# Airport Safety Management System > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2023-03597 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** February 23, 2023 - **Citation:** 88 FR 11642 ## Text DEPARTMENT OF TRANSPORTATION Federal Aviation Administration 14 CFR Part 139 [Docket No.: FAA-2010-0997; Amdt. No. 139-28] RIN 2120-AJ38 Airport Safety Management System AGENCY: Federal Aviation Administration (FAA), DOT. ACTION: Final rule. SUMMARY: This final rule requires certain airport certificate holders to develop, implement, maintain, and adhere to an airport safety management system (SMS). Certificated airports that qualify under one or more of the following triggering criteria (triggers) are required to develop a SMS under this final rule: are classified as large, medium, or small hubs based on passenger data extracted from the FAA Air Carrier Activity Information System; have a 3-year rolling average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures; or serve any international operation other than general aviation. This rule would expand the safety benefits of SMS to certain certificated airports and further the FAA's aviation-wide approach to SMS implementation in order to address safety at an organizational level. DATES: This rule is effective April 24, 2023. ADDRESSES: For information on where to obtain copies of rulemaking documents and other information related to this final rule, see “How to Obtain Additional Information” in SECTION VI of this document. FOR FURTHER INFORMATION CONTACT: For technical questions about this action, contact James Schroeder, Airport Safety and Operations Division, AAS-300, Office of Airport Safety and Standards, Federal Aviation Administration, 800 Independence Avenue SW, Washington, DC 20591; telephone (202) 267-4974; email james.schroeder@faa.gov. SUPPLEMENTARY INFORMATION: Table of Contents I. Executive Summary II. Background III. Discussion of Public Comments and Final Rule A. Applicability 1. General Applicability 2. Triggers i. Hub Trigger ii. Operations Trigger iii. International Trigger 3. Authority To Implement Triggers 4. Annual Review of Applicability B. Implementation 1. Phased Implementation 2. Staggered Implementation 3. FAA Review of Documents 4. Timeline for Document Submission and Full Implementation 5. Timeline for New Airports Qualifying After the Effective Date of This Final Rule, or Due to Changes in Status C. Non-Movement Area 1. Regulatory Authority in the Non-Movement Area 2. Inclusion of Fuel Farms, Baggage-Makeup, and Military Areas 3. Inconsistency With ICAO Standard 4. Air Carrier Operations in Non-Movement Areas D. Data Protection 1. State-Level Fix 2. Federal-Level Protection 3. Creation of a National Data Repository 4. De-Identified Data E. Safety Reporting and Interoperability 1. Change in Terminology 2. Data Sharing and Reporting Plan 3. Crewmembers Accessing Non-Movement Areas F. Training and Orientation 1. Identification of Roles, Responsibilities, and Minimum Training Elements 2. Training Estimates Used in Regulatory Evaluation calculations 3. Safety Awareness Orientation 4. Development of Training Materials 5. Clarification of “Comprehensive SMS Training” 6. Clarification of “Access” G. Accountable Executive 1. Amendment or Elimination of the Accountable Executive Requirement 2. Delegation 3. Personal Liability and Oversight H. Definitions 1. “Hazard” Definition 2. “Non-Movement Area” Definition 3. Harmonization of “Safety Policy,” “Safety Risk Management,” “Safety Assurance,” and “Safety Promotion” Definitions I. Miscellaneous Topics 1. FAA's Rulemaking Authority 2. Applicability to Non-Certificated Airports 3. FAA Oversight 4. Safety Risk Management 5. Record Retention 6. SMS Manual Updates 7. Guidance and Work Groups IV. Regulatory Notices and Analyses V. Executive Order Determinations VI. How To Obtain Additional Information List of Abbreviations and Acronyms Frequently Used in This Document AC Advisory Circular ACAIS Air Carrier Activity Information System ACM Airport Certification Manual AOC Airport operating certificate ARP FAA Office of Airports ATO FAA Air Traffic Organization AVS FAA Aviation Safety Organization CFR Code of Federal Regulations CBP Customs and Border Protection DSR Plan Data Sharing and Reporting Plan E.O. Executive Order FAA Federal Aviation Administration FOIA Freedom of Information Act ICAO International Civil Aviation Organization NPIAS National Plan of Integrated Airport Systems NPRM Notice of Proposed Rulemaking NTSB National Transportation Safety Board OMB Office of Management and Budget OpsNet FAA Operations Network SBREFA Small Business Regulatory Enforcement Fairness Act of 1996 SMS Safety Management System SNPRM Supplemental Notice of Proposed Rulemaking SRM Safety Risk Management SSI Sensitive Security Information I. Executive Summary A. Purpose of the Regulatory Action SMS has generated wide support in the aviation community as an effective approach that can deliver real safety and financial benefits. 1 SMS integrates modern safety concepts into repeatable, proactive processes in a single system, emphasizing safety management as a fundamental business process to be considered in the same manner as other aspects of business management. The development and implementation of SMS improves safety at the organizational level and is the next step in the continuing evolution of aviation safety. Therefore, the FAA is pursuing an aviation-wide approach that would require the implementation of SMS by those organizations in the best position to prevent future accidents. As part of that process, the FAA is expanding SMS's benefits to certain certificated airports by requiring them to proactively identify and mitigate safety hazards, thereby reducing the possibility or recurrence of incidents or accidents in air transportation. The purpose of this final rule is to require certain Title 14 Code of Federal Regulations (CFR) part 139 2 certificate holders to develop, implement, maintain, and adhere to an airport safety management system (SMS). 1 See, e.g., National Transportation Safety Board, NTSB Calls for Enhanced Safety Standards in Some Revenue Passenger-Carrying General Aviation Operations (Mar. 23, 2021), https://www.ntsb.gov/news/press-releases/Pages/NR20210323.aspx; Transportation Research Board, Airport Cooperative Research Program (ACRP) Synthesis 37: Lessons Learned from Airport Safety Management Systems Pilot Studies at 46 (2012) (explaining that airports that participated in the SMS program reported increased safety awareness and improved collaboration). 2 Part 139 requires airports serving scheduled air carrier aircraft with more than 9 seats or unscheduled air carrier aircraft with more than 30 seats to hold an Airport Operating Certificate (AOC). Under part 139, a certificate holder must develop and maintain an Airport Certification Manual (ACM). The ACM contains the processes and procedures the airport uses to comply with part 139 requirements, and the FAA approves the ACM and updates to it. A SMS is a formal means for organizations to identify and manage safety risks in their operations. It includes systematic procedures, practices, and policies for the management of safety risk. SMS enforces the concept that safety should be managed with as much emphasis, commitment, and focus as any other critical area of an organization. It prompts organizations to develop decision-making processes and procedures and use effective safety risk controls to proactively identify and mitigate or address any detected noncompliant or unsafe conditions in their operations. As discussed in the FAA Airport SMS Pilot Study report, 3 airports that voluntarily implemented SMS have reported better efficiency in identifying and mitigating hazards in daily activities such as pedestrian safety on ramps and operations with ground support equipment. 4 These airports also used SMS processes for significant events, such as construction safety and phasing planning, to proactively identify and mitigate hazards before the start of the project. This proactive approach, along with the communication of safety issues, provides a robust mechanism for airports to improve safety. The FAA has not formally tracked the number of airports that have implemented SMS since it is not yet a required element under part 139. 3 Federal Aviation Administration, Airport Safety Management Systems (SMS) Pilot Studies, https://www.faa.gov/sites/faa.gov/files/airports/airport_safety/safety_management_systems/external/smsPilotTechReportMay2011.pdf (May 2011). 4 FAA has not evaluated an airport's safety record prior to participating in SMS under the pilot program. In general, however, the FAA recognizes that airports participating in the pilot studies were proactive about the safety of their operations. The purpose of a SMS is to reduce incidents, accidents, and fatalities in the airfield operations environment. A specific example cited in the RIA was the FOD damage to 14 aircraft in 2007 (NTSB Accident No: DEN07IA069). The advanced communication procedures in a SMS could have expedited the reporting, assessment and mitigation of the FOD hazard, thus limiting the likelihood and severity of this hazard. Expanding SMS to certain certificated airports is the best strategy to continue to reduce incidents and accidents, and improve safety in aviation. ICAO, other Civil Aviation Authorities, industry advisory groups, and the NTSB all support the use of SMS to improve safety. In the U.S., safety management systems have been implemented by part 121 operators and the FAA has voluntary programs designed to expand the use of SMS throughout the aviation system. The FAA has even implemented SMS within many of its organizations. Further, expansion of SMS would also align the U.S. with current ICAO Standards and Recommended Practices. This final rule requires airport certificate holders that qualify under one or more of the following triggering criteria (triggers) to develop a SMS: airports: (a) classified as large, medium, or small hubs, based on passenger data extracted from the FAA Air Carrier Activity Information System; (b) that have a 3-year rolling average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures; 5 or (c) that serve any international operation other than general aviation. The FAA applied a primarily risk-based approach to the final rule's applicability. The criteria are designed to maximize SMS's safety benefits to stakeholders in the least burdensome manner. Instead of requiring SMS at all certificated airports, only certificated airports with the highest passenger enplanements, the largest total operations, and those hosting international air traffic must have a SMS under this rule. This final rule applies to approximately 265 certificated airports. These airports cover over 90 percent of all U.S. passenger enplanements and include the facilities with the largest number of commercial air transportation operations. This allows safety benefits to flow to airports with the majority of aircraft operations in the United States in addition to airports with international passenger operations to ensure conformity with international standards and recommended practices with the least regulatory burden. This rule does not require SMS implementation at small airports with fewer resources where creating a SMS may be a larger proportional burden and may not be cost beneficial. 5 For the purposes of this trigger, the FAA will use the following sources of data to determine number of operations: (a) traffic counts reported by the Air Traffic Control Tower through FAA Operations Network (OpsNet), for airports with FAA or contract towers; (b) FAA Form 5010-1 data for non-towered airports; or (c) other FAA-validated counting systems. Historical OpsNet data is publicly available through FAA.gov . This final rule includes an exception to the applicability of the SMS requirement. If a certificate holder qualifies exclusively under the international services trigger, then it may file a waiver request to seek relief from the regulatory requirement to implement SMS. To do so, it must certify that it does not host any operation by any tenant 6 that is required to implement SMS under the applicable laws or regulations of its country of origin ( i.e., the jurisdiction that issued the tenant's air carrier certificate, air operator certificate, or equivalent) or any other governing jurisdiction. For example, if international services at an airport are solely provided for operators engaged in general aviation operations, then—absent another trigger—the FAA will not require the airport to implement SMS. By linking the international trigger for part 139 airports to the presence of international tenants with SMS requirements, the FAA supports a holistic approach that encourages the sharing of data and proactive risk management inherent to SMS. Without this linkage, neither SMS reaches its full potential safety benefit. However, if an air carrier tenant commences international service to or from such airport, and the country of origin of such air carrier tenant requires that it adhere to a SMS, then the exception does not apply and the airport must implement SMS. 6 As discussed later in this document, tenant refers to any person or entity occupying space or property under a lease or other agreement (such as an air carrier or maintenance repair and overhaul company) that does business at the airport. In the interest of safety, this final rule requires the implementation of SMS in both the movement and non-movement areas 7 of qualifying airports. This rule allows airports to enter into data sharing and reporting arrangements with certain air carrier tenants. Such arrangements allow tenants to share with part 139 certificate holders any hazard report submitted though the tenants' confidential employee reporting systems. This reduces the burden of having to report hazards under two different reporting systems and fosters cooperation and increased communication of safety issues among interested parties, while avoiding gaps in SMS coverage. Separately, this final rule adds an authority citation inadvertently omitted from a previous final rule and amends § 139.101 by removing paragraph (c), which no longer applies. 