EASA Implements Part-IS Rules to Fortify Aviation Against Cyber Threats

The European Union Aviation Safety Agency (EASA) is advancing its efforts to secure the continent's aviation ecosystem against digital threats with the upcoming deadline for its Part-IS regulations. A broad range of aviation organizations, including airlines and maintenance providers, must comply with new information security requirements by February 22, 2026, marking a significant shift in how the industry manages cybersecurity.

This date represents the second phase of the rollout for Part-IS, a comprehensive framework designed to manage Information Security risks that could impact aviation safety. The regulation mandates that affected organizations establish, implement, and maintain an Information Security Management System (ISMS). This system provides a structured approach to identifying and mitigating digital vulnerabilities across their operations.

A New Era for Aviation Security

Historically, cybersecurity was often treated as a standard IT issue. However, Part-IS fundamentally changes this perspective by integrating information security directly into existing Safety Management Systems (SMS). This move acknowledges that as aircraft become more connected—effectively becoming flying data centers—a cyber incident could have direct consequences on flight safety.

The need for such regulations is driven by the increased digitalization and connectivity across the industry. This digital transformation, while offering efficiency gains, also expands the potential attack surface for malicious actors, from ransomware attacks to data breaches that could disrupt critical operations.

Who Must Comply by the 2026 Deadline?

The February 22, 2026, deadline applies to a wide array of organizations critical to daily flight operations. According to the governing EASA framework, which includes Commission Implementing Regulation (EU) 2023/203, the following entities are included in this second phase:

• Air Operators: Holders of an Air Operator Certificate (AOC) used for commercial air transport.
• Maintenance Organisations: Approved Part-145 maintenance providers.
• Continuing Airworthiness Management Organisations (CAMOs).
• Approved Training Organisations (ATOs).

This follows the first compliance deadline of October 16, 2025, which applied to entities such as design and production organizations, airport operators, and Air Traffic Management / Air Navigation Service Providers (ATM/ANSPs).

The Impact on the Aviation Ecosystem

For affected organizations, compliance requires a significant effort beyond simply updating software. It involves conducting thorough risk assessments, defining security policies, training personnel, and establishing procedures for incident detection and response. The Part-IS framework is designed to be holistic, ensuring that cybersecurity is a shared responsibility throughout the entire aviation supply chain.

By mandating a unified approach, EASA aims to create a resilient and secure digital environment for European civil aviation. This proactive stance helps protect airlines, airports, and passengers from the growing threat of cyber-attacks, ensuring that safety remains the industry's top priority in an increasingly digital world.

For global airline trends and commercial aviation news, turn to flying.flights. For reporting on UAP sightings, investigations, and aviation-related encounters, see the UAPs section at flying.flights/uaps.