The Part 135 SMS requirements come from 14 CFR Part 5, and the 2024 FAA final rule makes them mandatory for every Part 135 operator by May 28, 2027. Part 5 requires a Safety Management System built on four components: Safety Policy (§5.21–§5.27, including a designated accountable executive), Safety Risk Management (§5.51–§5.55), Safety Assurance (§5.71–§5.75), and Safety Promotion (§5.91–§5.93). On top of those, §5.95 requires you to document the SMS and §5.97 sets specific record-retention periods. There is no aircraft-count threshold — every Part 135 certificate holder is covered, plus §91.147 air-tour operators. The FAA does not grade whether your flying is safe; it grades whether your records prove you run a working system for managing safety.
This page is the requirements breakdown. Need the deadline and timeline?
For the date itself, the declaration of compliance, and how the 36-month window works, read our FAA Part 135 SMS 2027 deadline guide and the Part 135 SMS implementation timeline. This article focuses on what the rule requires.
What a Part 135 SMS Is — in Plain English
A Safety Management System is a formal, documented way of running your safety program as a system instead of a binder of policies. Rather than reacting to events after they happen, an SMS requires you to proactively look for hazards, decide how risky they are, put controls in place before something changes, and then keep checking whether those controls actually work. That loop — find, assess, control, verify — is the whole idea.
The FAA codified the framework in 14 CFR Part 5, which is modeled on the ICAO SMS standard. Part 5 is a standalone regulation — not a subpart of Part 135 — that defines the SMS framework. Part 121 air carriers have lived under it since 2018. The 2024 final rule amended the Part 5 applicability section (§5.1) to add Part 135 on-demand charter and commuter operators and §91.147 air-tour operators, and added §5.9, which sets the May 28, 2027 compliance date.
The SMS is the program. The records are the proof.
A functioning SMS does not just require policies — it requires evidence the policies are being executed. Every hazard assessment, internal audit, safety meeting, training event, and corrective action generates a record the FAA can request during surveillance. An operator who builds an SMS without a disciplined records system discovers the gap at the first surveillance evaluation — not before. This is precisely the layer FileFlo addresses (and the one piece it does not touch is the safety program itself).
For the closely related questions of what an SMS manual must contain and what the recordkeeping looks like in practice, see the required sections of a Part 135 SMS manual and Part 135 SMS recordkeeping requirements.
The Four Components of an Aviation SMS (the Four Pillars)
Part 5 organizes the SMS into four components — frequently called the four pillars. Together they form a closed loop: policy sets the intent and accountability, risk management identifies and controls hazards, safety assurance verifies the system works, and safety promotion makes sure everyone can operate it. Below is what each component requires under the CFR — and the records each one produces.
Safety Policy
14 CFR §5.21 – §5.27
What it requires: A written safety policy signed by the accountable executive, a formally designated accountable executive, and management personnel assigned specific SMS duties.
The requirement, by CFR
- Safety objectives and a stated commitment to fund and resource the SMS (§5.21(a))
- A safety reporting policy defining how employees report hazards (§5.21(a))
- A policy defining unacceptable behavior and disciplinary conditions (§5.21(a))
- An emergency response plan for the transition from normal to emergency operations (§5.21(a))
- A single accountable executive with final authority and control of money and people (§5.25)
- Designated management personnel who coordinate SMS implementation and report performance (§5.25)
Records it generates
- Signed safety policy statement (accountable executive)
- Accountable executive designation letter
- SMS manual / organizational structure
- SMS responsibilities matrix by role
- Emergency response plan documentation
Safety Risk Management (SRM)
14 CFR §5.51 – §5.55
What it requires: A process to identify hazards and to assess, accept, and control safety risk before you implement new systems, revise existing ones, or develop new operational procedures.