7 “Movement area” is defined as the runways, taxiways, and other areas of an airport that are used for taxiing, takeoff, and landing of aircraft, exclusive of loading ramps and aircraft parking areas, and that are under the control of an air traffic control tower. “Non-movement Area” is defined as taxiways, aprons, and other areas not under the control of air traffic or at airports without an operating airport traffic control tower. Airport SMS will help FAA develop its oversight processes so that FAA targets its involvement on the areas of highest safety risk. For airports with a fully implemented SMS and that have a consistent history of compliance with the requirements of part 139, the FAA will transition to system-based inspections, thereby allowing inspectors to focus on areas of greater risk and the FAA to modify the duration of time between inspections for those airports. In addition to focusing FAA's resources to best address safety needs, the FAA anticipates this approach will create government cost savings from reduced inspector time and travel costs. B. Summary of the Major Provisions of the Regulatory Action In its most general form, SMS is a set of decision-making tools that a certificate holder uses to plan, organize, direct, and control its everyday activities in a manner that enhances safety. An airport SMS must include, at a minimum, four components: (a) safety policy, (b) safety risk management, (c) safety assurance, and (d) safety promotion. Certificate holders must identify their plans for developing and implementing SMS through an FAA-approved Implementation Plan (see § 139.403). Pursuant to § 139.401(f), certificate holders may choose to either document their airport SMS in a separate SMS Manual or in their FAA-approved ACM (see also §§ 139.201-139.203). The submission of SMS Implementation Plans is staggered based on which trigger prompts certificate holders to comply with this final rule. Airports qualifying under the hub trigger must submit their Implementation Plans first, within 12 months of the effective date of this rule. Certificate holders qualifying under the annual operations trigger must submit Implementation Plans within 18 months, and airports qualifying under the international trigger must submit their Implementation Plans within 24 months. All certificate holders subject to this final rule must submit their SMS Manual and/or revised ACM to the FAA within the 12 months immediately following the FAA's approval of the Implementation Plan. Certificate holders have 36 months following approval of the Implementation Plan to fully implement their SMS. Table 1 provides a brief summary of the major provisions of this final rule and changes from the SNPRM. 8 The FAA anticipates that some airports will provide routine updates to their accountable executive, such as through a continuously updated dashboard. Table 1—Summary of Major Provisions Issue Proposed requirement (from the SNPRM) Adopted requirement Applicability of SMS requirements Limited to certificate holders: (a) Classified as large, medium, or small hub; or (b) Having more than 100,000 total annual operations; or (c) Classified as a port of entry, designated international airport, landing rights airport, or user fee airport. Limited to certificate holders: (a) Classified as large, medium, or small hub; or (b) Having an average of 100,000 or more total annual operations (the sum of all arrivals and departures) over the previous three calendar years; or (c) Classified as a port of entry, designated international airport, landing rights airport, or user fee airport. § 139.401(a). Waiver for International Trigger NONE Allow a certificate holder that qualifies exclusively under the international trigger to obtain a waiver from complying with the SMS requirements if it has no tenants that are required to comply with SMS requirements of any jurisdiction. § 139.401(d). Scope SAME AS ADOPTED Encompass aircraft operations in the movement and non-movement areas (and other airport operations addressed in part 139). § 139.401(b). Scale SAME AS ADOPTED Correspond in size, nature, and complexity to the operations, activities, and risks associated with the airport's operations. § 139.401(c). Implementation Plan SAME AS ADOPTED Detail how the airport will meet the requirements of this final rule; include a schedule for implementing the SMS components; describe any existing programs or policies the airport will use to meet the SMS requirements. § 139.403(b). Documenting the SMS requirements SAME AS ADOPTED Include methods of compliance contained within the ACM or a separate SMS Manual with incorporation by reference in the ACM. § 139.401(f). Document Submission and Implementation Deadlines Submit Implementation Plan on or before 12 months Submit SMS Manual and/or ACM update on or before 24 months Fully implement the SMS on or before 24 months Submit Implementation Plan on or before: • 12 months for hub triggers; • 18 months for operations triggers; and • 24 months for international triggers. § 139.403(a). Submit SMS Manual and/or ACM update on or before 12 months after FAA-approval of the Implementation Plan. § 139.403(c). Fully implement the SMS no later than 36 months after FAA-approval of the Implementation Plan. § 139.403(d). Accountable executive SAME AS ADOPTED Identify the accountable executive; report pertinent safety information and data on a regular basis to the accountable executive. 8 § 139.402(a)(1); § 139.402(c)(3). Safety Policy Statement SAME AS ADOPTED Establish and maintain a safety policy statement signed by the accountable executive. § 139.402(a)(2). Safety Objectives SAME AS ADOPTED Establish and maintain safety objectives; define methods, processes, and organizational structure necessary to meet those safety objectives; monitor safety performance. § 139.402(a)(6) & (7); § 139.402(c)(1). Safety Risk Management SAME AS ADOPTED Establish a system to identify operational safety issues and a process to analyze hazards and their risks. § 139.402(b). Safety Reporting System SAME AS ADOPTED Establish and maintain a reporting system that provides for reporter confidentiality. § 139.402(c)(2). Data Sharing and Reporting Plan NONE Provides option to develop data sharing and reporting plan with tenant(s) required to maintain a SMS subject to requirements of 14 CFR part 5. When such a plan exists, relieves airport from providing safety awareness orientation to applicable tenants or their employees. § 139.401(e). Training and Orientation SAME AS ADOPTED Provide all persons authorized access to movement and non-movement areas safety awareness orientation; provide all employees with responsibilities under the SMS training appropriate to their roles. § 139.402(d)(1) & (3). Safety Communications SAME AS ADOPTED Develop and maintain formal means for communicating important safety information. § 139.402(d)(5). Record Keeping SAME AS ADOPTED Retain: • SMS training records and orientation materials for 24 consecutive calendar months; • SRM documentation for the longer of 36 consecutive calendar months after the risk analysis has been completed or 12 consecutive calendar months after mitigations completed; and • Safety communications for 12 consecutive calendar months. § 139.301(b)(1) & (9) & (10). C. Summary of Costs and Benefits The goal of this rule is to improve the safety of the airfield environment (including movement and non-movement areas) by providing an airport with decision-making tools to plan, organize, direct, and control its everyday activities in a manner that enhances safety. The FAA envisions airports being able to use all of the components of a SMS to enhance their ability to identify safety issues and spot trends before they result in a near-miss incident or accident. While the FAA's use of prescriptive regulations and technical operating standards has been effective, such regulations may leave gaps best addressed through performance-based management practices. For example, pilots and controllers may be required to report incidents (such as bird-strikes or runway incursions) under their respective SMS. However, they may not be required to notify the airport of the incident. Because the airport operator best understands its own operating environment, it is in the best position to address many of its own safety issues providing it has sufficient data to address the hazard. A SMS may provide an airport with the capacity to anticipate and address safety issues before they lead to an incident or accident. Table 2 shows quantified present value and annualized benefits and costs over 10 years. The FAA anticipates additional benefits at airports with an implemented Airport SMS in the form of cost savings from reductions in the frequency and breadth of the traditional airport inspection and inspection cycle. Table 2 also includes the FAA's estimated cost savings of changing the traditional inspection cycle at airports with a fully implemented SMS. Table 2—Comparison of Costs and Benefits Over 10 Years [Millions of 2020 dollars] Present value (3%) Annualized (3%) Present value (7%) Annualized (7%) Benefits $199.2 $23.4 $144.1 $20.5 Costs 179.8 21.1 139.0 19.8 Cost Savings 3.1 0.4 2.2 0.3 Net Benefits (includes mitigation benefits, but excludes mitigation costs) 22.5 2.6 7.3 1.0 Table notes: The sum of the individual items may not equal totals due to rounding. Estimates are provided at three and seven percent discount rates per Office of Management and Budget (OMB) guidance. II. Background A. Authority for This Rulemaking The FAA's authority to issue rules on aviation safety is found in Title 49 of the United States Code. This rulemaking is promulgated under the authority described in: (a) 49 U.S.C. 44702, which authorizes the Administrator to issue airport operating certificates; (b) 49 U.S.C. 44706, which authorizes the Administrator to (i) issue an AOC to a person desiring to operate an airport if the person properly and adequately is equipped and able to operate safely; and (ii) include in such AOC all necessary terms to ensure safety in air transportation; and (c) 49 U.S.C. 44701, which requires the Administrator to—among other things—promote safety, prescribe minimum safety standards, and carry out functions that best tend to reduce or eliminate the possibility or recurrence of accidents in air transportation. This regulation is within the scope of the aforementioned authorities because it requires certain certificated airports to develop and maintain a SMS to improve the safety of operations conducted at such airports. The development and implementation of SMS ensures safety in air transportation by helping airports proactively identify and mitigate safety hazards, thereby reducing the possibility or recurrence of accidents in air transportation. B. Statement of the Problem The FAA has determined that there are unmitigated risks and safety gaps in the airport environment necessitating a systems approach to improve safety at part 139 certificated airports. The goal of this rule is to improve the safety of the airfield environment (including movement and non-movement areas). The FAA intends to evolve the current part 139 compliance program into a proactive, and ultimately predictive approach using the structured discipline of SMS principles. The increasing demands on the U.S. air transportation system, including additional air traffic and surface operations, and airport construction, present a potential increased presence of operational hazards in the airfield environment. However, many accidents and incidents that may be mitigated under SMS may not be shared outside the organization, especially in regards to the non-movement area, thus limiting FAA's insight into the breadth or scale of near-miss and other types of potentially hazardous incidents. While the FAA's use of prescriptive regulations and technical operating standards has been effective, such regulations may leave gaps best addressed through improved management practices. As the certificate holder best understands its own operating environment, it is in the best position to address many of its own safety issues. A SMS may provide an airport with the capacity to anticipate and address safety issues before they lead to an incident or accident. C. Related Actions In 2015, the FAA issued a final rule requiring 14 CFR part 119 certificate holders authorized to conduct operations under 14 CFR part 121 to develop and implement a SMS (see 14 CFR part 5, Safety Management Systems). 9 The part 5 rule established a general framework and minimum requirements for designing and implementing SMS and allowed air carriers to adapt the SMS to ensure it appropriately dealt with the size, scope, and complexity of their part 121 operations. Additionally, under FAA Order 8000.369, the FAA uses SMS internally in offices such as Airports, Air Traffic Organization, Aviation Safety, Security and Hazardous Materials, Next Generation Air Transportation, and Commercial Space Transportation. 9 Part 119 refers to the Certification of Air Carriers and Commercial Operators. Part 121 refers to Operating Requirements for Domestic, Flag, and Supplemental operations. Operations that occur under part 121 with a part 119 certificate are scheduled commercial air carrier operations. On January 8, 2015, the FAA published the Safety Management Systems for Domestic, Flag, and Supplemental Operations Certificate Holders final rule requiring operators authorized to conduct operations under part 121 to develop and implement a SMS. The rule added a new part 5 to Title 14 of the CFR, creating the set of requirements for SMS that a part 121 certificate holder must meet. The rule also modified part 119 to specify applicability and implementation of the new SMS framework. Part 119 refers to the certification of part 121 air carriers and commercial operators. Part 121 air carriers are regularly scheduled air carriers and are generally large, U.S.