DPO.AR.C.015 Findings, corrective actions, and enforcement measures

(a)       When the Agency, during investigation, oversight or by any other means, identifies any non-compliance with the applicable requirements of this Regulation of a procedure or manual required by this Regulation, or of a certificate or declaration issued in accordance with this Regulation, it shall, without prejudice to any additional action required by Regulation (EU) 2018/1139, raise a finding.

(b)       The Agency shall have a system in place to:

(1)       analyse findings for their safety and interoperability significance;

(2)       identify appropriate enforcement measures, including the suspension or revocation of approvals and certificates;

(3)       issue directives on the basis of the risk posed by the organisation’s non-compliance.

(c)       A level 1 finding shall be raised by the Agency when it identifies any significant non-compliance with the ATM/ANS certification basis as per point ATM/ANS.EQMT.AR.B.001 of Annex I to Delegated Regulation (EU) 2023/1768 that may lead to uncontrolled non-compliance and to a potential unwanted condition.

Level 1 findings shall include but are not limited to:

(1)       the promulgation of operational procedures which introduce a significant risk to the organisation’s activities;

(2)       the obtainment or maintenance of the validity of the organisation’s approval through the submission of falsified documentary evidence;

(3)       evidence of malpractice or fraudulent use of the organisation’s approval;

(4)       the lack of an accountable manager.

(d)       A level 2 finding shall be raised by the Agency where non-compliance with any of the following is identified:

(i)        with the applicable requirements of Regulation (EU) 2018/1139;

(ii)       with the delegated and implementing acts adopted on the basis of Regulation (EU) 2018/1139;

(iii)      with the procedures and manuals required by Regulation (EU) 2018/1139; or

(iv)      with the approval issued in accordance with Regulation (EU) 2018/1139, which is not classified as a level 1 finding.

(e)       Where a finding is raised, the Agency shall, without prejudice to any additional action required by Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on its basis, communicate the finding in writing to the organisation concerned and require it to take corrective action to address the non-compliance(s) identified.

(1)       In the case of level 1 findings, the Agency shall immediately take appropriate enforcement measures and may, if appropriate, limit, suspend or revoke in whole or in part the approval until successful corrective action has been taken by the organisation.

(2)       In the case of level 2 findings, the Agency shall:

(i)        grant the organisation a corrective action implementation period, as part of an action plan, appropriate to the nature of the finding;

(ii)       assess the corrective action and implementation plan proposed by the organisation, and, if the assessment concludes that they are sufficient to address the non-compliance(s), accept them.

(3)       In the case of level 2 findings, where the organisation fails to submit a corrective action plan that is acceptable to the Agency in the light of the finding, or where the organisation fails to perform the corrective action within the period of time accepted or extended by the Agency, the finding may be raised to a level 1 finding and action shall be taken in accordance with point (e)(1).

(f)        For those cases where level 1 and level 2 findings are not required, the Agency may issue observations.

(g)       The Agency shall:

(1)       suspend a certificate if it considers that there are reasonable grounds that such action is necessary to prevent a credible threat to the safety, security, performance or interoperability of ATM/ANS equipment;

(2)       issue an ATM/ANS equipment directive under the conditions of point ATM/ANS.EQMT.AR.A.030 of Annex I to Delegated Regulation (EU) 2023/1768;

(3)       suspend, revoke or limit a certificate if such action is required in accordance with point (c);

(4)       take immediate and appropriate action that is necessary to limit or prohibit the activities of an organisation or a natural or legal person if it considers that there are reasonable grounds that such action is necessary to prevent a credible threat to ATM/ANS equipment;

(5)       register a declaration of design compliance only after all the findings from the initial oversight investigation have been resolved;

(6)       temporarily or permanently deregister a declaration of design compliance if it considers that there are reasonable grounds that such action is necessary to prevent a credible threat to the safety, security, performance or interoperability of ATM/ANS equipment;

(7)       take any further enforcement measures which are necessary to ensure that any non-compliance with the essential requirements of Annex VIII and, if applicable, Annex VII to Regulation (EU) 2018/1139 and with this Annex, is rectified and, where necessary, mitigate its consequences.

(h)       Upon taking enforcement measures in accordance with point (g), the Agency shall notify them to the addressee, state the reasons for them, and inform the addressee of its right to appeal.