that the manual is more than words.
Question it answers: “Show me it actually ran.”
A beautiful SMS manual with no §5.97 records is still a finding
Operators who buy a polished SMS manual template and never generate the underlying records pass the §5.95 test and fail the §5.97 test. An inspector who asks for the risk assessment behind a recent operational change, the corrective action for last year's audit finding, or the training record for a specific crew member is testing §5.97 — and an empty folder is a documentation failure regardless of how good the manual reads.
Both obligations apply to every Part 135 certificate holder regardless of fleet size — there is no aircraft-count threshold in the 2024 rule, and the compliance date is the same May 28, 2027 for all affected operators. (Single-pilot operators get certain §5.9 exemptions but the same date; more on that below.) If you are still mapping the broader compliance picture, our guide to the records a Part 135 operator must keep shows where SMS records sit alongside pilot, maintenance, and operations records.
What Records Does an SMS Require? The Four Categories
Combining §5.95 and §5.97, a Part 135 SMS produces four categories of records. The first is the descriptive documentation; the other three are the operational outputs §5.97 tells you to retain — and each carries a different retention clock. This is the working checklist most operators are missing.
SMS Documentation (§5.95)
14 CFR §5.95The descriptive layer. §5.95 requires the operator to develop and maintain SMS documentation consisting of (a) the safety policy and (b) the SMS processes and procedures — the SMS manual that explains how all four components operate.
Maintained current; reviewed by the accountable executive; superseded versions retained and marked
Records in this category
- Safety policy statement, signed by the accountable executive (§5.95(a))
- The SMS manual describing processes and procedures for all four components (§5.95(b))
- Organizational structure and SMS responsibilities by role
- Revision history and version control for the manual and policy
Safety Risk Management Records (§5.97(a))
14 CFR §5.97(a)The outputs of the safety risk management processes in Subpart C. These are the hazard analyses and risk decisions the SMS produces whenever operations change or a hazard is identified.
Retain for as long as the risk control remains relevant to the operation
Records in this category
- Hazard identification worksheets for operational changes and reported hazards
- Risk assessment matrices with likelihood and severity ratings
- Risk-control decisions and the basis for accepting residual risk
- Change-management documentation for operations affecting safety
Safety Assurance Records (§5.97(b))
14 CFR §5.97(b)The outputs of the safety assurance processes in Subpart D — the monitoring, auditing, and performance layer that verifies the SMS is working. This is the highest-volume, longest-retention record category for most operators.
Retain for a minimum of 5 years
Records in this category
- Internal safety audit and evaluation reports with findings
- Continuous monitoring and safety event investigation outputs
- Safety performance indicator and target data (trend tracking)
- Corrective and preventive action records with closure dates
- Management review minutes and outcomes
Training & Communication Records (§5.97(c)–(d))
14 CFR §5.97(c)–(d)Safety promotion records. §5.97(c) requires a per-individual training record retained for as long as the person is employed; §5.97(d) requires safety-communication records retained for at least 24 months.
Training: as long as the individual is employed · Communications: minimum 24 consecutive calendar months
Records in this category
- SMS training completion record for each individual under §5.91 (§5.97(c))
- Competency assessment documentation per person
- Safety communication logs — bulletins, newsletters, meeting minutes (§5.97(d))
- Distribution / acknowledgment records for safety communications
Not sure which of these you already have on file?
The free FAA readiness score surfaces the SMS and Part 135 records most likely to be missing or expired before a surveillance evaluation — in about 3 minutes, no signup.