The requirement, by CFR
- Apply SRM to new systems, revised systems, and new operational procedures (§5.51)
- A system-analysis and hazard-identification process (§5.53)
- A defined process to assess risk and determine what is acceptable (§5.55)
- Develop safety risk controls needed as a result of the assessment (§5.55)
- Confirm the residual risk is acceptable before the control is implemented (§5.55)
Records it generates
- Hazard identification worksheets for operational changes
- Risk assessment matrices (likelihood × severity)
- Risk-control decisions and implementation records
- Change-management documentation for safety-affecting changes
- Residual-risk acceptance records (per the §5.55 acceptance process)
Safety Assurance
14 CFR §5.71 – §5.75
What it requires: Processes to monitor operations and the SMS, run a confidential employee reporting system, audit your own processes, measure safety performance, and continuously improve.
The requirement, by CFR
- Monitor operational processes and the operating environment for change (§5.71)
- Audit and evaluate operational processes and the SMS itself (§5.71)
- Investigate incidents, accidents, and reports of regulatory non-compliance (§5.71)
- Operate a confidential employee reporting system for hazards and concerns (§5.71)
- Analyze the data collected and assess safety performance (§5.71, §5.73)
- Continuously improve the SMS based on the findings (§5.75)
Records it generates
- Internal safety audit reports with findings and corrective actions
- Safety performance indicator (SPI) trend data
- Confidential employee report logs and dispositions
- Corrective and preventive action plans with closure dates
- Management-review minutes and continuous-improvement records
Safety Promotion
14 CFR §5.91 – §5.93
What it requires: SMS training so each person can attain and maintain the competencies for their SMS duties, plus a means of communicating safety information across the organization.
The requirement, by CFR
- Provide SMS training to each individual identified under §5.23 (§5.91)
- Ensure individuals attain and maintain the competencies for their SMS duties (§5.91)
- Communicate SMS policies, processes, and tools relevant to each role (§5.93)
- Communicate hazard information and why safety actions were taken (§5.93)
- Explain why safety procedures are introduced or changed (§5.93)
Records it generates
- SMS initial training completion records per person
- Recurrent SMS training records
- Competency assessment documentation
- Safety communication logs (bulletins, newsletters, meeting minutes)
- Training curriculum and course materials
The four components at a glance
| Component | Primary CFR | Core requirement |
|---|---|---|
| Safety Policy | §5.21–§5.27 | Signed policy + accountable executive + assigned duties |
| Safety Risk Management | §5.51–§5.55 | Identify hazards; assess, accept, and control risk before changes |
| Safety Assurance | §5.71–§5.75 | Monitor, audit, run confidential reporting, measure, and improve |
| Safety Promotion | §5.91–§5.93 | SMS training to competency + safety communication |
See where your SMS evidence stands today
FileFlo's free FAA readiness score takes about 3 minutes and surfaces the document gaps most likely to generate findings at a Part 5 SMS surveillance evaluation. It checks your evidence — it does not build your SMS. No signup required.
5-day free trial · No credit card required · Cancel anytime
SMS Documentation (§5.95) and Record Retention (§5.97)
Two often-overlooked sections turn the four components into hard obligations. §5.95 requires every operator with an SMS to develop and maintain SMS documentation — your safety policy and your SMS processes and procedures. In practice, that is the SMS manual that ties the four components together. (For what belongs in it, see the required sections of a Part 135 SMS manual.)
§5.97 then sets the retention clocks — and they are specific. This is where many operators trip, because the four record families do not all keep the same length of time:
| Record type | CFR | Retention period |
|---|---|---|
| Safety Risk Management outputs (hazard analyses, risk assessments, risk-control decisions) | §5.97(a) | As long as the control remains relevant to the operation |
| Safety Assurance outputs (audits, evaluations, monitoring data) | §5.97(b) | Minimum of 5 years |
| SMS training records (per individual, under §5.91) | §5.97(c) | As long as the individual is employed |
| Safety communications (under §5.93 and §5.57) | §5.97(d) | Minimum of 24 consecutive calendar months |
The takeaway: an internal audit report is a five-year document, a risk control stays on file for as long as it is in force, training records live for the duration of employment, and safety communications hold for at least two years. A spreadsheet of expiration dates will not survive a surveillance request — the retention rules vary by record family, and the inspector will ask you to produce the specific evidence. For the full recordkeeping picture, see Part 135 SMS recordkeeping requirements and the broader aviation records retention schedule.
