21.B.221 Oversight principles

(a)     The competent authority shall verify:

1.       compliance with the requirements that are applicable to organisations, prior to issuing the production organisation approval certificate;

2.       continued compliance with the applicable requirements of the organisations it has certified;

3.       the implementation of appropriate safety measures mandated by the competent authority according to points 21.B.20(c) and (d).

(b)     This verification shall:

1.       be supported by documentation specifically intended to provide personnel responsible for oversight with guidance to perform their functions;

2.       provide the organisations concerned with the results of oversight activities;

3.       be based on assessments, audits, inspections and, if needed, unannounced inspections;

4.       provide the competent authority with the evidence needed in case further action is required, including the measures provided for in point 21.B.225.

(c)      The competent authority shall establish the scope of the oversight defined in points (a) and (b) taking into account the results of past oversight activities and the safety priorities.

(d)     If the facilities of an organisation are located in more than one State, the competent authority, as defined in point 21.1, may agree to have the oversight tasks performed by the competent authority(ies) of the Member State(s) where the facilities are located, or by the Agency for facilities that are located outside a territory for which Member States are responsible under the Chicago Convention. Any organisation that is subject to such an agreement shall be informed of its existence and of its scope.

(e)     For any oversight activities that are performed at facilities located in a Member State other than where the organisation has its principal place of business, the competent authority, as defined in point 21.1, shall inform the competent authority of that Member State before performing any on-site audit or inspection of the facilities.

(f)      The competent authority shall collect and process any information deemed necessary for performing oversight activities.

(g)     With regard to the certification and oversight of the organisation’s compliance with point 21.A.139A, in addition to complying with points (a) to (f), the competent authority shall review any approval granted under point IS.I.OR.200(e) of this Regulation or point IS.D.OR.200(e) of Delegated Regulation (EU) 2022/1645 following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.

[point (g) is applicable from 22 February 2026 – Regulation (EU) 2023/203]