How Long Must SMS Records Be Kept? The §5.97 Retention Clocks
There is no single retention period for SMS records. §5.97 sets a different clock for each record type, and getting them straight is what separates an audit-ready operator from one scrambling during an evaluation. Here is the rule, section by section.
| Record type | CFR | Minimum retention |
|---|---|---|
| Safety risk management outputs (hazard analyses, risk assessments, risk-control decisions) | §5.97(a) | As long as the risk control remains relevant to the operation |
| Safety assurance outputs (audits, monitoring, performance data, investigations) | §5.97(b) | Minimum 5 years |
| Training record for each individual (under §5.91) | §5.97(c) | As long as the individual is employed by the operator |
| Safety communication records (under §5.93) | §5.97(d) | Minimum 24 consecutive calendar months |
Two of these clocks are easy to mishandle. The §5.97(a) risk management clock is event-driven, not calendar-driven: a risk assessment and its risk-control decision stay on file as long as that control is in place — retire the control, and only then does the obligation end. The §5.97(c) training clock is tied to employment, not a fixed term: when a pilot, dispatcher, or maintenance contact leaves, the as-long-as-employed obligation for their SMS training record ends (though many operators retain longer for defensibility and for Part 135 training-program recordkeeping reasons). The §5.97(b) safety-assurance clock is the only long, fixed one: five years minimum, which means you cannot discard last year's audit cycle just because this year's is complete.
SMS retention sits on top of your existing Part 135 retention schedule
These §5.97 periods are in addition to — not a replacement for — the retention rules you already follow for pilot, maintenance, and operations records. Our aviation records retention schedule lays the SMS clocks alongside the rest of the Part 135 stack so nothing gets discarded early.
SMS Document Control: What “Maintain” Actually Means
§5.95 says you must “develop and maintain” the SMS documentation, and §5.97 says you must “maintain” and retain the records. In aviation practice, “maintain” means a document-control discipline — current versions, tracked revisions, defensible retention, and on-demand retrieval. Part 5 does not mandate a specific software or filing format, so the discipline is on you to enforce.
Version control on the manual and policy
The SMS manual and safety policy should carry revision numbers and dates, be reviewed by the accountable executive, and have superseded versions retained but clearly marked. An inspector should be able to see which version was in effect on any given date.
Each record filed against the Part 5 process that produced it
A risk assessment is a §5.97(a) record. An audit report is a §5.97(b) record. A training certificate is a §5.97(c) record. Filing by source process — not in a generic “safety” folder — is what makes a surveillance request answerable in minutes.
A retention clock per record type
Document control has to track four different clocks at once: the event-driven §5.97(a) clock, the 5-year §5.97(b) clock, the employment-tied §5.97(c) clock, and the 24-month §5.97(d) clock. Spreadsheets drift; this is where most manual systems fail.
On-demand retrieval under inspection
The real test is not storage — it is retrieval while a Principal Operations Inspector is waiting. If producing a specific record means searching shared drives and email threads, document control has failed even if the record technically exists.
Single-pilot operators carry a lighter — but not empty — version of this. Under §5.9(e), an operator with a single pilot who is the sole individual performing all necessary SMS functions is exempt from several specific sections — including §5.93 and the §5.97(d) safety-communication record requirement, since there is no separate workforce to communicate to. But the §5.95 documentation, the §5.97(a) risk management outputs, and the §5.97(c) training record still apply, and the deadline is still May 28, 2027. Our single-pilot Part 135 records guide walks through the scaled set in detail.
Prove your SMS records on demand — not assemble them under pressure
FileFlo classifies each SMS record against the correct Part 5 section, tracks all four §5.97 retention clocks, and produces an inspector-format evidence binder in seconds. Check your readiness free, or start a trial and load your first documents today.
5-day free trial · No credit card required · Cancel anytime
Where FileFlo Fits: The Records Proof Layer, Not the SMS
FileFlo holds and proves the records — it does not run your SMS
FileFlo is a compliance document intelligence platform: a proof layer that stores, classifies, version-controls, and expiration-tracks your §5.95 documentation and §5.97 records, and generates inspector-format binders on demand. It does not author your SMS manual, perform your hazard analyses or audits, replace your safety manager, run your SMS, or provide a safety program or legal advice. It sits alongside your SMS and proves the records exist and are audit-ready.