Who the Rule Applies To — and the One Date That Governs All of It
The 2024 final rule amended 14 CFR §5.1 so that every person authorized to conduct operations under Part 135 must have an SMS, and §5.9 sets a single compliance date of May 28, 2027 for existing operators. The same date applies to §91.147 air-tour Letter of Authorization holders and to certain Part 21 certificate holders. New applicants on or after May 28, 2024 must have the SMS in place to obtain their authorization.
No fleet-size threshold
Every Part 135 certificate holder is covered — a single-aircraft air taxi the same as a multi-aircraft commuter operator. There is no aircraft-count cutoff inside Part 135.
One date, not a phased schedule
There is a single May 28, 2027 compliance date — not staggered, fleet-size-dependent dates, and not a later date for single-pilot operators.
Single-pilot ≠ exempt
§5.9(e) exempts a single-pilot operator from a specific list of sub-paragraphs — §5.21(a)(4) and (a)(5), §5.23(a)(2), (a)(3) and (b), §5.25(b)(3) and (c), §5.27(a) and (b), §5.71(a)(7), §5.93, and §5.97(d) — not whole sections. Most of Part 5 still applies, and the §5.97(a)-(c) record-retention rules still apply. It does not move the deadline.
A common misconception to retire
There is no “10-aircraft threshold” and no November 2027 date in the rule. The applicability is by certificate, not by fleet size, and the date is a single May 28, 2027. If you operate under Part 135 in any capacity, plan to the same deadline as everyone else, and confirm your specific obligations with your assigned FSDO principal inspector.
Part 145 repair stations are not swept into the general Part 5 mandate by this rule, though the FAA encourages voluntary adoption and U.S. stations holding EASA Part-145 approval face SMS expectations through the bilateral framework. For single-pilot and small-operator specifics, see Part 135 single-pilot operator records and single-pilot Part 135 SMS.
How SMS Records Sit Alongside the Records You Already Keep
The SMS does not create a parallel record-keeping universe — it adds record obligations that reference the compliance stack you already maintain. A Safety Risk Management assessment for a new route or aircraft type will reference your existing Part 135 records. Safety Promotion training records link to the same personnel files used for training-program recordkeeping and required management personnel qualifications. And Safety Assurance investigations of incidents and accidents intersect with NTSB Part 830 reporting records and service difficulty reports.
When the inspector arrives, that web of references is the point of failure — the audit, the training record, the drug-and-alcohol program file, and the maintenance discrepancy log all have to be produced on demand and tied back to the SMS. Operators who already keep clean drug-and-alcohol program records and mechanical irregularity records are already most of the way to an audit-ready SMS evidence set — and corporate flight departments should also review Part 91 flight-department records. Repair-station partners feeding a Part 135 operation should keep their RSQCM current too. Knowing exactly what a surveillance evaluation looks for is the difference — see how to prepare for a Part 135 FAA surveillance audit.
Where FileFlo Fits: The Compliance Evidence Layer, Not the SMS Itself
FileFlo holds the proof — it does not provide, author, or run the SMS
FileFlo is a compliance document intelligence platform — a proof layer that sits alongside your SMS software, operations platform, and dispatch stack. It classifies 600+ document types against the governing CFR, version-controls them, tracks expirations, and produces inspector-format audit binders. It does not build your SMS, write your SMS manual, replace a safety manager, run your safety program, or give legal advice. Its job is to make your SMS records produce-on-demand and audit-ready.
The Part 135 SMS requirements create a document-management challenge that is structurally different from what most operators have faced. Prior obligations — pilot currency, operations-manual revision control, maintenance records — generated records that were largely static once created. SMS records are dynamic: risk assessments are updated when operations change, corrective actions carry open/closed status, training records accumulate recurrently, and audit reports form a cycle that references prior findings. That is exactly the kind of evolving evidence that gets lost across shared drives and email threads.
