Direct Answer
The FAA Voluntary Disclosure Reporting Program (VDRP) — set out in FAA Advisory Circular AC 00-58 — lets a Part 135 certificate holder that discovers it has apparently violated a regulation disclose it to the FAA and, if five conditions are met, resolve the matter with a letter of correction instead of a civil penalty. It is FAA program guidance, not a CFR rule, and acceptance is at the FAA's discretion.
There are two clocks. You make an initial notification to your FAA principal inspector promptly after discovery — ordinarily within 24 hours — and then submit a detailed written report ordinarily within 10 working days. The five conditions: you notified promptly; the violation was inadvertent (not reckless or intentional); it does not raise a question of your qualification; you took immediate corrective action; and you developed a comprehensive fix and implementation schedule, including a self-audit.
The written report is, at its core, a documented root cause + corrective action + proof package — the regulation involved, how the violation happened and was found, the immediate action taken, the systemic cause, the fix and schedule, and a self-audit. That is a records exercise as much as a legal one: an operator that can produce current, dated records quickly can assemble a credible disclosure on the program's timeline, while one reconstructing paperwork is fighting the clock.
VDRP Is a Program, Not a Regulation — and That Distinction Matters
The first thing to get right is what VDRP is. It is not a section of the Code of Federal Regulations — you will not find it cited as a "14 CFR" rule. It is an FAA program described in Advisory Circular AC 00-58 (current revision AC 00-58C, eff. July 1, 2024) and implemented through FAA internal guidance. That matters because the program operates on FAA policy and discretion, not on a regulatory entitlement. Meeting the conditions does not give you a legal right to a particular outcome; it makes you eligible for favorable handling that the FAA, in its discretion, generally extends when the conditions are satisfied.
The premise of the program is the FAA's broader compliance philosophy: when an operator with the will and the capability to comply makes an inadvertent mistake, the agency would rather see it found, disclosed, and fixed than litigated. A disclosed-and-corrected violation improves safety more than a hidden one that surfaces later in an accident or an audit. So VDRP rewards the behavior the system wants — proactive detection, prompt reporting, immediate correction, and a durable fix — by taking civil penalty off the table for the disclosed conduct when the program's terms are met.
That framing also tells you what VDRP is not. It is not immunity. It is not a shield for reckless or intentional conduct. It is not a way to make a serious qualification problem disappear. And it is not a substitute for actually fixing the underlying cause — the favorable outcome follows a satisfactory comprehensive fix, not merely a confession. For the bigger picture of how the FAA chooses between working a problem cooperatively and escalating it, see FAA compliance action vs. enforcement.
Timeliness is not a courtesy — it is a condition
The single most common way operators lose VDRP protection is timing. Prompt notification is one of the five qualifying conditions, so a disclosure made after the FAA already knows about the violation — from a ramp check, an accident, a complaint, or its own surveillance — may not qualify. The window is short by design: ordinarily within 24 hours of discovery. Knowing about a problem and waiting is the opposite of what the program protects.
The Five Conditions, in Plain English
AC 00-58 conditions acceptance of a voluntary disclosure on five elements. They are cumulative — all five must be met, not most of them. Here is what each one actually asks of you.
Prompt notification
You notified the FAA of the apparent violation promptly — ordinarily within 24 hours of discovering it. Timeliness is itself a condition: if the FAA finds out another way first, or you sit on a known problem, the disclosure can lose its protection.
Inadvertent — not reckless or intentional
The apparent violation was inadvertent. VDRP is built for honest, unintended noncompliance. Conduct that was reckless or intentional falls outside the program, which is one reason the facts matter so much.
No question of qualification
The apparent violation does not indicate a lack, or a reasonable question, of your qualification to hold the certificate. A one-off slip is different from a pattern that suggests the operation is not fit to hold its certificate.
Immediate corrective action
You took immediate action, satisfactory to the FAA, upon discovery to terminate the conduct that produced the violation. The first move is to stop the bleeding — ground the aircraft, pull the pilot, halt the practice — and document that you did.
A comprehensive fix
You have developed, or are developing, a comprehensive fix and implementation schedule satisfactory to the FAA — including a self-audit to confirm the fix worked. This is the heart of the program: not just an apology, but a documented plan that the systemic cause will not recur.
