Avioverse Supplier self-assessment
Edition v2.2
Assess Avioverse before you rely on it.
Our own assessment of Avioverse, ready for your change process: the Part-IS asset entry with CIA values, an information-security risk assessment for adopting it, the EASA AI level of each capability, our Article 50 checklist and a supplier questionnaire. Every value is our recommendation for you to confirm.
Both include the instructions for your AI assistant and all of our recommendations.
Preview the complete assessment pack
- Statement type
- Supplier self-assessment
- Risk method
- ICAO 5×5 matrix
- Reviewed
On this page
How to use this assessment
1. Choose your route
Personal use, adding Avioverse to your tools, or replacing a system. Each route sets the values and actions that apply.
2. Take our recommendations
Copy the prompt or download the pack to prefill your asset register, risk register and change record.
3. Confirm and accept
Check each value against your own context and change any that don’t fit, with the reason. Your organisation records the decision.
This is Avioverse’s own assessment, reviewed on . It is not an EASA approval, and it cannot accept risk on your behalf: your organisation’s accountable people do that.
Avioverse as a Part-IS asset
Register Avioverse as one asset. A register holds many types of asset: information, software, SaaS, hardware, network and communications, people and facilities. Avioverse is a SaaS asset: you use it and we operate it.
Recommended register entry
- Asset
- Avioverse with Metis: aviation workbench and AI assistant
- Type
- SaaS (software as a service)
- Supports
- The work you permit it for and the information used in it. Your organisation lists these.
- Supplier
- Avioverse Ltd, Cyprus. The company number and registered office are published when Avioverse opens.
- Data location
- Stored in the European Union. AI processing uses the providers and locations listed in our privacy notice.
- Interfaces
- Web browser and email. Optional: browser extension, Telegram, calendar feed and scheduled reports. The extension can read and act on pages open in the user’s browser, including your own web systems, and always asks before it submits a form.
- Owner
- Named by your organisation.
- Review
- At each new edition of this assessment, and when one of your change triggers occurs.
Recommended CIA values
Low, Medium and High map to your own scale. The values depend on how you use Avioverse.
| Property | Personal assistant | Adds to your tools | Replaces a system |
|---|---|---|---|
| Confidentiality | Low | Medium | High |
| Integrity | Medium | High | High |
| Availability | Low | Low | High |
| Safety relevance | Indirect | Indirect | Indirect, process-critical |
- Why: confidentiality
- Personal use covers public regulations and your own notes. Adding Avioverse to your tools brings in internal material such as findings and draft assessments, so set a rule on what may be uploaded. Replacing a system puts your records in it, including names in findings and reports.
- Why: integrity
- Personal outputs are working aids you check against official sources. Once an output feeds your organisation’s process, it can shape a decision about applicability, a deadline or a finding. Integrity includes how current a source is and where it came from.
- Why: availability
- Official sources and your existing systems remain the fallback in the first two routes. A replaced system stops the process when it is unavailable, and daily backups mean up to a day of recent work could be lost after a disaster.
- Why: safety relevance
- Avioverse has no connection to aircraft or operational systems; every effect passes through a person’s decision. It becomes process-critical when it holds the records that show what is due.
IS risk assessment for adopting Avioverse
A ready-made Part-IS information-security risk assessment for introducing Avioverse into your organisation. It covers the risk assessment and treatment steps for this change (IS.I.OR.205 and .210, or IS.D.OR.205 and .210 under Regulation 2022/1645). Take it into your risk register, adjust it to your operation, and have the residual risk accepted by the person your procedure names.
- Change assessed
- Introducing Avioverse for the work you name, on the route you choose.
- Assets in scope
- Avioverse (the SaaS asset in section 02), the information you put into it, the outputs you rely on, your users’ accounts and devices, and your web systems if you permit the browser extension.
- Interfaces
- Uploads and pasted text into Avioverse; outputs, exports and email notifications out of it; the browser extension where permitted.
How the 5×5 matrix works
- Initial risk:
- Avioverse as delivered, alongside your existing processes, before the mitigations listed.
- Residual risk:
- With the listed mitigations in place and working.
- Severity:
- The worst credible consequence for aviation safety. A risk with no credible safety pathway is rated D or E and also belongs in your general information-security register.
Likelihood
- 5 Frequent:
- Likely to occur many times
- 4 Occasional:
- Likely to occur sometimes
- 3 Remote:
- Unlikely to occur, but possible
- 2 Improbable:
- Very unlikely to occur
- 1 Extremely improbable:
- Almost inconceivable that it will occur
Severity
- A Catastrophic:
- Aircraft or equipment destroyed; multiple deaths
- B Hazardous:
- Large reduction in safety margins; serious injury; major equipment damage
- C Major:
- Significant reduction in safety margins; serious incident; injury
- D Minor:
- Nuisance; operating limitations; minor incident
- E Negligible:
- Few consequences
- Intolerable (5A, 5B, 5C, 4A, 4B, 3A):
- Not acceptable in the current circumstances.