Classification against 14 CFR Part 5
Every SMS record — risk assessments, training completions, audit reports, corrective actions, the signed safety policy — is automatically classified against the specific Part 5 section it satisfies, so nothing is misrouted to the wrong component.
Expiration tracking for recurrent SMS records
Safety Promotion training carries recurrence cycles and Safety Assurance audits create expected record dates. FileFlo surfaces upcoming gaps 90, 60, and 30 days out — before they become a finding, not after.
One-click SMS evidence binder
When your FAA Principal Operations Inspector requests SMS documentation, FileFlo assembles a Part 5-organized evidence binder — all four components, indexed by section — in about 60 seconds rather than by hand.
Coverage across the full Part 135 stack
Alongside Part 5, FileFlo classifies records against the wider Part 135 footprint — operations-manual revision history, pilot currency, recordkeeping, and Part 120 drug-and-alcohol program records — so the SMS evidence and the underlying compliance records live in one place.
Starter Plan
$89/mo
Up to 100 documents/month · 3 users
For solo owner-operators and small teams starting their SMS documentation program.
Professional Plan
$299/mo
Unlimited documents + users · audit trail · employee auto-detection
For Part 135 operators managing the full SMS evidence load across all four components.
Frequently Asked Questions
What are the Part 135 SMS requirements under the 2024 FAA rule?
The FAA's 2024 Safety Management System final rule requires every Part 135 operator to build, document, operate, and evidence an SMS that meets all of 14 CFR Part 5 by May 28, 2027. Part 5 organizes the SMS into four components: (1) Safety Policy — a signed safety policy, a designated accountable executive, and assigned management duties (§5.21–§5.27); (2) Safety Risk Management — a process to identify hazards and assess and control risk before operational changes (§5.51–§5.55); (3) Safety Assurance — monitoring, auditing, and performance measurement that proves the system works (§5.71–§5.75); and (4) Safety Promotion — SMS training and safety communication (§5.91–§5.93). On top of those, §5.95 requires you to document the SMS and §5.97 sets concrete record-retention periods. The requirement applies to every Part 135 certificate holder regardless of fleet size — there is no aircraft-count threshold — and to §91.147 air-tour operators.
What does the FAA SMS rule actually require?
At its core, the FAA SMS rule (14 CFR Part 5) requires four things to exist and be evidenced. First, top-down accountability: §5.25 makes you name one accountable executive who controls the money and people and holds ultimate responsibility for safety performance, and §5.21 requires a written safety policy that executive signs. Second, a forward-looking risk process: §5.51–§5.55 require you to identify hazards and formally assess and control risk before you change a system, procedure, or operation. Third, a feedback loop: §5.71–§5.75 require you to monitor operations, run a confidential employee reporting system, audit your own processes, measure safety performance, and continuously improve. Fourth, people who can run it: §5.91 requires SMS training and §5.93 requires safety communication. The rule does not grade whether your flights are safe — it grades whether your documentation proves you have a working system for managing safety.
What are the four components (pillars) of an aviation SMS?
Under 14 CFR Part 5 the four SMS components — often called the four pillars — are Safety Policy, Safety Risk Management, Safety Assurance, and Safety Promotion. Safety Policy (§5.21–§5.27) sets management commitment, the accountable executive, and a safety reporting policy. Safety Risk Management (§5.51–§5.55) is the analytical engine: identify hazards, assess the risk, decide whether it is acceptable, and apply controls before the change goes live. Safety Assurance (§5.71–§5.75) is the verification loop: monitor, audit, measure safety performance, and improve. Safety Promotion (§5.91–§5.93) is training and communication so everyone can operate the system. The FAA models these on the ICAO SMS framework, and each pillar generates the records an inspector reviews during surveillance.
Does Part 135 require an SMS, and is there an aircraft-size threshold?