Two of these five are where disclosures most often fall apart, and both are records problems as much as legal ones. The immediate corrective action condition requires you to show — not just say — that you stopped the conduct on discovery: a grounding entry, a pilot pulled from the line, a procedure suspended, each dated. And the comprehensive fix condition requires a documented plan with owners, a schedule, and a self-audit proving it worked. An operator that took the right actions but cannot produce the dated proof is in a weaker position than the facts deserve.
What "inadvertent" tends to mean in practice
The inadvertent / not-reckless-or-intentional condition is the gate that keeps VDRP from being a tool to launder deliberate noncompliance. In practice the FAA looks at whether the operator had the will and capability to comply and simply made a mistake, versus whether it knew better and chose otherwise. A genuinely inadvertent gap — a tracking error, a missed recurring item, a misread requirement — is the program's home territory. A pattern of the same violation, or evidence the operator was aware and proceeded anyway, points the other way.
Because applying these five elements to a real situation is a judgment call — and because getting it wrong can mean disclosing your own violation without the protection you assumed — this is a decision to make with an aviation attorney and in coordination with your principal inspector, not from a checklist alone.
How a Part 135 Operator Actually Files a VDRP Report
The mechanics are a two-step sequence, and the two steps map to the two clocks. Coordinate the specifics with your FAA principal inspector — many operators submit through the FAA's web-based VDRP system — but the shape of the process is consistent.
Discover and stop the conduct
The clock starts at discovery. The first action is to terminate the conduct that produced the apparent violation — ground the aircraft, remove the pilot from the schedule, suspend the practice — and to document that you did, with dates and names. This is condition four, and it happens before, or simultaneously with, notification.
Make the initial notification — ordinarily within 24 hours
Notify your FAA principal inspector (POI/PMI) promptly after discovery, ordinarily within 24 hours, that you are disclosing an apparent violation under the VDRP. This initial notification identifies the apparent violation and signals your intent to disclose; it is not yet the full report. Getting it in promptly is what preserves the timeliness condition.
Submit the written report — ordinarily within 10 working days
After the FAA acknowledges the disclosure, submit the detailed written report — ordinarily within 10 working days of the initial notification. This is the substantive document: regulation involved, the apparent violation and how it was found, immediate action taken, root cause, and the comprehensive fix with its schedule and self-audit.
Work the fix to a letter of correction
The FAA reviews the report and works with you to confirm the root cause is identified and the comprehensive fix is satisfactory. The matter is typically tracked as an enforcement investigation that is then closed out with a letter of correction once the FAA and the operator agree on the fix and implementation schedule — and the self-audit confirms it worked.
A disclosure does not erase the duty to fix it
The favorable outcome — a letter of correction in lieu of civil penalty — follows a satisfactory comprehensive fix, not the act of disclosing. If the fix is not developed and implemented to the FAA's satisfaction, the protection the program offers may not materialize. The disclosure opens the door; the documented, completed corrective action is what walks you through it.
A disclosure runs on a 10-working-day clock and lives or dies on whether your records are current. See where your maintenance, pilot, and training records stand in two minutes.
The Written Report: Root Cause + Corrective Action + Proof
This is the heart of the program, and the place where a compliance-records system either helps you or watches you struggle. AC 00-58 lays out the elements the written report should contain. Read them as a single sentence and the through-line is unmistakable: here is what went wrong, here is exactly how and when we found it, here is what we did the moment we found it, here is the systemic reason it happened, here is our complete plan to make sure it never happens again, and here is the self-audit proving the plan worked.
The regulation(s) involved
The specific FAA regulation(s) that may have been violated — identified precisely, not described vaguely.
The apparent violation
A description of the apparent violation, including how long it went undetected and how and when it was discovered.
The immediate action taken
What you did immediately to terminate the conduct, when it was taken, and who was responsible for taking it.
The root cause
The root cause(s) and any systemic issues that led to the apparent violation — the why, not just the what.
The comprehensive fix
The proposed corrective actions, who is responsible for each, and a schedule for completing them.
The self-audit
A self-audit to verify the fix was implemented and actually worked — the proof that closes the loop.