- Tolerable (all other cells):
- Acceptable once mitigated, with the decision recorded by the person who accepts it.
- Acceptable (3E, 2D, 2E, 1B, 1C, 1D, 1E):
- Acceptable as it stands.
Summary: initial → residual risk
| Risk | Adds to your tools | Replaces a system |
|---|---|---|
| R1 · Confidential information leaves your control | 3D → 2D (acceptable) | 4D → 2D (acceptable) |
| R2 · Wrong information enters a decision | 4C → 2C (tolerable) | 4C → 2C (tolerable) |
| R3 · Manipulated content redirects the assistant | 3C → 2C (tolerable) | 3C → 2C (tolerable) |
| R4 · Account compromise or excess access | 3D → 2D (acceptable) | 3C → 2C (tolerable) |
| R5 · Information stays with people who leave | 3D → 2D (acceptable) | 3D → 2D (acceptable) |
| R6 · The browser extension reaches your web systems | 3C → 2C (tolerable) | 3C → 2C (tolerable) |
| R7 · A scheduled report is taken as complete monitoring | 3C → 2C (tolerable) | 3C → 2C (tolerable) |
| R8 · Avioverse is unavailable when needed | 3E → 3E (acceptable) | 3C → 3D (tolerable) |
| R9 · Records are lost or cannot be produced | 2E → 2E (acceptable) | 3C → 2D (acceptable) |
| R10 · Review weakens over time | 3C → 2C (tolerable) | 3C → 2C (tolerable) |
| R11 · A product change invalidates this assessment | 3D → 2D (acceptable) | 3C → 2C (tolerable) |
Risk register
R1 · Confidential information leaves your control
Staff upload internal material, such as findings, occurrence details or personal data. Avioverse and the AI providers it uses process it under Avioverse’s terms rather than your own contracts.
- Affects
- Information you upload · confidentiality
- Consequence
- Information is processed or exposed in a way your policy does not allow. Leaked confidential safety reports can discourage reporting.
- Already in Avioverse
- Storage in the European Union. No training on your content. Providers and locations listed in the privacy notice. Team content visible only to members.
- Your mitigations
- Set a rule on what may be uploaded. Exclude confidential occurrence reports and personal data unless approved. Check the provider list at each new edition.
- Adds to your tools:
- 3D Tolerable → 2D Acceptable
- Replaces a system:
- 4D Tolerable → 2D Acceptable
- Owner:
- Information owner
R2 · Wrong information enters a decision
An answer, summary or extracted value is incomplete, outdated or wrong, and is used without an adequate check.
- Affects
- Outputs you rely on · integrity
- Consequence
- A wrong conclusion about applicability, a deadline or a finding enters your process, and a requirement is missed.
- Already in Avioverse
- Answers show their sources and are checked against them. The regulation library keeps each version with its effective dates, and ADs and SIBs are synced from EASA. Every chat reminds users to verify.
- Your mitigations
- Name the outputs that may be used and how each is checked. A competent person checks the official source and the case facts before use, and the check is kept.
- Adds to your tools:
- 4C Tolerable → 2C Tolerable
- Replaces a system:
- 4C Tolerable → 2C Tolerable
- Owner:
- Process owner
R3 · Manipulated content redirects the assistant
An uploaded file or web page contains instructions written to redirect the assistant.
- Affects
- Outputs and saved records · integrity
- Consequence
- Analysis, saved records or actions depart from what the user asked.
- Already in Avioverse
- Documents and web pages are treated as content, not instructions. Deleting, scheduling and submitting forms in the browser need the user’s approval.
- Your mitigations
- Upload material from known sources. Users review saved changes and every approval request.
- Adds to your tools:
- 3C Tolerable → 2C Tolerable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Service owner
R4 · Account compromise or excess access
A user’s email or password is compromised, or someone keeps access they no longer need.
- Affects
- User accounts and the information they reach · confidentiality, integrity
- Consequence
- Your information is read or changed without authority.
- Already in Avioverse
- Access is checked on the server for every workspace request. Team owners and admins control membership and roles.
- Your mitigations
- Sign in with your organisation’s Google or Microsoft accounts so your own sign-in controls apply. Remove leavers on their last day and review membership at each review.
- Adds to your tools:
- 3D Tolerable → 2D Acceptable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Service owner
R5 · Information stays with people who leave
Organisation material is kept in a personal workspace or in the assistant’s memory, and stays there when the person leaves.
- Affects
- Organisation information in personal accounts · confidentiality
- Consequence
- Your information remains outside your control.