-based airlines, regional air carriers, and all cargo operators. As of the effective date of this final rule, part 5 applies to part 119 certificate holders authorized to conduct operations in accordance with part 121. The FAA acknowledges, however, that the applicability of part 5 may be expanded in the future, which could impact this final rule by allowing greater coordination between part 139 certificate holders and tenants through increased use of data sharing and reporting plans (as discussed later). This final rule targets part 139 certificated airport operators. It follows a similar framework and harmonizes definitions and requirements with the SMS requirements established under part 5 SMS, when and if appropriate. Nonetheless, this final rule recognizes that there might be differences in SMS requirements depending on the scope and complexity of the operations and types of regulated parties subject to 14 CFR. For example, the FAA recognizes that an airport operation is inherently different from the operation of an air carrier and that the vast majority of part 139 certificate holders are public entities (owned and/or operated by a State or local government or a department, agency, special purpose district, political subdivision, or other instrumentality of a State or local government) rather than private entities like those operating as part 121 air carriers. The revised definition proposed in the SNPRM, and adopted in this final rule of an accountable executive eliminates the substantive differences between the part 121 and part 139 definitions, and clarifies that the accountable executive should not be personally liable to the FAA through certificate action or civil penalty. Thus, in the interest of safety, harmonization is not feasible in all instances and differences in the SMS framework, definitions, and requirements are warranted to best deal with the types and varying degrees of operation of the part 139 certificate holders subject to SMS. This final rule imposes a SMS requirement on certain airports certificated under part 139. It does not impose any additional SMS requirement on part 119 certificate holders, nor does it expand, revise, or amend the provisions, requirements, or responsibilities established in part 5. A Part 139 airport may choose to update its contractual agreements with applicable tenants. However, in most cases, airport operators have additional means to direct critical safety actions through other controlling documents including airport rules and regulations or minimum standards. Usually, contractual agreements with tenants point to, or incorporate by reference, those other documents to allow for more timely implementation of procedures and actions without the need for changes to the agreement. While the final rule does not impose additional SMS requirements on tenants, it is plausible that to achieve its own SMS requirements under part 139, an airport will use these controlling documents to extend certain SMS requirements onto part 119 certificate holders or other tenants. For the purposes of this final rule, the terms “certificate holder” (when used without part 139 before) and “operator” refer to any entity holding an AOC under part 139. The term “tenant” refers to any person or entity occupying space or property under a lease or other agreement (such as an air carrier or maintenance repair and overhaul company) that does business at the airport. D. National Transportation Safety Board (NTSB) Recommendations The NTSB has recommended SMS as a means to prevent future accidents and improve safety in air transportation. The NTSB has cited organizational factors contributing to aviation accidents and has recommended SMS for several sectors of the aviation industry, including aircraft operators and aerodromes (airports). The FAA agrees with the NTSB, concluding the organizational factors and benefits of SMS apply across the aviation industry, including airports. NTSB submitted comments to the SNPRM concurring with the FAA's “proposal that implementation of SMS at airports is warranted and that SMS should apply to the entire airfield environment, including non-movement areas.” 10 NTSB approved of the FAA's proposal to include non-movement areas by stating: “[they] have investigated accidents that clearly demonstrate that the potential for significant events is not limited to only the movement areas.” 10 National Transportation Safety Board response to SNPRM, September 6th, 2016, Docket Number FAA-2010-0997-0179, Christopher A. Hart, Chairman, page 2. E. International Movement Toward SMS ICAO's Annex 19—Safety Management document establishes a framework for member States to develop and implement SMS requirements. State Safety Programs, as implemented by member States, require SMS for the management of safety risk. Many member States, including the U.S., started developing and implementing in-country SMS requirements after Annex 19 became applicable in November 2013 (amended Annex 19 applicable November 2019). ICAO requires SMS requirements for international commercial air transportation, international general aviation, design and manufacturing, maintenance, air traffic services, training organizations, and certified aerodromes. It is FAA policy to comply with ICAO standards to the maximum extent practicable. This rule would further align U.S. safety management system requirements for airports with international standards, which are recognized and followed by many international product and service providers also complying with ICAO Standards and Recommended Practices. F. Summary of the NPRM and SNPRM On October 7, 2010, the FAA published in the Federal Register a notice of proposed rulemaking (NPRM) titled “Safety Management System for Certificated Airports” (75 FR 62008). The NPRM proposed to require all part 139 certificate holders to establish a SMS for the entire airfield environment, including movement and non-movement areas, to improve safety at airports hosting air carrier operations. While reviewing the comments received in response to the NPRM, the FAA began to re-evaluate whether requiring a SMS at all part 139 certificated airports was the appropriate approach. As part of the re-evaluation, the FAA assessed various combinations of criteria that could trigger the requirement to implement the SMS rule and to maximize safety benefits in the least burdensome manner. On July 14, 2016, the FAA published a supplemental notice of proposed rulemaking (SNPRM) titled “Safety Management System for Certificated Airports” (81 FR 45872). The SNPRM proposed creating triggers for SMS and proposed the FAA's preferred alternative to impose a SMS requirement on airports that (a) are large, medium, or small hubs; (b) serve international air traffic; or (c) have more than 100,000 total annual operations. The FAA also revised the proposed implementation schedule to extend the implementation period from 18 months to 24 months and requires the submission of an Implementation Plan within 12 months (instead of 6 months) from the effective date of the rule. The SNPRM clarified the training requirements and revised certain definitions to ensure consistency—when deemed appropriate—among various FAA SMS initiatives. The SNPRM comment period closed on September 12, 2016. In 2021, the FAA decided to reopen the comment period in order to solicit comments on any new information or data generated since the close of the 2016 comment period. The FAA was aware of many airports that had voluntarily implemented SMS since 2016 that might provide additional insight to the SNPRM. The FAA also took into account the Covid-19 pandemic and the five years that had elapsed since the close of the 2016 comment period, and determined that these factors taken together warranted reopening the comment period. Accordingly, the FAA reopened the comment period for the SNPRM, published at 81 FR 45872, for 30 days. When the FAA reopened the comment period, the agency stated that the most helpful comments would: provide only data and information that was not previously submitted to the rulemaking docket; reference a specific portion of the proposal; and explain the reason for any recommended change, including supporting data. The reopened SNPRM comment period closed on September 23, 2021. G. General Overview of Comments The FAA received submissions from commenters in 2016 and 2021 in response to the SNPRM. The FAA received comments from 38 commenters during the 2016 comment period, and 17 commenters during the comment period that it reopened in 2021. In general, the 2021 comments were similar to the 2016 comments, and were from many of the same commenters that commented during the 2016 comment period. This preamble identifies comments that were received in 2021 and comments that were received in both 2016 and 2021 by indicating the year the comment was received. Any comments for which the preamble does not note a year were received in 2016. Although most commenters were certificate holders, some were air carriers, consultants, academics, and individuals. The following industry associations submitted comments: Airlines for America (A4A), Airports Council International-North America (ACI-NA), American Association of Airport Executives (AAAE), Helicopter Association International (HAI), and the National Business Aviation Association (NBAA). The comments addressed the following areas of the proposal: • Applicability; • Implementation; • Non-movement area; • Data protection; • Safety reporting and interoperability; • Training and orientation; • Accountable executive; • Definitions; and • Miscellaneous topics. III. Discussion of Public Comments and Final Rule A. Applicability (1) General Applicability The majority of airport and industry commenters submitted comments about the FAA's preferred alternative for the applicability of the rule. Instead of applying the SMS rule to all certificated airports, the SNPRM amended the proposed applicability to cover only certificate holders identified as (a) large, medium, or small hubs; (b) having more than 100,000 total annual operations; or (c) having international services (triggers (a) through (c) are hereinafter referred to collectively as, the “preferred alternative”). Most commenters generally supported the use of the hub classification as a trigger for the applicability of this final rule. However, smaller airports and industry associations questioned the operational and international triggers. One commenter disagreed with the FAA's revised approach, instead suggesting the FAA require SMS for all certificated airports, as proposed in the NPRM. The commenter believed that applying SMS to a select number of airports could create two levels of safety for airports. The FAA disagrees. The FAA has determined that its approach achieves the most safety benefits in the least burdensome manner, while also strengthening its alignment with international standards. Consistent with other provisions of part 139, this approach relieves relatively small airports from compliance costs when the safety benefits are lower. These small airports have the opportunity to voluntarily implement a SMS, if they believe it is beneficial to their operations. The FAA continues to encourage airports not certificated under part 139 and part 139 certificate holders that are not subject to this final rule to voluntarily implement SMS and has made Federal funding available for SMS Manuals and Implementation Plan development. Commenters also proposed alternate frameworks for SMS applicability. For example, some commenters suggested SMS be required on a case-by-case basis. The FAA disagrees with these suggestions because these alternative frameworks would generally cause ambiguity as to when a certificate holder would be required to comply with the SMS requirements. In the case-by-case example referenced above, suggested application of SMS may be regarded as a punitive measure FAA could use to address a certificate holder failing to comply with part 139 requirements. The perception of using SMS as an enforcement tool, contradicts the non-punitive, safety culture critical to a SMS. The FAA's actual intent is for SMS to serve as a risk-based tool targeting highest-risk areas. A case-by-case approach would also be highly subjective because of the unique conditions of each non-compliance issue. Another commenter suggested that the FAA exclude airports holding a Class IV AOC from the preferred alternative. A Class IV airport is an airport certificated to serve unscheduled passenger operations of large air carrier aircraft. A Class IV airport cannot serve scheduled large or small air carrier aircraft. The FAA disagrees that Class IV airports should be completely excluded, as they serve air carrier aircraft. If a Class IV airport meets one of the triggers because it could serve a large number of air carrier 11 operations or host international operations, it meets the standard identified through the risk-based approach. As discussed later, if a Class IV airport is only identified under the international trigger, the certificate holder may obtain a waiver from the SMS requirements if it meets all of the conditions established in § 139.401(d). 11 See § 139.5, definition of large air carrier aircraft. One comment received during the 2021 comment period recommended allowing for a single SMS for use in multi-airports systems. The FAA agrees with this recommendation, and notes that the regulations allow this use, provided that each airport can still meet the requirements of this final rule. Finally, one commenter observed the preferred alternative could result in certain airports used by air carriers as alternate or emergency airports not being subject to the SMS requirement. This observation is correct: airports designated as an alternate airport are subject to part 139 requirements only if they fulfill one of the triggers. (2) Triggers (i) Hub trigger: In the SNPRM, the FAA proposed using data from the National Plan of Integrated Airport Systems (NPIAS) to identify which certificate holders would qualify under the hub trigger. One commenter stated that there is a lag between when NPIAS data is gathered, published, and becomes publicly available. While the commenter requested the FAA use a different data source to determine hub applicability, it also asked the FAA to report SMS applicability within the biennial NPIAS Report to Congress. The FAA partially agrees with these requests. The FAA will use the annually updated Enplanements at All Airports (Primary, Non-primary Commercial Service, and General Aviation) by State and Airport data available on FAA.gov to determine hub applicability. The FAA pulls this data from the Air Carrier Activity Information System (ACAIS), an FAA database containing data reported by the air carriers to the U.S. Department of Transportation, Bureau of Transportation Statistics. The FAA has used ACAIS since the 1980s to categorize airports based on enplanements and determine entitlement funding under the Airport Improvement Program. The FAA shares this data with airports annually and uses it to inform the NPIAS report. The FAA does not plan to add information about SMS applicability to the NPIAS ( e.g., adding a column/field to indicate whether the airport is required to implement SMS) as inconsistencies might exist due to a reporting lag. Instead, the FAA will maintain a separate list of airports required to implement SMS on our public website, FAA.gov. (ii) Operations trigger: In the SNPRM, the FAA proposed using operational data submitted through FAA Form 5010-1, Airport Master Record. To determine which airports would be subject to the SMS requirement under this trigger, the FAA used a “snapshot” approach, gathering operational data reported in the system on August 1, 2012. Commenters requested changes to either the operations trigger or the source data. Commenters also expressed concerns about the FAA's snapshot approach, explaining that multiple factors could cause airport operations to vary on a yearly basis, causing an airport to exceed 100,000 operations for a particular year but fall below the trigger threshold in the preceding or following years. The FAA agrees with commenters' concerns about the snapshot approach. Therefore, the FAA will use a 3-year rolling average to determine applicability under the operations trigger. Accordingly, this final