EASA announced on 23 February 2026 that "Regulation (EU) 2023/203 (Implementing Regulation of Part-IS) became applicable on the 22nd of February 2026." EASA describes this as full applicability of Part-IS across the EU aviation sector, following the Delegated Regulation (EU) 2022/1645, which began applying in October 2025.
Safeguard does not make avionics or certify anyone to Part-IS. This post is for software suppliers whose customers are now in scope.
What's affected
Per EASA's applicability FAQ, Regulation 2023/203 applies to maintenance organisations under Part-145 (with exceptions), continuing airworthiness management organisations, air operators under Part-ORO (with exceptions), approved training organisations, aero medical centres and flight simulation training device operators, ATCO training organisations, ATM/ANS service providers, U-space service providers, and design and production organisations for ATM/ANS systems. The Delegated Regulation 2022/1645 adds Part 21 design and production organisations and aerodrome operators. Competent authorities are also covered.
EASA's FAQ states that Part-IS sets "requirements for an information security management system (ISMS)" that are largely aligned with ISO/IEC 27001 but include aviation specific provisions. I did not read the regulation text clause by clause, so check the regulation for exact duties.
How to check if you're exposed
If you sell software, tooling or equipment to any of the organisations above, ask your customers whether they are in scope and what they now require of suppliers. Then check what you can show about:
- Which components are in each product release
- Known vulnerabilities in those components and what was decided
- How and how fast fixes are delivered
- Who can change your build and release process
What to do now
- Produce a software bill of materials per release.
- Scan it and keep dated results, including which findings are on CISA's Known Exploited list.
- Write down your fix delivery process, including offline delivery for sites without internet.
- Keep an audit log of approvals for releases.
- Prepare a standard answer pack so each customer question does not start from zero.
Why it matters
Regulation of an operator reaches its suppliers through procurement. Maintenance shops, operators and training providers will ask the same questions of every vendor, and the supplier with the records ready answers quickly.
Try it yourself
Map a few of those questions to a framework view, and see how one set of evidence can answer several.
Click through it at your own pace, or open it full screen.
Quick check
On what date did Regulation (EU) 2023/203 become applicable?
22 February 2026.
Is Part-IS only for airlines?
No. It covers maintenance, training, air navigation services, U-space providers and others, plus competent authorities.