§5.95 and §5.97 are, in essence, a records-control mandate — which is exactly the problem FileFlo was built for. The challenge is not that operators lack the ability to write a manual or run an audit; it is that the records those activities generate end up scattered across shared drives, inboxes, and a safety manager's laptop, with no version control and no retention tracking. When a Principal Operations Inspector asks for a specific record during an SMS surveillance evaluation, that scatter becomes a live failure.
Classification against 14 CFR Part 5
Upload an SMS record and FileFlo classifies it against the specific Part 5 section it satisfies — a risk assessment to §5.97(a), an audit report to §5.97(b), a training certificate to §5.97(c) and the individual. No manual filing, no records misrouted to a generic safety folder.
All four §5.97 retention clocks, tracked automatically
FileFlo tracks the event-driven risk management clock, the 5-year safety-assurance clock, the employment-tied training clock, and the 24-month communication clock — and surfaces gaps and expirations 90, 60, and 30 days out, before they become findings.
Version control on the SMS manual and policy
The §5.95 documentation carries revision history so the version in effect on any date is recoverable, and superseded versions are retained and marked rather than overwritten.
One-click SMS evidence binder
When the FAA requests SMS documentation, FileFlo generates a complete, Part 5-organized evidence binder — §5.95 documentation plus the §5.97 record categories, indexed by section — in seconds rather than days. The same binder supports ACSF, IS-BAO, and ARGUS audit prep.
SMS records also cross-reference the rest of your compliance stack. A risk assessment for a new aircraft type touches your aircraft and maintenance records retention; an SMS training record sits next to the pilot training records under Part 135 training-program recordkeeping; and an inspector preparing for a Part 135 FAA surveillance audit will expect to see SMS records produced as cleanly as the rest. FileFlo classifies the full Part 135 footprint, so SMS records do not become a parallel filing universe.
Starter Plan
$89/mo
Up to 100 documents/month · 3 users
For solo owner-operators and small teams starting to organize their SMS documentation.
Professional Plan
$299/mo
Unlimited documents + users · audit trail · employee auto-detection
For Part 135 operators managing the full §5.97 record load across all four categories.
Frequently Asked Questions
What records does an SMS require under 14 CFR Part 5?
14 CFR Part 5 requires two layers of SMS records. First, under §5.95, every operator must develop and maintain SMS documentation consisting of (a) the safety policy and (b) the SMS processes and procedures — in practice, the SMS manual that describes how all four components work. Second, under §5.97, the operator must maintain the operational records the SMS actually generates: the outputs of safety risk management (hazard analyses, risk assessments, risk-control decisions), the outputs of safety assurance (audits, monitoring data, performance assessments), a training record for each individual, and records of safety communications. The §5.95 documentation describes the system; the §5.97 records prove it is running. Both are what an FAA principal inspector reviews during an SMS surveillance evaluation.
How long must Part 135 operators keep SMS records?
The retention periods are set out in 14 CFR §5.97 and they are specific. Safety risk management outputs must be retained for as long as the risk control remains relevant to the operation (§5.97(a)) — so a risk assessment for an active operational change stays on file as long as that change and its controls are in effect. Safety assurance outputs — internal audits, evaluations, monitoring data, and performance assessments — must be retained for a minimum of 5 years (§5.97(b)). SMS training records for each individual must be retained for as long as that individual is employed by the operator (§5.97(c)). Records of safety communications under §5.93 must be retained for a minimum of 24 consecutive calendar months (§5.97(d)). There is no single 'keep everything for X years' rule — the clock is different for each record type.
What is the difference between §5.95 SMS documentation and §5.97 SMS records?
They are two distinct obligations. 14 CFR §5.95 (SMS documentation) requires the operator to develop and maintain the documents that describe the system — the safety policy under (a) and the SMS processes and procedures under (b). This is the static, descriptive layer: your SMS manual and the procedures that explain how you identify hazards, assess risk, audit performance, and train people. 14 CFR §5.97 (SMS records) requires the operator to retain the dynamic outputs the system produces as it operates — the actual hazard analyses, audit reports, training records, and communication logs, each with its own retention period. A common audit finding is having a polished SMS manual (§5.95) but no §5.97 records demonstrating the manual is being followed.