- Already in Avioverse
- Team content is separate from personal workspaces. Memory belongs to each account and is not shared with the Team.
- Your mitigations
- Keep organisation material in the Team workspace. Tell users what may go into personal memory, and add its removal to your leaver steps.
- Adds to your tools:
- 3D Tolerable → 2D Acceptable
- Replaces a system:
- 3D Tolerable → 2D Acceptable
- Owner:
- Service owner
R6 · The browser extension reaches your web systems
The browser extension reads and acts on pages open in the user’s browser, which can include your own web systems.
- Affects
- Your web systems and their data · confidentiality, integrity
- Consequence
- Data from those systems is sent to Avioverse, or an unintended entry is made in them.
- Already in Avioverse
- The extension acts only on the user’s instruction, and every form submission needs the user’s approval.
- Your mitigations
- Decide whether the extension is permitted. If it is, name the systems it may be used with, and have users check each approval.
- Adds to your tools:
- 3C Tolerable → 2C Tolerable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Service owner
R7 · A scheduled report is taken as complete monitoring
A scheduled watch fails, runs late or misses a relevant change, and the silence is read as “nothing changed”.
- Affects
- Monitoring of ADs and regulatory change · integrity, availability
- Consequence
- A new or revised requirement is not acted on in time.
- Already in Avioverse
- Scheduled runs are read-only. A run that cannot finish is reported as incomplete, not as checked.
- Your mitigations
- Keep your official monitoring of ADs and regulatory changes, and treat reports as an extra check.
- Adds to your tools:
- 3C Tolerable → 2C Tolerable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Process owner
R8 · Avioverse is unavailable when needed
Avioverse is down or unreachable when the work needs it.
- Affects
- The work that uses Avioverse · availability
- Consequence
- The work is delayed. When Avioverse holds the tracker, a due item can be missed.
- Already in Avioverse
- Daily backups with an off-site copy for recovery.
- Your mitigations
- Write down how the work continues without Avioverse. When it replaces a system, keep the latest export where the fallback can use it.
- Adds to your tools:
- 3E Acceptable → 3E Acceptable
- Replaces a system:
- 3C Tolerable → 3D Tolerable
- Owner:
- Process owner
R9 · Records are lost or cannot be produced
Records kept in Avioverse are lost, deleted or cannot be produced, including after you stop using Avioverse.
- Affects
- Records kept in Avioverse · integrity, availability
- Consequence
- You cannot show the authority what was found, decided or done, and an overdue item can go unseen.
- Already in Avioverse
- Daily backups with an off-site copy. “Download my data” at any time. Account deletion has a 30-day window to change your mind.
- Your mitigations
- Decide which records are official. Export them to your records system on a schedule, and confirm you can export everything before you depend on it.
- Adds to your tools:
- 2E Acceptable → 2E Acceptable
- Replaces a system:
- 3C Tolerable → 2D Acceptable
- Owner:
- Information owner
R10 · Review weakens over time
Time pressure or familiarity leads people to accept outputs without the agreed check.
- Affects
- The human review of outputs · integrity
- Consequence
- Outputs are relied on beyond what was assessed.
- Already in Avioverse
- Sources are shown with each answer, and every chat reminds users to verify.
- Your mitigations
- Set the reviewer’s competence and workload, train users on Avioverse’s limits, and sample reviewed outputs at each review.
- Adds to your tools:
- 3C Tolerable → 2C Tolerable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Process owner
R11 · A product change invalidates this assessment
Avioverse changes a feature, AI provider or control that this assessment relied on.
- Affects
- The assessed configuration · confidentiality, integrity, availability
- Consequence
- The assessment no longer matches what you use.
- Already in Avioverse
- Changes to this assessment are published as new editions with their history.
- Your mitigations
- Name who watches for new editions, and reassess at each one and at your own change triggers.
- Adds to your tools:
- 3D Tolerable → 2D Acceptable
- Replaces a system:
- 3C Tolerable → 2C Tolerable
- Owner:
- Service owner
Personal use is outside your organisation’s risk register; its checklist is in section 06. Add any risk specific to your own operation.
EASA AI classification
EASA’s AI levels describe who decides and who acts. We classify each capability by what Metis does and what the person keeps.
| Capability | What Metis does | What the person does | Level | Why |
|---|---|---|---|---|
| Ask and research | Finds, reads and summarises sources, and answers with citations. | Evaluates the answer and decides what to do with it. | 1A | It only gathers and analyses information. |
| Assess and recommend | Compares requirements, drafts assessments and proposes options. | Chooses the option and makes the decision. | 1B | It assists the decision; the decision stays with the person. |
| Save and update records | Creates or changes tasks, notes and records when asked. | Directs the change and can review or undo it. Deleting and scheduling need approval. | 2A | The person decides; Metis carries out the action under the person’s oversight. |
| Scheduled watches and reports | Researches on a schedule and delivers a report. | Sets the watch and decides what to do with the report. | 1A or 1B | It runs unattended but can only read and research. 1B when the report recommends action. |
| Browser actions | Reads and operates web pages in the user’s browser. | Gives the instruction and approves every form submission. | 2A | The person directs the task and approves each commitment; Metis performs the steps. |
What the levels mean
- 1A Human augmentation:
- The AI supports gathering and analysing information.