Yes. The 2024 final rule amended 14 CFR §5.1 so that every person authorized to conduct operations under Part 135 must have an SMS, and §5.9 sets a single compliance date of May 28, 2027. There is no aircraft-count or fleet-size threshold inside Part 135 — a single-aircraft, single-pilot air taxi is covered the same as a multi-aircraft commuter operator. The same May 28, 2027 date also applies to §91.147 air-tour Letter of Authorization holders and certain Part 21 certificate holders. Single-pilot operators are not exempt from the deadline; §5.9(e) only scales back which specific Part 5 sections apply to an organization with one pilot who is the sole individual. Part 145 repair stations are not swept into the general Part 5 mandate by this rule.
When is the Part 135 SMS deadline?
The compliance date is May 28, 2027 for existing operators. Under §5.9, any person authorized to conduct Part 135 operations (and §91.147 LOA holders) must implement an SMS and submit a declaration of compliance to the FAA by that date. There is one single date — not a phased, fleet-size-dependent schedule, and not a later date for single-pilot operators. New applicants on or after May 28, 2024 must have the SMS in place as part of obtaining their authorization. Because the window is fixed, the practical work — building the manual, designating the accountable executive, standing up the risk and assurance processes, and accumulating real records — has to start well before the date. See our deadline-focused breakdown for the timeline detail.
How long must Part 135 operators retain SMS records?
The retention rules are spelled out in 14 CFR §5.97 and they are specific. Outputs of Safety Risk Management processes — hazard analyses, risk assessments, and risk-control decisions — must be retained for as long as the control remains relevant to the operation (§5.97(a)). Outputs of Safety Assurance processes — audits, evaluations, and monitoring data — must be retained for a minimum of 5 years (§5.97(b)). Training records under §5.91 must be retained for as long as the individual is employed (§5.97(c)). Records of safety communications under §5.93 (and §5.57) must be retained for a minimum of 24 consecutive calendar months (§5.97(d)). In plain terms: an internal audit is a five-year document, a risk control stays on file as long as it is in force, and training records live for the life of employment.
Who is the accountable executive under the SMS rule?
Under 14 CFR §5.25, you must designate a single accountable executive who, irrespective of other functions, is the final authority over the operations conducted under your certificate, controls the financial and human resources required for those operations, and retains ultimate responsibility for the safety performance of the operations. That same person must sign the safety policy (§5.21(b)) and regularly review safety performance and direct action on substandard performance. Because §5.25 requires control of both the money and the people, at most Part 135 operators the accountable executive is the owner, president, or CEO — not the Director of Operations or a hired safety manager. §5.25 also requires the accountable executive to designate enough management personnel to coordinate SMS implementation, facilitate hazard identification, and report SMS performance back up. The designation must be formal and documented.
What is a Part 135 SMS, in plain English?
A Safety Management System is a formal, documented way of running your safety program as a system rather than a binder. Instead of reacting to events, an SMS requires you to proactively look for hazards, decide how risky they are, put controls in place before something changes, then continuously check whether those controls are working. 14 CFR Part 5 is the FAA regulation that defines what a compliant SMS must contain. For a Part 135 operator the practical reality is that an SMS produces a continuous stream of records — a signed safety policy, hazard and risk worksheets, internal audit reports, corrective-action logs, training completions, and safety bulletins — and the FAA evaluates those records during surveillance to confirm the system is real and operating. The SMS is the program; the records are the proof.
Chad Griffith
Founder, FileFlo — compliance document intelligence
This article is written from a compliance-document perspective: what 14 CFR Part 5 requires and the records each requirement produces. It is not legal advice, and it is not safety-program or SMS-design advice. FileFlo classifies and proves compliance records audit-ready; it does not build, author, or operate your SMS. Confirm your individual requirements and compliance date with your assigned FSDO principal inspector and qualified aviation counsel.
Keep your SMS evidence ahead of the deadline
FileFlo classifies every SMS record against the correct Part 5 section, surfaces expiring training and audit records before they become findings, and produces a complete FAA-organized evidence binder in about 60 seconds. It proves your SMS records on demand — it does not build your SMS. Starter at $89/mo · Professional at $299/mo · No credit card required.
5-day free trial · No credit card required · Cancel anytime