Notice how much of that list is documentary. "How long it went undetected" is answered by your records. "When and how it was discovered" is answered by your audit or detection trail. "The immediate action taken, when, and by whom" is answered by dated entries. "The self-audit" is itself a produced artifact. The narrative legal judgment — was this inadvertent, does it qualify — belongs to you and your counsel. But the spine of the report is evidence, and evidence is either on file and retrievable, or it is being reconstructed against a deadline.
Why this is the page where records discipline pays off
A VDRP written report is, functionally, an audit binder assembled under time pressure: the regulation, the records that show the gap and its discovery, the dated corrective actions, and the proof the fix worked. Operators who keep their maintenance entries, pilot records, training files, and procedures current and instantly retrievable can build that binder in days. Operators whose records are scattered across inboxes, shared drives, and filing cabinets spend the 10-working-day window hunting for documents instead of writing the analysis.
That gap is not about whether you did the right thing operationally — it is about whether you can prove you did, on a clock. It is the same capability that carries you through a Part 135 surveillance audit and a records request during an investigation.
One caution worth stating plainly: never fabricate, backdate, or alter a record to make a disclosure look cleaner. Falsifying a maintenance record is itself a serious violation — historically under 14 CFR §43.12, which a 2025 FAA final rule reserved and consolidated into 14 CFR Part 3, §3.403 (fraudulent or intentionally false statements; incorrect statements at §3.405), effective Nov. 3, 2025 — and a falsified record turns a recoverable inadvertent mistake into intentional misconduct that VDRP does not protect. The honest, dated, complete record is the one that helps you. See falsification of maintenance records (now under 14 CFR Part 3 §3.403) and, for the legitimate way to fix a flawed entry, how to correct a maintenance logbook entry.
If you had to assemble a root-cause-and-corrective-action package in 10 working days, could you?
FileFlo classifies and indexes the records a VDRP written report is built from — maintenance entries, pilot and training records, OpSpecs and manuals, and the corrective-action file — ties them to aircraft and dates, alerts on expirations, and assembles an audit-ready binder on demand. 600+ document types. Starter at $89/mo, Professional at $299/mo. 5-day free trial, no credit card required.
VDRP vs. ASAP vs. ASRS: Which Program Is Which
VDRP is one of several voluntary FAA-related safety programs, and they are easy to confuse because they overlap in spirit — all reward voluntary reporting — but differ in who reports, what they cover, and how they protect. A single event can implicate more than one. Here is the clean separation.
| Program | Who reports | What it covers | Guidance / administrator |
|---|---|---|---|
| VDRP | The certificate holder (the operator itself) | The operator's own apparent regulatory violation, with a comprehensive fix | FAA program — AC 00-58 |
| ASAP | Employees (e.g., pilots, mechanics) under an MOU | Employee-reported safety issues, captured with limited enforcement exposure | FAA program — AC 120-66 |
| ASRS | Any individual airman, confidentially | Safety reports; can support a limited waiver of sanction in some cases | NASA-administered (not the FAA) |
The simplest mental model: VDRP is the operator-level disclosure of the company's own violation; ASAP is the employee-level safety-reporting program run by agreement among the operator, the FAA, and often a labor group; and ASRS is the individual's confidential NASA report. They are not interchangeable, and choosing among them — or filing more than one for the same event — is a strategic decision with real consequences. Whether ASRS's limited protection, an ASAP report, a VDRP disclosure, or some combination fits a given situation depends on the facts and on who the actor is.
This is a decision to make with counsel
Which program to use, and in what combination, is fact-specific and carries consequences for both the operator and the individuals involved. It is also separate from your rights if a matter moves toward enforcement — those are shaped by statute, including the Pilot's Bill of Rights (Public Law 112-153, 2012), which changed how airman certificate actions are reviewed. Bring an aviation attorney in early. Our companion guide walks the choice in more depth: ASAP vs. VDRP vs. ASRS — which to file.
It is also worth separating VDRP from the things it is sometimes confused with. A VDRP disclosure is not an NTSB Part 830 accident or incident report — that is a separate, mandatory notification regime under 49 CFR Part 830 for accidents and certain incidents, with its own immediate-notification and report duties. If an event is both a reportable accident and an apparent regulatory violation, both obligations can apply, on their own timelines. See what to do for a Part 135 accident NTSB notification.