rule retains the operations trigger with minor modifications. This final rule will not use FAA Form 5010-1 as the sole source of data used to determine who qualifies under the operations trigger. Instead, the FAA will use the following: (a) traffic counts reported by the Air Traffic Control Tower through FAA Operations Network (OpsNet) for airports with FAA or contract towers; (b) FAA Form 5010-1 data for non-towered airports; or c) other FAA-validated counting systems. Historical OpsNet data is publicly available through FAA.gov. Lastly, the final rule adds a clause to § 139.401(a)(2) to clarify that operations for the purposes of this trigger mean the sum of all arrivals and departures. This addition does not change the meaning of operations as it is used in the context of the operations trigger and as it was proposed in the SNPRM, but merely provides additional clarity. (iii) International trigger: In the SNPRM, the FAA proposed requiring SMS at all airports with international services, specifically: (a) those identified as a port of entry (under 19 CFR 101.3), (b) designated international airports (under 19 CFR 122.13), (c) landing rights airports (under 19 CFR 122.14), or (d) user fee airports (under 19 CFR 122.15). Seven commenters expressed general concern that small airports with Customs and Border Protection (CBP) facilities accommodating international general aviation traffic, not scheduled air carrier operations, are unnecessarily included in the international trigger. Several commenters recommended that the FAA should only require airports with scheduled international service to have SMS. In 2021, commenters reiterated concerns about the SMS requirements that would apply to airports under this particular trigger. The FAA requested comments on alternate methods for identifying international airports, since the FAA no longer maintains Advisory Circular 150/5000-5, Designated U.S. International Airports. Commenters had mixed responses to the Agency's use of CBP's Guide for Private Flyers list. Many requested the FAA not use the list because it is outdated and is not hosted by the Agency. One commenter recommended the FAA modify FAA Form 5010-1 to include a new field for certificate holders to self-report the availability of international services. Some commenters requested the FAA establish a joint government/industry task force to assess the accuracy of CBP's lists and develop another method to identify international status, which could include self-reporting by airports. The FAA also agrees with commenters' concerns about the data source for international applicability. It does not appear that any one data source document contains the most up-to-date list of airports with international services. Therefore, this final rule removes reference to CBP regulations. Instead, the FAA will use appropriate available sources of data to determine applicability under this trigger. In addition to CBP regulations, the Agency will use CBP website information and the private flyers list of available airports. The combined use of these lists provides a more comprehensive source of information to determine which airports host international services. The FAA determined that it is unnecessary to establish a joint government/industry task force to develop this information since it is available directly from CBP. The FAA will defer to the expert agency and will not question the accuracy, data gathering systems, analysis, or processes of CBP. As previously stated, the FAA intends to maintain the master list of qualified airports. The FAA determined that it is unnecessary to note this applicability in other lists such as the FAA Form 5010-1 database or the NPIAS because doing so could lead to inconsistent data due to potential reporting lags. The FAA also agrees with comments submitted in 2016 and 2021 that the intent of the international trigger is not to impose a burdensome regulation on certificate holders with international service capabilities aimed exclusively at general aviation traffic. Thus, the FAA incorporated a provision into this final rule allowing airports hosting international services exclusively for general aviation traffic to obtain a waiver from the SMS requirement. An airport may obtain a waiver as long as there is no tenant at the airport that is required to comply with a SMS requirement imposed by any applicable law or regulation of its country of origin ( i.e., the jurisdiction that issued the operator's air carrier certificate, air operator certificate, or equivalent) or any other applicable governing jurisdiction. 12 To obtain a waiver, a certificate holder must submit a formal, written request to the appropriate FAA Regional Airports Division Manager justifying its waiver request, pursuant to § 139.401(d). As discussed later in the preamble, FAA estimates that approximately 74 airports would meet this provision and be eligible to apply for a waiver. 12 If an airport has any tenant required to implement a SMS pursuant to any foreign law or regulation, such foreign jurisdiction could prevent the tenant from operating into, or out of, a U.S. airport that does not have a SMS. The FAA recognizes that an airport's status could change based on the turnover of tenants conducting business at any given moment. For certificate holders granted a waiver, this final rule (§ 139.401(d)) requires the certificate holder to report to the FAA whether it has had any change in international air carrier service that affects the applicability of part 139 SMS requirements every 2 years. The FAA also received comments in 2016 and 2021 alleging the framework did not comply with ICAO standards. The FAA concludes that ICAO Annex 14 identifies standards and recommended practices that address certificated airports with international air carrier service. This final rule's international trigger framework is consistent with the overarching intent of the international standards. (3) Authority To Implement Triggers Several commenters asserted that the FAA does not have sufficient authority to implement the proposed triggers. As stated in the SNPRM, the FAA has sufficient statutory authority under Title 49 of the United States Code, Subtitle VII, part A, subpart III, section 44706, “Airport operating certificates,” as well as section 44701, “General requirements,” and section 44702, “Issuance of certificates,” to require SMS at any certificated airport—including those identified as having international services. (4) Annual Review of Applicability The FAA was asked to clarify: (a) the timeline and process for reviewing the final rule's applicability to an airport; (b) how the FAA will review each airport's status including when the review will occur; and (c) how much time a newly identified airport would have to comply with this final rule. The FAA plans to conduct its annual applicability review at the end of each calendar year after this final rule becomes effective. After each annual review, the FAA will post a list of qualifying airports on FAA.gov and send airports that qualify due to a status change a letter notifying them of their qualification. This final rule requires a newly qualified airport to submit its Implementation Plan within 18 months from notification of qualification by the FAA (see § 139.403(a)(4)). After the FAA approves the Implementation Plan, the certificate holder has 12 months to submit its SMS Manual and/or ACM update and 36 months to fully implement SMS. For an airport that initially qualified under any of the triggers but no longer qualifies due to a status change, the certificate holder will be required under § 139.401(h) to continue to develop, implement, maintain, and adhere to the SMS for the longest of either 24 consecutive calendar months after full implementation; or 24 consecutive calendar months from the date it no longer qualifies under § 139.401(a). Additionally, some airports may cross the threshold of the 100,000 operations criteria from one year to the next. The 24 consecutive calendar months ensure greater continuity and predictability in the airport's SMS. The FAA determined 24 calendar months was the minimum time that would be necessary to accurately validate the withdrawal of the triggering requirements. FAA believes a period beyond 24 consecutive calendar months would be overly burdensome to airport operators. If at any time during the application process for an AOC, an airport operator becomes subject to this final rule under any of the triggers identified in § 139.401(a), then the FAA expects that such airport operator will develop a SMS simultaneously with the development of its certification program. The FAA does not expect the Implementation Plan requirement for airport operators seeking an AOC under § 139.103 to create an additional burden because the FAA anticipates that the process will occur simultaneously with the certification process. B. Implementation Nearly every commenter from both 2016 and 2021, including certificate holders, industry associations, and consultants, commented on the FAA's proposed timeline for submission of the certificate holder's Implementation Plan, SMS Manual, ACM update, and full implementation. While most agreed the amended proposal for submitting the Implementation Plan and SMS Manual was acceptable, none thought a certificate holder could be fully implemented within 2 years. Commenters from the 2021 comment period requested further clarity on how the final rule would affect existing SMS programs. The final rule supplemental guidance incorporates more detail for airports implementing an existing SMS into their part 139 compliance program. (1) Phased Implementation In the SNPRM, the FAA addressed comments to the NPRM requesting the FAA mandate a phased approach to implementation. This would entail setting different regulatory timelines for implementation based upon, for example, each SMS component, or requiring the implementation of the SMS in the movement area prior to non-movement areas. As explained in the SNPRM, to facilitate maximum flexibility and scalability, the FAA did not propose a one-size-fits-all implementation approach. A certificate holder is granted flexibility in structuring and fine-tuning its Implementation Plan to best fit its operations and capabilities. Certificate holders are therefore able to phase implementation, either by SMS component or by movement versus non-movement area, as long as they fully implement SMS by the required deadline. During both the 2016 and 2021 comment periods, commenters reiterated previous comments to the NPRM asking the FAA to require a phased approach and permit more time for implementation. The FAA maintains that it will not require airports to use a phased approach. This final rule is performance-based and allows flexibility in how the certificate holder implements SMS within the required deadlines. A certificate holder could choose to phase its implementation, as long as that phasing occurs within the full implementation deadline. The FAA addresses potential phasing options and considerations in the related AC, which takes into account experiences from pilot studies and other implementing countries. The AC is a guidance document and the FAA stresses that certificate holders may choose to pursue a phased approach—or not—and to structure their implementation to best fit their operations, needs, and capabilities. The FAA also acknowledges that safety assurance processes and procedures, including program evaluation and auditing, would require experience under the SMS to be meaningful. By the deadline for full implementation, the FAA expects a certificate holder to identify those safety assurance processes and procedures and a timeline for rolling out those activities identified in the SMS Manual or ACM; not actually apply those practices prior to full implementation. (2) Staggered Implementation In addition to requesting a phased implementation, numerous commenters requested the FAA impose a staggered approach to implementation. The meaning and scope of “staggered” varied per commenter, but commenters focused on staggering by size and complexity of airport operations, by applicability triggers, or based on airport human and financial resources. The FAA agrees that a staggered approach will benefit industry implementation as well as FAA review and oversight. Therefore, this final rule staggers rollout of document submission and implementation requirements based on the applicability triggers. This approach conforms to commenters' requests to implement a staggered approach based on size and complexity of the airport's operation. By being the last to implement, smaller, less complex operations gain the ability to learn and seek advice from larger, more complex airports that already underwent the process. They will also have more time to identify resources and program appropriate funding, where needed. (3) FAA Review of Documents The majority of commenters requested the FAA provide a detailed timeline for FAA review, and approval or acceptance, of the certificate holder's Implementation Plan and SMS Manual/ACM update. Several commenters specifically requested that this final rule include regulatory text imposing deadlines for FAA review. Commenters also requested the FAA conclude that if a certificate holder receives no feedback from the FAA Regional staff within a certain number of days after document submission ( e.g., 60 or 90), then the Implementation Plan or SMS Manual should be deemed approved or accepted. Lastly, the FAA was asked to explain whether it expects a certificate holder who has already voluntarily implemented (or begun implementation of) a SMS to submit an Implementation Plan. The commenter suggested these airports conduct a gap analysis to determine gaps between their established programs and this final rule and submit a letter to the FAA summarizing those gaps. The FAA acknowledges the importance of approval of the Implementation Plan to full SMS implementation. Therefore, the deadlines for submission of the SMS Manual and/or ACM update and full implementation dates are calculated based on the FAA's approval of the Implementation Plan, rather than the effective date of this final rule. This approach is similar to the one used in part 5, except that it does not provide an absolute deadline by which the FAA must approve each Implementation Plan. On average, the FAA estimates it will take an inspector 60 days to review an Implementation Plan and 90 days to review a SMS Manual and/or ACM update. The FAA deems these estimates reasonable and achievable under the staggered implementation approach. FAA Regional inspectors will work closely with their team leads, managers, and Headquarters liaisons should any problem or question arise about the submission or review process. Furthermore, the change to how the deadlines are calculated ( i.e., based on the Implementation Plan approval date) allows for more communication between the inspector and certificate holder, should changes be required. The FAA intends to leverage existing long-standing processes, whereby the FAA Regional inspectors work closely with the airport operator to review and approve submitted changes to their ACM. These processes are typically explained in FAA Orders, which are publicly available documents. FAA Order 5280.5, “Airport Certification Program Handbook,” will provide inspectors with guidance on how to review, approve, and accept document submissions, and also inspect SMS implementation. Part 139 does not include a process for certificate holders to resolve disapproval of changes to their ACM, and the FAA has not added such a process in this final rule. 13 The ACM review processes have historically been successful under the part 139 program. 