How long are safety assurance records kept under §5.97?
Under 14 CFR §5.97(b), records of the outputs of safety assurance processes — described in Subpart D of Part 5 — must be retained for a minimum of 5 years. Safety assurance is the monitoring layer of the SMS: it includes internal audits, continuous monitoring, safety performance indicator and target data, investigations of safety events, and the management reviews that confirm the SMS is effective. Practically, that means an internal audit report, a corrective-action record, or a set of safety performance indicator trend data is a five-year document. Operators frequently under-retain here because audit cycles are annual and it is easy to discard older cycles — but the rule requires five years minimum.
Do single-pilot Part 135 operators have SMS recordkeeping requirements?
Yes. Single-pilot Part 135 operators are subject to 14 CFR Part 5 and face the same May 28, 2027 compliance date as everyone else — §5.9 does not push their deadline later. What §5.9(e) does is exempt an operator with a single pilot who is the sole individual performing all necessary SMS functions from certain specific sections. Notably, §5.9(e) lists §5.97(d) — the safety-communication record requirement — and §5.93 (safety communication) among the exemptions, which makes sense because there is no one else to communicate safety information to. But the core records still apply: a single-pilot operator must still develop the §5.95 SMS documentation and must still retain its §5.97(a) safety risk management outputs and §5.97(c) training records. See our dedicated guide on single-pilot Part 135 records for the full scaled requirement set.
What does SMS document control look like in aviation?
SMS document control is the discipline of managing the §5.95 documentation and §5.97 records so they are current, version-tracked, and retrievable. In practice it means: the SMS manual and safety policy carry revision numbers and dates and are reviewed by the accountable executive; superseded versions are retained but clearly marked; each §5.97 record is filed against the Part 5 process that produced it; retention clocks are tracked per record type (the 5-year safety-assurance clock, the as-long-as-employed training clock, the 24-month communication clock); and the operator can produce any requested record on demand during an FAA surveillance evaluation. Part 5 does not prescribe a specific software or filing format — it requires that the documentation be developed, maintained, and the records retained for the stated periods. FileFlo is one way to enforce that document-control discipline as a proof layer alongside your SMS.
Are SMS training records part of the recordkeeping requirement?
Yes. 14 CFR §5.97(c) requires the operator to maintain a record of all training provided under §5.91 for each individual, and to retain that record for as long as the individual is employed by the operator. §5.91 requires training for each individual identified in §5.23 so they attain and maintain the competencies needed to perform their SMS duties. So SMS training records are a named, per-person recordkeeping obligation — not an optional add-on. The retention trigger is employment status, not a fixed number of years: when an individual leaves, the as-long-as-employed clock for their SMS training record ends, though operators often retain longer for defensibility. These records sit alongside, and are distinct from, the pilot training records required under Part 135 itself.
Does FileFlo run my Part 135 SMS or store the records?
FileFlo stores, classifies, version-controls, and expiration-tracks your SMS records — it does not run your SMS. FileFlo is a compliance document intelligence platform: a proof layer that holds the §5.95 documentation and §5.97 records, files each against the correct Part 5 section, tracks the different retention clocks, surfaces gaps before they become findings, and generates an inspector-format evidence binder on demand. It does not author your SMS manual, perform your hazard analyses or audits, replace your safety manager, or provide a safety program — those are the SMS itself, which FileFlo sits alongside. Think of it as the filing cabinet that proves your SMS records exist and are audit-ready, not the system that produces them. FileFlo also does not provide legal advice or claim any SOC 2 certification.
Keep your SMS records audit-ready before May 28, 2027
FileFlo classifies every §5.95 and §5.97 record against the correct Part 5 section, tracks all four retention clocks, and generates a complete FAA-organized evidence binder on demand. It holds the proof your SMS is running — it does not run your SMS. Starter at $89/mo · Professional at $299/mo · No credit card required.
5-day free trial · No credit card required · Cancel anytime