The Records That Carry a Disclosure — Document by Document
Here is the part that matters most for an operator who wants VDRP to be a usable tool rather than a theoretical one. A voluntary disclosure is only as strong as the records behind it. The five conditions and the written report both demand evidence — dated, complete, and produced on a 24-hour-then-10-working-day schedule. The operators who use VDRP well are not the ones who never make mistakes; they are the ones who can find a problem in their own records, prove what happened and when, document the fix, and hand the FAA a clean package fast.
That is a document-management capability, and it is precisely the gap FileFlo is built to close. Below is the record set a Part 135 disclosure typically draws on, what each one proves, and where a compliance document intelligence platform helps.
The disclosure record set
Maintenance records and logbook entries
14 CFR §§43.9, 43.11Why it carries the disclosure
Many Part 135 disclosures begin in the maintenance world — a missed inspection, an out-of-sequence entry, an airworthiness item. The written report has to show what the records actually said, when, and how the gap was found and closed. Complete, dated, retrievable entries are the difference between a credible disclosure and a reconstruction.
How FileFlo helps
FileFlo classifies maintenance entries and airworthiness documents, dates them, and tracks recurring inspection deadlines, so the maintenance picture behind a disclosure is continuous and producible rather than reassembled.
Pilot qualification and training records
14 CFR Part 135 Subpart E/GWhy it carries the disclosure
When the apparent violation touches a pilot — a lapsed checkride, an expired currency item, a training record that cannot be found — the report must document the qualification status as it actually was and the corrective action taken. The proof is the records, not a recollection.
How FileFlo helps
FileFlo tracks pilot records with expiration alerting, so a lapsing checkride or medical surfaces before it becomes a finding, and the historical record is on file when a disclosure needs it.
The corrective-action / root-cause file
AC 00-58 (program guidance)Why it carries the disclosure
The comprehensive fix is the core of the written report: corrective actions, responsibilities, a completion schedule, and a self-audit. That is a living document set that has to be assembled, dated, and proven within the program timeline — exactly the kind of artifact that is painful to build from nothing under a deadline.
How FileFlo helps
FileFlo gives the corrective-action package a home — the documents that evidence each step, dated and indexed, so the root-cause-and-fix story is captured as it happens instead of recreated later.
Operations specifications and manuals
14 CFR Part 119 / Part 135Why it carries the disclosure
Whether a fix is satisfactory often turns on what the OpSpecs and manuals require, and whether a procedure was changed to prevent recurrence. The current authorizations and the manual revision history are part of showing the systemic cause was addressed.
How FileFlo helps
FileFlo indexes OpSpecs and manual revisions as distinct document classes and version-controls amendments, so the authorization and procedure in force on a given date is retrievable.
The dated notification and report itself
AC 00-58 (program guidance)Why it carries the disclosure
The program runs on timelines — ordinarily 24 hours to notify, 10 working days for the written report. Being able to prove when you notified and when you reported, and to hold the report and its supporting exhibits together, is part of demonstrating you met the conditions.
How FileFlo helps
FileFlo stores the disclosure documents and their supporting exhibits as a tied-together set with dates, so the timeline of the disclosure is documented, not asserted.
None of these documents is exotic — they are the same records a Part 135 operator is already required to keep. The failure mode is rarely "we never had the record." It is "we could not assemble the complete, dated picture fast enough to make the disclosure credible on the program's clock." For the foundational records picture underneath all of this, see what records a Part 135 operator must keep, Part 135 maintenance recordkeeping and CAMP requirements, and the aviation records retention schedule for how long each must be kept.
The maintenance-record entries that so many disclosures revolve around are governed by the §43.9 maintenance-record entry requirements, and increasingly those entries live in digital systems — see electronic aircraft maintenance records and digital signatures. Major repairs and alterations bring their own paperwork, the FAA Form 337 records. And if the underlying problem is that records have gone missing, the recovery path is its own discipline: how to reconstruct lost aircraft logbooks.
The same records discipline is what carries you through the adjacent enforcement-adjacent situations in this cluster — a paperwork-driven fine for a Part 135 paperwork violation, a ramp-check document checklist and what to expect in a ramp inspection, and the kind of grey-area scrutiny covered in the FAA illegal-charter crackdown.