13 The FAA notes that part 5 also does not detail resolution of disapproval or non-acceptance. The FAA developed a standardized Implementation Plan template in AC 150/5200-37A and has updated the material along with this final rule. Certificate holders are not required to use the template but are encouraged to do so to simplify and expedite FAA review and approval. A certificate holder is not required to submit changes to its approved Implementation Plan. As discussed in the SNPRM, the Implementation Plan serves as a tool to help certificate holders develop and implement the various components and elements of SMS within the prescribed and/or approved deadlines. Once approved, the FAA expects the certificate holder to make necessary adjustments to ensure compliance with the prescribed deadlines. Airports that have already voluntarily implemented SMS also must provide an Implementation Plan detailing how they will comply with this final rule. The FAA has determined that the Implementation Plan requirements are scalable, flexible and not overly burdensome. The certificate holder could use the AC guidance material and template to identify whether it has already completed the elements required under this final rule to assess any gaps between the final rule and its existing programs. Certificate holders may use an existing gap analysis as the basis for their Implementation Plan. However, the FAA would not accept a gap analysis alone, in lieu of the Implementation Plan. (4) Timeline for Document Submission and Full Implementation The SNPRM proposed an amended schedule for submission of a certificate holder's-Implementation Plan (12 months after the rule's effective date) and the SMS Manual and/or ACM update (24 months after the rule's effective date). The SNPRM implied that full implementation would be completed as of the date the SMS Manual was submitted. Most commenters agreed the amount of time proposed for submitting the Implementation Plan and SMS Manual was acceptable. However, many commenters from the 2016 and 2021 comment periods believed that full implementation was unachievable within 2 years. Numerous comments supported ICAO's model allowing 3 years for full implementation, while others supported alternate timelines ranging from 3 to 8 years. One commenter during the 2021 comment period argued that the implementation period of 2 years was too long. Commenters during both the 2016 and 2021 comment periods stated that by extending the timeline for full implementation, certificate holders would have more time to (a) amend existing tenant leases in non-movement areas, and change applicable leaseholds, contracts, policies and procedures; (b) work with State legislatures to protect SMS-related data; (c) implement based on FAA review and approval of the Implementation Plan; (d) effectively manage the number of hazards reported; (e) garner support and buy-in, hold partnering sessions with all stakeholders, and ensure that the written program will be positively received and accepted upon implementation; and (f) obtain local, state, or Federal funding to meet SMS requirements ( e.g., to obtain consultant services, acquire software systems, etc.). One commenter from the 2021 comment period recommended that the FAA reconsider its submittal timelines for SMS Implementation Plans and Manuals/ACM SMS sections. The FAA agrees it is appropriate to increase the time allotted for full implementation. Thus, under this final rule, certificate holders qualifying under the hub trigger must be fully implemented approximately 4 years from the effective date of this final rule, plus any additional time that is required for FAA approval of the Implementation Plan. Because the FAA is using a staggered approach to submission of the Implementation Plan, certificate holders qualifying under the operations trigger have over 4.5 years and those qualifying under the international trigger have over 5 years to fully implement from this final rule's effective date. Table 3 depicts the timeline for submission of the Implementation Plan, SMS Manual and/or ACM update, and full implementation based on a trigger. It also provides an estimated full implementation date based on a 60-day FAA review and approval of the Implementation Plan. The only documents required for submission are the Implementation Plan and SMS Manual and/or ACM update. During the 2021 comment period, the FAA received several comments urging the FAA to reconsider SMS rulemaking and required implementation at this time due to the economic impact airports are facing as a result of the COVID-19 pandemic. The FAA recognizes the pandemic's impact on many airports; however, this rule's triggering criteria in § 139.401(a) account for factors that influence the triggers, such as the COVID-19 pandemic. The final rule also includes an implementation schedule based on the trigger and continues to be scalable and flexible to accommodate changes in airport operations. As previously addressed, Federal funding is also available for SMS Manuals and Implementation Plan development. Table 3—Timeline for Submission of the Implementation Plan, SMS Manual and/or ACM Update, and Full Implementation Based on Trigger Triggers Submit implementation plan Submit SMS Manual and/or ACM update Fully implement * Large, medium, and small hubs 12 months from effective date 12 months from date on which the FAA approves the Implementation Plan 36 months from the date on which the FAA approves the Implementation Plan. +100,000 average annual operations 18 months from effective date 12 months from date on which the FAA approves the Implementation Plan 36 months from the date on which the FAA approves the Implementation Plan. International airports 24 months from effective date 12 months from date on which the FAA approves the Implementation Plan 36 months from the date on which the FAA approves the Implementation Plan. *Approximate dates assume 60-day FAA review of Implementation Plan. (5) Timeline for New Airports Qualifying After the Effective Date of This Final Rule, or Due to Changes in Status In the SNPRM, the FAA discussed SMS requirements imposed on: (a) airports that were subject to the rule at the time of the effective date of this final rule, and (b) airport operators requesting an AOC (newly certificated airports) after the effective date of this final rule. The FAA failed to address certain circumstances that could arise after the effective date of this final rule; particularly, when a certificate holder could become subject to, or no longer subject to, the requirements of this final rule due to a change in its hub, operations, or international status. In these instances, two commenters requested clarification of the timelines for submission of Implementation Plans, SMS Manuals and/or ACM updates, and full implementation. As further discussed in section A, “Applicability,” this final rule addresses these circumstances and requires the certificate holder to: (a) submit an Implementation Plan within 18 months of notification of qualification by the FAA; (b) submit a SMS Manual and/or ACM update within 12 months of Implementation Plan approval; and (c) fully implement a SMS within 36 months of Implementation Plan approval. This final rule also addresses circumstances in which a certificate holder no longer meets any of the qualification triggers. Section 139.401(h) requires the certificate holder to continue to develop, implement, maintain, and adhere to its SMS for the longest of either twenty-four consecutive calendar months after full implementation; or twenty-four consecutive calendar months from the date it no longer qualifies under § 139.401(a). For illustration purposes only, assume a certificated airport qualified only under the international trigger due to the presence of a part 129 international carrier. If the international air carrier ceases operations at the airport, and if there are no other commercial international operations, then the airport no longer will be subject to the SMS requirements, but § 139.401(h) requires the airport to continue to develop, implement, maintain, and adhere to its SMS for the longest of either twenty-four consecutive calendar months after full implementation; or twenty-four consecutive calendar months from the date it no longer qualifies under § 139.401(a). Some airports may cross the threshold of the international flights criteria frequently. The FAA determined twenty-four calendar months was the minimum time that would be necessary to accurately validate the withdrawal of the triggering requirements. FAA believes a period beyond twenty-four consecutive calendar months would be overly burdensome to airport operators. C. Non-Movement Area The FAA believes it is essential that SMS regulatory requirements apply to non-movement areas through part 139 because. . . . We received comments during the 2016 and 2021 comment periods from numerous entities, including associations, certificate holders, and air carriers, on the proposed application of SMS to non-movement areas. Except for a few notable exceptions, most disagreed with the FAA's proposal to include non-movement areas in an airport's SMS. Nearly all of these commenters suggested ways—through either regulatory text or preamble discussion—for the FAA to clarify its intentions with respect to applicability of SMS to non-movement areas and to improve the requirements to reflect the practicalities of airport operations. Several of these commenters from both the 2016 and 2021 comment periods also urged the FAA to resolve potential duplication and conflicts between the SMS of an air carrier tenant ( i.e., a part 119 certificate holder subject to part 5 SMS) and the SMS of an airport operator for activities conducted in leased facilities located in non-movement areas. Commenters from both comment periods suggested that airport involvement in air carrier tenant leased areas could introduce new risks for air carriers because the air carriers would have to ensure compliance with different procedural mitigations at each airport they fly into. Commenters from both comment periods also addressed potential duplication and conflict for passenger operations in non-movement areas. However, both airport and cargo operators indicated that operations on cargo ramps are unique since they are managed exclusively by cargo operators. Lastly, commenters from both comment periods asked the FAA to exclude non-movement areas subject to exclusive area agreements with the Transportation Security Administration (TSA), when the certificate holders have implemented SMS. The FAA received and considered the following suggestions to address the implementation in non-movement areas: 1. Make SMS implementation in non-movement areas voluntary for part 139 certificate holders; 2. Apply SMS in the non-movement areas only for “traditional” airport responsibilities ( e.g., infrastructure condition, driving, airport-provided or required marking and lighting, and public protection), and let air carriers or other third parties address other functions ( e.g., pushback and towing, aircraft servicing, jet bridge operation, and baggage/cargo handling); 3. Encourage (or require) part 139 certificate holders to implement SMS first in the movement area and then in the non-movement areas (phasing in areas in which the airport has complete control, areas in which the airport shares control, and areas in which a third-party has control); 4. Permit part 139 certificate holders to exclude SMS applicability from areas specifically identified in the SMS Manual that are under the control of one or more air carrier tenants with part 5 SMS; 5. Allow part 139 certificate holders to delegate their authority to their tenants to implement SMS in certain non-movement areas where the certificate holder can show the tenant has greater control, or limit the role of the airport operator in such areas to that of a “coordinator”; 6. Permit part 139 certificate holders to delegate SMS oversight and responsibility to a designated senior official of each affected tenant; and 7. Clarify whether the part 139 certificate holder SMS or the air carrier tenant SMS has precedence for safety issues in non-movement areas, subject to the SMS requirements of parts 5 and 139 ( e.g., gate operations near aircraft, ground servicing vehicles, etc.). (1) Regulatory Authority in the Non-Movement Area One commenter reasserted its argument—first brought forth in its comments to the NPRM—that the FAA lacks the necessary authority to regulate non-movement areas pursuant to 49 U.S.C. 44706. Another commenter stated the FAA has not offered a compelling reason to substantiate the proposed expansion of its regulatory oversight to non-movement areas. The FAA has broad authority under 49 U.S.C. 44702 to issue AOCs. Under 49 U.S.C. 44706, the FAA can issue an AOC to a person desiring to operate an airport if it finds that the certificate holder “properly and adequately is equipped and able to operate safely under this part and regulations and standards prescribed under this part.” Furthermore, 49 U.S.C. 44701(c) allows the FAA to regulate to “reduce or eliminate the possibility or recurrence of accidents in air transportation.” The FAA acknowledges that the majority of the quantified benefits related to wildlife strikes are primarily occurring in the movement area, which make up about 50 percent of benefits. However, the FAA has identified numerous safety concerns, events, accidents, and incidents in non-movement areas that constitute hazards and may reasonably contribute or lead to accidents in air transportation (examples of which are discussed both later in the preamble as well as in the accompanying RIA). Instituting SMS in movement and non-movement areas is consistent with the FAA's authority and safety mission, because it provides significant benefits and contributes to the reduction or elimination of the possibility of recurrent air transportation related accidents. In