FileFlo is the proof layer — not your disclosure, your decision, or your attorney
FileFlo is a compliance document intelligence platform. It classifies the records a voluntary disclosure draws on, indexes them by aircraft and date, tracks expirations on the time-sensitive ones, documents the corrective-action trail, and keeps the whole set retrievable so you can assemble a credible package on the program's timeline. It does not file your VDRP report, decide whether you qualify, represent you to the FAA, give legal advice, or guarantee that the FAA will accept a disclosure. What it does is make sure that when you and your counsel decide to disclose, you can produce and prove your records — on the clock.
Frequently Asked Questions
What is the FAA Voluntary Disclosure Reporting Program (VDRP)?
The Voluntary Disclosure Reporting Program (VDRP) is an FAA program — described in Advisory Circular AC 00-58 — under which a certificate holder that discovers it has apparently violated a regulation can disclose that violation to the FAA, fix the underlying cause, and, when the program's conditions are met, have the matter closed with a letter of correction instead of a civil penalty. It is FAA policy and guidance, not a section of the Code of Federal Regulations, and acceptance into the program is at the FAA's discretion. The trade is straightforward: the operator self-reports promptly, takes immediate corrective action, and commits to a comprehensive fix; in return the FAA generally refrains from a civil penalty for the disclosed conduct. It is a self-disclosure tool for the operator's own apparent violations — not a way to report someone else.
How do you file a VDRP report as a Part 135 operator?
In practice it is a two-step process described in AC 00-58. First, you make an initial notification to your FAA principal inspector (the Principal Operations or Principal Maintenance Inspector for your certificate) promptly after discovering the apparent violation — ordinarily within 24 hours of discovery. That notification identifies the apparent violation and states that you are disclosing it under the VDRP. Second, after the FAA acknowledges the disclosure, you submit a detailed written report — ordinarily within 10 working days of the initial notification — that documents the regulation involved, how and when the violation occurred and was found, the immediate corrective action you took, the root cause, and your comprehensive fix and implementation schedule. The FAA reviews the report, works with you on the fix, and, if everything is satisfactory, closes the matter with a letter of correction. Many operators file through the FAA's web-based VDRP tool; coordinate the mechanics with your inspector, because eligibility and acceptance are fact-specific.
What are the five conditions to qualify for VDRP?
AC 00-58 sets out five elements that all must be met for the FAA to accept a voluntary disclosure and refrain from civil penalty. (1) You notified the FAA of the apparent violation promptly — ordinarily within 24 hours of discovering it. (2) The apparent violation was inadvertent — neither reckless nor intentional. (3) The apparent violation does not indicate a lack, or reasonable question, of your qualification as a certificate holder. (4) You took immediate action, satisfactory to the FAA, upon discovery to terminate the conduct that produced the violation. (5) You have developed, or are developing, a comprehensive fix and implementation schedule satisfactory to the FAA — including a self-audit to confirm the fix worked. Miss any one of these and the disclosure may not qualify. Because applying those elements to real facts is a judgment call, an aviation attorney and your inspector are the right people to confirm eligibility before you rely on it.
How long do you have to file a VDRP report — is it really 24 hours?
There are two clocks, and conflating them is a common mistake. The first is the initial notification: AC 00-58 says it should be made promptly, ordinarily within 24 hours of discovering the apparent violation. That 24-hour window is about telling the FAA quickly that you have something to disclose — it is not the deadline for the full report. The second clock is the detailed written report, which is ordinarily due within 10 working days after the initial notification. The reason timeliness matters so much is that prompt self-reporting is one of the five qualifying conditions; if the FAA learns of the violation some other way first, or you sit on a known problem, the disclosure can lose its protection. The discipline the program rewards is detecting, reporting, and acting fast — and being able to show, with dated records, that you did.
What goes in the VDRP written report?