one example, discussed further in the RIA, an airport identified a hazard to passengers walking on a ramp between parked aircraft and the terminal. The airport mitigated the hazard by adding pavement markings to guide passengers along a safe path between aircraft and the terminal. In another example, an airport identified a trend regarding collisions between moving aircraft wingtips or service vehicles and the tails of stationary aircraft parked at gates. The airport mitigated the hazard using pavement markings as a clear indicator for ramp wing-walkers and marshallers to maintain proper clearances. The regulatory evaluation of this final rule provides additional examples of past events that justify the need for implementation of SMS in non-movement areas. See Section IV, Benefits, in the regulatory evaluation for this rule. Accidents and incidents continue to occur. For example, during the 2-month period encompassing January and February 2017, a large hub airport reported four damaging incidents in the non-movement area. Two of the incidents occurred during pushback, and all four incidents involved vehicle movements or safety personnel required to monitor such movements. In February, May, and July 2017, a second large hub airport (owned and operated by the same entity) reported three more damaging incidents in the non-movement area, similar to those experienced at the first airport. Furthermore, as discussed in the SNPRM, and in direct support for instituting SMS in non-movement areas, pilot studies found that it was difficult to apply SMS concepts only to the movement area because aircraft and airside personnel routinely flow between movement and non-movement areas. Airport operators and/or airport owners currently have sufficient authority to implement the training, safety reporting, and Safety Risk Management (SRM) processes required in this final rule, as well as to undertake the additional responsibility and burden in the non-movement area that will result from this rule, including potential development of new expertise in this area. (2) Inclusion of Fuel Farms, Baggage-Makeup, and Military Areas A commenter argued against the inclusion of fuel farms as part of the SMS requirements. The FAA disagrees that SMS implementation in fuel farms should be voluntary for airports. As stated in the SNPRM, fuel farms are regulated under § 139.321 as part of the certificate holder's AOC. Therefore, it is a natural progression to implement relevant portions of the SMS in the fuel farm environment. Another commenter requested the FAA include baggage-makeup areas within the definition of non-movement area. The FAA previously responded to issues about applicability to baggage-makeup areas in both the “Responses to Clarifying Questions (to the NPRM)” and the SNPRM. The FAA continues to disagree with including baggage-makeup areas explicitly within the definition of non-movement areas. At the majority of airports, these areas are located in the terminal environment. The purpose of addressing non-movement areas in SMS is to address conditions, events, incidents, or accidents that could potentially threaten, or harm, passenger-carrying operations, and to reduce or eliminate the possibility of recurrence of accidents in air transportation (as authorized by 49 U.S.C. 44701, 49 U.S.C. 44702, and 49 U.S.C. 44706). However, if a baggage-makeup area is located outside the landside facilities—in proximity to air carrier operations—the certificate holder would need to ensure the implementation of relevant portions of this final rule, like awareness of the safety reporting system for individuals working in the external baggage-makeup areas. The “non-movement area” definition covers these rare instances without explicitly identifying baggage-makeup areas. The FAA addressed certain issues about joint-use airport facilities in the NPRM and SNPRM. Notwithstanding, several commenters—including various certificate holders—stated the SNPRM was unclear with respect to non-movement areas that are under the exclusive control of the military or other governmental entities. The FAA maintains its position that non-movement areas under the exclusive control of military units or other governmental agencies are excluded from the applicability of SMS requirements. This exclusion will apply to military facilities at joint-use airports or leased areas at joint-use airports. All such areas must be identified in the SMS Manual and/or ACM update, and the certificate holders should include the exclusion in any “lease and use agreement”—or similar legal instrument—with applicable military units or governmental agencies. Certificate holders can—at their own initiative—promote the voluntary inclusion of the military and governmental bodies in SMS-related activities and programs. (3) Inconsistency With ICAO Standard A commenter noted that ICAO Annex 19, Appendix 2, states an “organization's SMS should identify hazards and mitigate risks associated with its products or services.” It argued that an airport's SMS should only be applicable to products or services provided by the airport or its contractors, meaning that services provided in non-movement areas by parties other than the airport operator would not be covered ( e.g., baggage handlers or provisioning crews). The commenter believed the FAA's proposal is inconsistent with this international standard and may lead to negative consequences. The FAA does not agree with the commenter's interpretation. “Note 2” of Amendment 1 to ICAO's Annex 19 states: “the service provider's interface with other organizations can have a significant contribution to the safety of its products or services.” Section 2.1.1 of Appendix 2 states: “the service provider shall develop and maintain a process to identify hazards associated with its aviation products or services.” Furthermore, pursuant to section 2.1.2: “hazard identification shall be based on a combination of reactive and proactive methods.” The sections referenced above evidence and recognize the complexity of certain operations ( i.e., airport operations). The interface between a service provider and other organizations can significantly contribute to the safety of the service provider's products or services. Airport operations are complex, and certain actions occurring in movement and non-movement areas could pose a threat to the safety of aircraft and air transportation. Airports should consider all conditions that could pose a threat or hazard to the airport's operations, whether partly or completely located in the movement or non-movement areas. This is not an issue of where the hazard occurs, but if it could occur. Conditions in the non-movement areas could constitute hazards because they can foreseeably lead—or be part of a chain of events that leads—to aircraft accidents ( e.g., An aircraft taxis over wheel chocks left on the ramp, causing damage to the aircraft's nose wheel spray deflector. The damaged deflector prevents extension or retraction of nose gear after takeoff, causing an emergency diversion and nose gear-up landing. 14 14 Ref. https://www.asias.faa.gov/apex/f?p=100:17:::NO::AP_BRIEF_RPT_VAR:CHI01FA270 . Based on the above, and on the FAA's authority to regulate the non-movement area pursuant to 49 U.S.C. 44701, 44702, and 44706, the FAA determined the regulation of the non-movement area for SMS purposes is consistent with ICAO standards. (4) Air Carrier Operations in Non-Movement Areas Commenters that commented during both the 2016 and 2021 comment periods were confused about the applicability of SMS regulatory requirements in non-movement areas. Some air carriers and airport operators believed the SMS requirements proposed in the SNPRM would duplicate requirements already imposed on air carriers through part 5. These entities believed the part 139 final rule should exclude non-movement areas under the exclusive control of air carriers since they are already covered through the air carrier's SMS. The part 5 final rule limited the FAA's oversight of the air carrier's SMS to aviation activities conducted under part 121. The FAA acknowledged in the preamble of the part 5 final rule that some air carriers may opt to extend their SMS to other aviation and non-aviation-related activities. The FAA clarified that it would only conduct oversight of SMS activities related to aviation operations that the air carriers conduct under part 121. Many air carriers have voluntarily extended their SMS to include ramp operations, but these programs are not required to comply with part 5, nor are they inspected by the FAA. The part 5 final rule also narrowed the definition of the term “hazard” to ensure consistency with the NTSB's definition of “aircraft accident.” Accordingly, the part 5 definition of “hazard” involves a condition that could foreseeably cause or contribute to an aircraft accident as defined in 49 CFR 830.2. An “aircraft accident” is defined as: “an occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage.” By limiting the scope of the definition of “hazard” in part 5, the FAA's oversight is narrowed to the air carrier's operation. The FAA notes that certain aspects of an air carrier's operations conducted in non-movement areas are not subject to the provisions of part 121. Similarly, unfavorable occurrences, which could lead to an accident, injury, or damage, may not involve an aircraft with the intention of flight but could still be of concern to an airport operator. As previously discussed, the need for proactive safety management in the non-movement area is evidenced by the large number of safety accidents and incidents in non-movement areas. Therefore, the FAA believes it is essential that SMS regulatory requirements apply to non-movement areas through part 139. The FAA Office of Airports' (ARP) oversight and inspection related to application of the SMS to non-movement areas will focus on the airport operator's processes and practices to ensure proactive safety management, since ARP inspectors are not authorized to inspect air carrier operations for compliance with part 5, 119, or 121. As for implementation of SMS in non-movement areas, the FAA does not agree that it should be voluntary or dictated by regulation (see section B, “Implementation”). However, the FAA agrees that additional flexibility—to facilitate compliance with the requirements for SMS implementation in non-movement areas—will be beneficial to account for unique contractual, business, or operational arrangements involving air carrier tenants required to implement SMS. For example, the airport operator could establish a means for air carriers' tenants to share with the airport any reports, safety information, and analysis relevant to the air carrier's operations in the movement and non-movement areas of the airport. The air carrier tenant employees could file the information through the airport's safety reporting system. However, the flexibility of this final rule allows for—but does not require—the certificate holders to enter into an arrangement in which air carrier tenant employees continue using their employer's confidential employee reporting system (See 14 CFR 5.71(a)(7)) to communicate relevant safety data and reports, as long as the air carrier tenant shares relevant information derived from such reports or findings with the airport. Section 139.401(e) affords certificate holders such flexibility by alleviating duplicative reporting and encourages sharing of information by addressing interoperability issues between the regulated entities. If the part 139 certificate holder chooses to develop a Data Sharing and Reporting (DSR) Plan, this option is available. A certificate may develop a DSR Plan as a means of compliance with § 139.401(e). If the certificate holder chooses this means of compliance, the DSR Plan must include, as a minimum: (a) the types of information ( e.g., hazard reports, investigation findings, etc.) the airport operator expects the air carrier tenants to share if they are reported through their part 5 confidential employee reporting system or other hazard collection means; (b) the timeliness of sharing relevant safety data and reports; (c) the process for analyzing joint safety issues or hazards; (d) other processes, procedures, and policies to aid the part 139 certificate holder's compliance with its obligations under the airport SMS; and (e) the identification of means by which the requirements of the plan will be executed ( e.g., private agreement, internal bylaws, internal regulations, internal policies, memorandums of understanding, etc.). The part 139 certificate holder may choose to incorporate the DSR Plan into the ACM or SMS Manual. Establishing a DSR does not necessarily require any additional capital investment by the airport or the tenant to facilitate data sharing as § 139.401(e) does not prescribe how data sharing should occur (for example, data sharing could be achieved through routine meetings between the airport and the part 121 air carrier). A DSR might also reduce the total amount of incidents that would otherwise be reported to the airport, as the DSR Plan may allow for a tenant, through its own internal reporting system and SMS, to analyze and mitigate reported hazards that it determines do not require further analysis or mitigation by the airport. Airport operators must work with air carrier tenants that chose to participate in the DSR Plan to ensure they agree to the terms it established. The FAA stresses that the development and participation in the DSR Plan is voluntary both for the airport operator and air carrier tenants. Airports that develop a DSR Plan may encourage participation by, among other things, reminding air carrier tenants of the benefits afforded through the DSR Plan, such as relief from duplicative reporting. The DSR Plan affords the airport operator flexibility in how it engages applicable air carrier tenants. This final rule does not dictate the means by which the airport operator must carry out the provisions; rather, it requires airport operators choosing this option to describe how they will implement the provisions. For example, an airport operator may have sufficient rights and powers to institute requirements such as data sharing through airport issued rules, regulations, or policies. In other cases, an airport operator may need to enter into a private agreement or amendment to an agreement or an internal directive or guideline to implement such provisions. The part 139 certificate holder will simply identify the means by which it will implement the minimum requirements of the DSR Plan to allow for the sharing of information ( e.g., private agreement, rules and regulations, memorandum of understanding, etc.). It will not have to incorporate the agreements, rules, or other provisions into the DSR Plan. Regardless of the existence or form of delegation, the FAA emphasizes that the burden of compliance with the regulatory requirements established by this final rule rests solely on the part 139 certificate holder. Any failure of an air carrier tenant to uphold any term or condition established in an arrangement or agreement between the air carrier tenant and the part 139 certificate holder that is used to carry out the provisions of the DSR Plan is not a valid or reasonable justification for lack of compliance with the regulation. 15 15 The FAA notes that the scope of oversight burden under this final rule is not different than current requirements in part 139. Airports are currently responsible for compliance in all areas covered under part 139 and the airport ACM. Moreover, almost every part 139 airport is federally obligated through the federal grant program and is required to meet certain federal grant assurances including the requirement to operate in a safe and serviceable manner. The oversight expectations present under existing part 139 rules are sustained in this final rule; the SMS process simply establishes a systematic approach to the airport's already-existing responsibilities and helps mitigate incidents or accidents that may occur. Further, an FAA inspector could request to inspect the optional documentation ( e.g., private agreement, internal bylaws, internal regulations, internal policies, memorandums of understanding, etc.) referenced in the DSR Plan, whenever the FAA determines—or has reasonable belief—that the airport is not complying with related provisions of the regulation. The inspection of the documentation facilitates the FAA's assessment of compliance with the regulation and the FAA's understanding of the delegation of responsibilities among the parties. Therefore, the FAA recommends that certificate holders include a clause or provision in such agreements or documents that all parties involved facilitate access to the FAA for the review of the agreements or documents—at the FAA's request—so the FAA can assess compliance with all applicable regulatory requirements when in question. As discussed in Section D, Data Protection, the FAA may request additional SMS-related data or information under existing regulatory oversight processes to ensure that systemic or national compliance issues are reported when appropriate. In most cases, the FAA will review requested documents while on the airport. The only time the FAA will take physical possession of SMS-related data off airport will be as part of an investigation. Otherwise, the part 139 certificate holder will retain all other SMS-related information. Airport operators executing a DSR Plan with a tenant would not be required to make their safety reporting systems available to the tenants or tenant's employees for safety reporting purposes. The airport operators would also not be required to extend their SMS training or make available SMS materials to the tenant's employees if the tenant's SMS covers such training or materials. D. Data Protection Most commenters to the SNPRM that commented during both the 2016 and the 2021 comment periods, including certificate holders, associations, and air carriers, claim the FAA has not adequately considered the effects that a lack of data protection will have on SMS implementation. Commenters asked the FAA to take action to protect from public disclosure SMS-related information such as hazard reports, safety risk management documentation, investigations, and Safety Assurance reports. Without Federal action, these commenters believed a lack of data protection could significantly impact the effectiveness of the certificate holder's safety reporting system and overall SMS. A commenter noted that airport operators generally have greater difficulty than air carriers in protecting against the disclosure of safety information because most airports are owned and operated by governmental entities that may be subject to a state's freedom of information laws. In the absence of effective protection mechanisms, most certificate holders could be required to disclose safety data gathered as part of their SMS. The FAA was asked to provide guidance on the appropriate way to handle open records act and Freedom of Information Act (FOIA) obligations if an airport operator comes into possession of, or has access to, air carrier SMS information. A commenter stated that if the FAA intends for safety reporting to be independent of other governmental functions, it must explicitly include language in this final rule that prohibits the airport operator from sharing information with other government entities, notwithstanding any contrary local or State requirements or law. Another commenter mentioned that airport operators may not have authority to ignore non-safety implications of data they receive in connection with shared SMS data. A commenter from the 2021 comment period requested that the FAA codify a FOIA exemption for SMS reporting. The FAA assessed various suggestions for dealing with potential data protection issues: (1) State-Level Fix Two commenters believed that if the FAA finds a way to provide Federal protection, existing state legislation (in some states) would grant similar protection. One of the commenters stated that the FAA would have to opine that grant-obligated airports are required to keep confidential those records collected in compliance with a SMS rule, thus allowing protection under its state's open records laws. However, another commenter explained that its state's existing public records laws are broad and would not protect any data submitted to the airport's safety reporting system. While these commenters are not averse to working with their state legislatures to ensure protections, they request additional time for implementation to address these issues. In 2021, one commenter requested an exclusion of SMS-related data from state level public records requests in the final regulation, provided the FAA determines it has the authority to create such an exclusion. In contrast, two commenters disagreed with the State-level fix, explaining that the FAA has underestimated the monetary and schedule challenges posed by putting the onus on the certificate holder to work with state authorities. The commenter also believes a patchwork of different protection standards is not conducive to the success of the SMS effort. The FAA recognizes that most certificate holders are owned by public entities, whether it is a State, a subdivision of a State, a local governmental body or other similar entity. Certificate holders are in the best position to seek legal guidance to determine the most appropriate way to handle and protect data and information gathered. They should assess applicable State legal frameworks to determine how to comply with data privacy laws and reporting requirements. (For example, SMS data that is required to be redacted as part of a disclosure requirement might also be subject to applicable State law.) Furthermore, certificate holders have the ability to evaluate whether States afford data and information protection mechanisms through local statutes and regulations or through other legal or contractual arrangements such as confidential disclosure agreements. Notably, the FAA does not have the authority to preempt State freedom on information laws without a congressional mandate. The FAA is also not in a position to assess any State's legal framework, to impose any requirement to create or implement State laws and regulations to protect data and information, or to counsel about handling and protection of data shared amongst third parties. Thus, the FAA cannot determine whether FOIA exceptions preclude disclosure requirements under applicable State laws, or if other laws, regulations, or contractual arrangements would preclude disclosures made amongst third parties. (2) Federal-Level Protection Commenters from the 2016 and 2021 comment period re-stressed their assertions that existing Federal protections could be used to protect SMS data. Commenters disagreed with the FAA's finding that data protection under SSI provisions is inapplicable and may be impermissible because those procedures are for information obtained or developed in the conduct of security activities as described in 49 CFR part 1520. The commenters argued that hazard reports and SRM processes could identify airport vulnerabilities. Another commenter believed the FAA should commit to using the provisions of 49 U.S.C. 44735(b)(4) to assist certificate holders in securing exemptions from state law. One commenter argued that the FAA already has the legal authority to exempt SMS-data from disclosure under Federal, state, and local freedom of information and sunshine laws. The commenter stated that Congress imposed on the FAA the responsibility of overseeing and regulating aviation safety in the U.S., and that pursuant to that authority, the FAA adopted a comprehensive regulatory scheme for certain activities. As such, the commenter maintained that Federal protection could be afforded since, whenever the FAA preempts the field, U.S. courts tend to invalidate state laws and regulations that conflict with the FAA safety regulations. Commenters that commented during both the 2016 and 2021 comment periods agreed that a single Federal standard or statutory exemption should apply to all airports regarding data and information protection. Some commenters wanted the FAA to seek legislative protection to address data protection. Numerous commenters believed that the FAA should explicitly address data protection in this final rule's regulatory text and pressed for Federal legislation to protect such information. Pursuant to 49 U.S.C. 44735, as amended, the FAA must protect certain voluntarily submitted reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator; however, this protection is not afforded to any SMS information required to be submitted to the FAA. Consequently, the FAA is limiting the SMS information that certificate holders are required provide the Agency ( i.e., certificate holder's implementation plan and SMS Manual, and/or ACM update). Specifically, the FAA is not incorporating regulatory language requiring certificate holders to report to the FAA any safety-related data developed under a SMS. This approach should have no repercussions under FOIA and is consistent with the authority under 49 U.S.C. 44735. It should also not affect the FAA's ability to review a certificate holder's documentation to assess compliance with part 139; meaning, the FAA might take possession of such documentation when investigating a potential issue of non-compliance. Certificate holders are not prohibited from voluntarily sharing information with other governmental entities. The protection under 44735 only safeguards against release by the FAA, and does not extend to other governmental entities nor to private entities. This means that whenever a certificate holder releases or submits information to any other governmental entity, the information rendered is not protected from release by such governmental entity, absent other applicable law. The information might also not be protected from discovery in civil litigation, although the certificate holder could request that a court extend additional or ancillary protections available under the laws of the relevant jurisdiction. Furthermore, the FAA cannot protect data that is shared by and among third parties; such protection would have to be granted statutorily or under a legally-binding agreement to protect the information that is recognized as protected under state or local law. As previously stated in the SNPRM, data protection under SSI provisions is inapplicable and may be impermissible because those procedures are for information obtained or developed in the conduct of security activities, as described in 49 CFR part 1520. (3) Creation of a National Data Repository Numerous commenters from both the 2016 and 2021 comment periods believed data could be protected under existing Federal protections if the FAA established a national repository for certificate holders to voluntarily submit hazard data. Two commenters during the 2021 comment period suggested that such a repository would be advantageous and reduce the financial burden to airports. One commenter explained that while the FAA may have little to no need for such information, the approach would allow certificate holders to take advantage of the narrow legislative provision. Regarding the request for the creation of a national data repository, the FAA acknowledges that such a database would allow it to protect all SMS data submitted voluntarily to the FAA. Notwithstanding, the FAA has concluded that a national data repository will not provide an immediate solution to data protection. As one of the commenters accurately stated, certificate holders could inundate the FAA with hazard reports and documentation to gain Federal protection. Further, a national database would not prevent disclosure under State or local laws. Certificate holders would still be in possession of the data before submitting it to the national database. The FAA remains interested in the long-term idea of a national database, as a means to identify systemic safety issues and hazards. The FAA will re-explore this option after certificate holders' SMS mature, and the FAA has more time to analyze and consider the types of information that could be submitted as well as all resource requirements regarding collection. When deemed appropriate, the FAA may consider implementing a national data repository, pursuant to the provisions of 49 U.S.C. 44735, which allows the FAA to protect from disclosure all “reports, data, or other information produced or collected for purposes of developing and implementing a safety management system” as long as the data is furnished voluntarily and is not required to be submitted to the FAA pursuant to other provisions of law. In addition, the implementing regulations to 49 U.S.C. 40123, codified at 14 CFR part 193, afford the FAA the option of designating voluntarily submitted safety information as “protected” information, thereby preventing its disclosure to unauthorized third parties. (4) De-Identified Data During the part 139 SMS pilot studies, certain participants explored the use of third parties to de-identify hazard reports before these were filed with the certificate holder. One commenter noted that such a system would add cost and complexity to SMS implementation and operation, although it did not address whether the option would result in the protection of SMS data. As a clarification, the FAA realizes that some confusion exists regarding the information that a certificate holder must submit to the FAA. One commenter from the 2021 comment period stated that the requirement for airports to share de-identified data with the FAA was