AC 00-58 lays out the elements the written report should contain. At a minimum it identifies the specific regulation(s) that may have been violated; describes the apparent violation, including how long it went undetected and how and when it was discovered; describes the immediate action taken to terminate the conduct, when it was taken, and who was responsible; sets out the root cause and any systemic issues that led to the violation; and presents the proposed comprehensive fix — the planned corrective actions, who is responsible for each, a schedule for completing them, and a self-audit to verify the fix. In other words, the written report is a documented root-cause-and-corrective-action package backed by proof. That is precisely the kind of artifact a disciplined document system should be able to assemble — current records, dated evidence, and a clean trail of the corrective action — rather than reconstruct under a 10-working-day deadline.
VDRP vs ASAP vs ASRS — which one do I file?
They are different FAA-related programs that serve different purposes, and a single event sometimes implicates more than one. VDRP (AC 00-58) is for a certificate holder disclosing its own apparent regulatory violation and committing to a comprehensive fix. ASAP — the Aviation Safety Action Program (AC 120-66) — is an employee safety-reporting program run under a memorandum of understanding between an operator, the FAA, and often a labor group, aimed at capturing safety issues from employees with limited enforcement exposure. ASRS — the Aviation Safety Reporting System — is the NASA-administered, confidential, voluntary report any airman can file, which can provide a limited waiver of sanction in certain circumstances. VDRP is the operator-level disclosure; ASAP is employee-level; ASRS is the individual NASA report. Which to use (and whether to use more than one) is exactly the kind of fact-specific call to make with counsel — see our companion guide on choosing among ASAP, VDRP, and ASRS.
Does VDRP protect you from a fine or civil penalty?
When a disclosure meets all five conditions and the FAA accepts it, the program's outcome is that the FAA generally refrains from a civil penalty and closes the matter with a letter of correction once the comprehensive fix and schedule are agreed. But that protection is neither automatic nor guaranteed. Acceptance is at the FAA's discretion; the disclosure must actually qualify; and the protection is tied to the disclosed conduct, not a blanket shield. VDRP also does not erase the duty to fix the problem — a letter of correction follows a satisfactory comprehensive fix, not just a confession. And it does not cover conduct that was reckless or intentional, or that raises a real question about your qualification to hold the certificate. Treat VDRP as a path to resolve an inadvertent, promptly-corrected violation favorably — not as immunity — and get legal advice on whether a specific situation qualifies.
Can a small or single-pilot Part 135 operator use VDRP?
Yes. The VDRP framework in AC 00-58 applies to regulated entities including air carriers and operating certificate holders, and there is no rule that it is only for large airlines — a small or single-pilot Part 135 operator that discovers an inadvertent violation can disclose it. The practical challenge for a small operator is capacity: the same person who found the problem often has to make the 24-hour notification, write the 10-working-day report, document the root cause, and stand up a comprehensive fix with a self-audit — on top of flying the airplane. That is where being able to produce current, organized records quickly is decisive. A small operator that can pull its maintenance entries, pilot records, and training documentation on demand can assemble a credible disclosure on the program's timeline; one that is reconstructing paperwork from scratch is fighting the clock. The program is available to you — the records discipline is what makes it usable.
A voluntary disclosure lives or dies on the records behind it. Keep them current — and producible on a 10-day clock.
FileFlo classifies and indexes the documents a VDRP written report is built from — maintenance entries, pilot and training records, OpSpecs and manuals, and the corrective-action file — with AI classification across 600+ document types, expiration tracking, and an audit-ready binder on demand. Starter at $89/mo, Professional at $299/mo. No credit card required for the 5-day free trial.
5-day free trial · No credit card required · Cancel anytime
Reviewed by Chad Griffith, Founder, FileFlo — compliance document intelligence — June 15, 2026. The VDRP is described in FAA Advisory Circular AC 00-58 and implemented through FAA guidance; it is an FAA program, not a section of the CFR, and acceptance is at the FAA's discretion. Regulatory citations (e.g., 14 CFR §43.9, §43.11) verified against the Code of Federal Regulations (Cornell LII) as of publication date. Note: 14 CFR §43.12 was reserved by a 2025 FAA final rule (eff. Nov. 3, 2025); record falsification now appears at 14 CFR Part 3, Subpart D (§§3.403, 3.405). The Pilot's Bill of Rights is a statute (Public Law 112-153, 2012). This article is general compliance-document information, not legal advice; eligibility and acceptance are fact-specific — consult an aviation attorney.