unreasonable. As stated in the SNPRM, the FAA decided not to propose data reporting requirements for safety-related data created under a SMS. The only documents or information that must be submitted to the FAA under the SMS provisions are the certificate holder's Implementation Plan and SMS Manual and/or ACM update. While at the entity's facility, the FAA may request to review additional SMS-related data or information under existing regulatory oversight processes to ensure that systemic or national compliance issues are reported when appropriate. The only time the FAA will take physical possession of SMS-related data off airport will be as part of an investigation. Otherwise, the certificate holder will retain all other SMS-related information. E. Safety Reporting and Interoperability The SNPRM proposed to require certificate holders to establish and maintain a confidential hazard reporting system and to encourage all persons accessing the movement and non-movement areas to report hazards to the certificate holders. The SNPRM also acknowledged the numerous ongoing SMS efforts ( e.g., part 5 and internal efforts to implement SMS within the FAA) and the overlapping responsibilities related to hazard reporting. Commenters to the SNPRM—including certificate holders, air carriers, an association, and a consultant—commented on the proposed requirement to establish and maintain a confidential hazard reporting system. In addition to concerns about data protection (see section D. “ Data Protection ”), commenters sought clarification on how SMS reporting systems are meant to work and how they should be implemented. These commenters requested the FAA address how it expects information and data to flow between the airport tenants (including those required to implement reporting systems under their own certificate programs) and certificate holders. Multiple commenters, including certificate holders and air carriers, believed that requiring employees to report to multiple SMS systems is duplicative and could cause confusion. A commenter also expressed concerns about how hazard reporting would be implemented for crewmembers or air carriers operating into multiple part 139 airports, stating that it is not reasonable to expect the crewmembers to be trained to comply with each individual airport's SMS and reporting systems. Another commenter requested the FAA clarify whether it considers a confidential hazard reporting system to be the same as an operational safety issues system. One commenter from the 2021 comment period asked whether this rule would apply to air carriers, and whether airports would be expected to investigate airline incidents or only act as a repository of lessons learned and corrective actions to be shared with all employees and employers. (1) Change in Terminology As stated in the SNPRM, the FAA agrees the term “hazard reporting system” is confusing and does not adequately address the genesis of the requirement. The intent of the reporting system is to ensure a transparent means of reporting safety issues within the movement and non-movement areas. As such, this final rule changes the terminology in § 139.402(c)(2) from “hazard reporting system” to “safety reporting system.” (2) Data Sharing and Reporting Plan The FAA agrees that, for air carriers or other tenants that are required to maintain a SMS, the reporting system as proposed in the SNPRM could be duplicative. The FAA believes that the DSR Plan (See section C. “ Non-Movement Area ”), could alleviate the duplicative reporting burden. Under § 139.402(c)(2), the airport operator is required to maintain a confidential safety reporting system. The system must be accessible by all individuals with access to the movement and non-movement areas (except those excluded through an optional DSR Plan). The certificate holder needs access to this type of data to proactively address safety issues in the movement and non-movement areas. While the FAA acknowledges that the majority of incidents related to wildlife strikes account for about 50 percent of the estimated benefits primarily occurring in the movement area, the FAA finds that the conditions for events, accidents, and incidents that occur are originating in the non-movement area. The majority of conditions, events, accidents, and incidents that occur in an airport transpire in the non-movement area. These conditions that—if unreported, unanalyzed, or unmitigated—could directly result or indirectly contribute to a chain of events that lead to accidents in air transportation. The FAA reiterates that part 5 works in parallel to this final rule, as it encourages air carriers and airports to communicate with one another when hazards and safety issues are identified through their respective SMS procedures and processes. Consistent with the intent of this rule and the FAA's SMS policy, the part 5 final rule also recommended that air carriers notify airports of hazards identified in airport facilities, so all certificate holders are aware of issues, analyze the risks, and take appropriate remedial action. One commenter from the 2021 comment period recommended that the FAA speed up the development of SMS software to enable data sharing with an FAA-supported vendor in a manner similar to how the FAA implemented the SMS requirements under part 5. The FAA does not intend to develop data sharing software at this time, but reiterates that Federal funding may be available for SMS software development. (3) Crewmembers Accessing Non-Movement Areas The FAA agrees that it is unreasonable to expect that all air carrier crewmembers would have knowledge of the reporting systems of all airports they fly into. For air carriers or other tenants not addressed through an optional DSR Plan, the FAA recommends, but does not require, that all crewmembers based at a particular airport and those crewmembers most often accessing an airport's non- movement area receive safety awareness orientation and report safety issues to the airport's safety reporting system. The FAA anticipates that crewmembers who are not based at an airport, or with limited access to the non-movement area of other airports, will continue to report safety issues through their air carrier's employee reporting system. 16 16 FAA anticipates that most air carriers with part 5 SMS programs will develop DSRs between tenants and airports; however, this rule does not establish a regulatory requirement for an airport to develop a DSR. Non-DSR agreement airports will continue to operate as they do currently to meet current requirements of other established regulations. In situations where a DSR does not exist, a pilot, for example, would continue to report hazards through their company's reporting mechanism, or through the airport's Safety Management System. The FAA deems it crucial for all individuals with access to the movement and non-movement areas to have a means of reporting safety issues and hazards, since there are limited numbers of certificate holder employees with access to these areas at any given time. The availability of alternate reporting venues increases the possibility that an air carrier employee or an employee of another tenant located at the airport will, upon witnessing safety issues not readily visible to certificate holder employees, report those observations. This, in turn, allows the certificate holder to analyze the situation and take prompt action to fix any problems found or implement ancillary measures to enhance safety at the airport. F. Training and Orientation The SNPRM identified a 2-prong approach to training requirements. First, a small number of certificate holder employees (those involved in the implementation and compliance with the SMS) would be required to receive SMS-specific training. Second, all other individuals with access to the movement and non-movement areas of the airport would not have to undergo SMS-specific training, but would instead receive hazard (safety) awareness orientation ( e.g., they could be provided with brochures or be required to complete training modules that discuss what a hazard is and how to report it to the airport's safety reporting system). 17 17 Airport SMS safety awareness/orientation can be accomplished through such methods as written communication, presentation, or brochures. Most commenters agreed with the FAA, but some from both the 2016 and 2021 comment periods requested that the FAA provide clarification. (1) Identification of Roles, Responsibilities, and Minimum Training Elements Most commenters requested that this final rule include job roles, responsibilities, and minimum training elements for compliance. Comments received during the 2021 comment period reiterated these requests. The FAA finds it would be overly prescriptive to (a) identify specific roles or job titles, or (b) set the minimum elements of SMS-specific training in regulatory text. This rule is performance-based and grants latitude to certificate holders in establishing and tailoring their SMS to their particular operations. Although the FAA requires the certificate holder to identify an accountable executive, it grants airport operators discretion as to how to allocate resources to comply with the remaining requirements of the rule. Smaller airports may use their accountable executive to implement other provisions of the rule. For example, the certificate holder can require the accountable executive to be responsible for both SRM and continuous oversight under safety assurance, instead of acting exclusively as the overarching decision maker or figurehead. Accordingly, the FAA has determined it would be overly restrictive or burdensome to identify certain roles or job titles warranting training and orientation. The FAA does not identify minimum elements of SMS-specific training for the same reason it does not identify specific roles or job titles. As explained above, the FAA wants certificate holders to have maximum flexibility in implementing the SMS, in such a way that it can be tailored to their unique operating environment, and to facilitate their compliance with the broad requirements and intent of the rule. Notwithstanding, in the interest of addressing commenters' concerns, the FAA decided to incorporate a non-binding, non-exhaustive list of examples of training programs implemented by pilot study participants in the AC. The FAA received several comments in 2021 concerning the training, qualifications, and deployment of qualified FAA SMS inspectors. Some commenters from the 2021 comment period were also concerned that FAA's oversight would encroach into certificate holders' decision-making and the judgments certificate holders make during the safety risk assessment process, including the proposed and implemented mitigations. The FAA intends to train current part 139 inspectors on overseeing compliance with this rule in the current inspection process, and on how to provide additional guidance to assist certificate holders with complying with the rule. Commenters also questioned whether the FAA would accept the completion of SMS-related coursework to demonstrate compliance with the FAA SMS requirements. Training received in support of the FAA Air Traffic Organization (ATO) or ARP SMS does not meet the intent of the SMS-specific training requirements identified in this final rule. Any existing training provided by ATO or ARP would be specific to compliance with the FAA's internal SMS efforts and not specific to the individual airport's SMS. (2) Training Estimates Used in Regulatory Evaluation Calculations A few commenters from both the 2016 and 2021 comment periods requested that the FAA provide clarification on how it developed the training estimates. Many of these commenters offered an approximation of the number of employees that would require training at their airport. The FAA agrees that the number of employees requiring SMS-specific training will vary per certificate holder. The FAA requested training information from the airports that participated in the pilot study programs. 18 That data was used to develop an average for large-sized (large, medium, and small hub airports) and small-sized (all other airports) operations. The FAA analyzed those responses and included the number of employees needing training based on the specific requirements of this final rule. The FAA notes that many of the pilot study airports appeared to provide training on topics outside the scope of this rulemaking and those courses were not included as part of the analysis. 18 External SMS Efforts—Part 139 Rulemaking, Airport SMS Pilot Studies (Sept. 22, 2020), available at https://www.faa.gov/airports/airport_safety/safety_management_systems/external/pilot_studies/./ In the 2016 comment period, four airport operators (one of which holds two AOCs) provided estimated numbers of employees needing training. One airport operator, who operates a large hub airport, agreed with the FAA's average estimates of 3 and 10 employees. The other three airport operators provided their own estimates. One operator, who holds AOCs for a large hub and a reliever airport, estimated a total of 40 employees in these airports will require training. Another large hub airport estimated 30 to 40 employees will require training. A third large hub airport estimated approximately 2 to 3 people per division will require training. In the 2021 comment period, one commenter stated that it believed the FAA estimate of 10 employees requiring comprehensive SMS training at large airports was low. Another commenter noted that some airports are expanding SRM training to include Planning, Engineering, and Capital Development teams, which increases the total anticipated trainees to more than 50 at some airports (as many as 80 total). The FAA affirms its preliminary estimates as averages for the regulated community's unique operations. The FAA recognizes that some airport operators may have to train more employees than others to ensure compliance with the rule. The FAA also understands that some certificate holders may train employees in topics that are well beyond the scope of this regulation—such as occupational health and safety issues—but those programs are separate from this final rule (as violations of other regulations would not necessarily result in part 139 violations). If a certificate holder elects to include training on topics beyond the scope of this regulation, the FAA would only conduct oversight of the SMS activities related to the applicable provisions of part 139. For example, an airport could be cited for a violation of an OSHA requirement if compliance with OSHA requirements was incorporated into its ACM, or if the OSHA violation also resulted in a failure to comply with its SMS process. However, the basis for t [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2023-03597. Public record. Not legal advice.