- 1B Human cognitive assistance:
- The AI supports the person’s decision; the person decides.
- 2A Human–AI cooperation:
- The AI carries out decisions and actions the person directs, under the person’s oversight.
Levels 2B and 3 are not used: Metis never shares decision authority with the person or acts on its own authority.
Avioverse is not a certified or approved aviation system. We use EASA’s levels because they are the recognised way to describe who decides and who acts. Concept Paper Issue 3 and NPA 2025-07 are proposals; we will revise this section when they are adopted.
EU AI Act: Article 50 checklist
Article 50 of the EU AI Act sets transparency duties for AI systems that talk to people or generate text. Avioverse is the provider of Metis; your organisation is a deployer when it uses Metis.
What Avioverse does
| Duty | What we do | Status |
|---|---|---|
| 50(1) Tell people they are talking to an AI | A line under every chat box in the app and the browser extension, and once in the Telegram pairing message. | Done |
| 50(1) Say it is an AI whenever asked | Metis answers truthfully today. An explicit instruction to Metis is still to be added. | Open |
| 50(2) Machine-readable marks on AI text | Metis is built on AI models from specialist vendors, and we rely on their marking: an answer carries a vendor’s watermark where that vendor applies one. Every AI output is logged. | Position documented |
| 50(2) Files Metis produces | Not marked. They are made on your instruction from your material, and their origin is recorded in Avioverse. | Position documented |
| 50(4) AI summaries of ADs, SIBs and library documents | Each summary carries the Metis mark and the note “Summarised by AI.” | Done |
| 50(4) Our articles and guides | A named author reviews each one and holds editorial responsibility. | Done |
| 50(3) Emotion recognition or biometric categorisation | Not in the product. | Not applicable |
| 50(5) Clear, at first interaction, accessible | Plain text, visible before the first message and read by screen readers. | Done |
| Code of Practice on AI-generated content | Not signed. Our gap analysis against each of its required measures is in the next section. | Done |
| Risk category | Not high-risk: Metis is not a safety component under Regulation (EU) 2018/1139 and not an Annex III use. | Position documented |
What your organisation does
- If you publish text Metis wrote on a matter of public interest, such as a safety notice to an open audience, without substantive human review, label it as AI-generated (50(4)). The Code of Practice’s EU “AI” icon, placed at the top of the text, is the recognised label.
- The deepfake and emotion-recognition duties do not arise: Metis produces no images, audio or video, and does not recognise emotions.
EU AI Act: Code of Practice gap analysis
The EU Code of Practice on transparency of AI-generated content (final, June 2026) sets out how to meet Article 50(2), (4) and (5). We have not signed it. The Commission expects non-signatories to show how they measure up, so here is our gap analysis against each of its required measures.
Avioverse as provider of Metis (Section 1)
| Code measure | Where we stand | Status |
|---|---|---|
| 1.1 Machine-readable marking of answers | Metis is built on AI models from specialist vendors, and we rely on their marking, as the Commission’s Article 50 guidelines allow. An answer carries a vendor’s watermark where that vendor applies one. | Via our model vendors |
| 1.1 Very short text | AD and SIB summaries are 1–3 sentences, under the Code’s 200-token threshold, so no watermark is expected. | Not required |
| 1.1 Files Metis produces | Files are made from your material: filled forms, tables, charts and format conversions only arrange or convert what you gave. Article 50(2) does not cover that (Article 50 guidelines, points 65 and 91–92). | Not required |
| 1.2 Keep marks, offer no removal tools | Metis does not strip marks from your material, and we offer no tool that removes them. | Compliant |
| 2 Detection | Each vendor that watermarks provides detection of its mark to authorities, researchers and media. Our records show which model wrote each answer. | Via our model vendors |
| 3 Effective, reliable, robust, interoperable | Rests on each vendor’s marking and its testing, which a provider building on their models may rely on. | Via our model vendors |
| 4 Compliance process | A documented compliance record, reviewed whenever models or features change. The operator is trained on Article 50, and we cooperate with market surveillance authorities. | Compliant |
Avioverse as publisher of AI summaries and articles (Section 2)
| Code measure | Where we stand | Status |
|---|---|---|
| Scope | Section 2 covers deep fakes and text published to inform the public on matters of public interest. Metis makes no images, audio or video, and its answers reach only the person who asked. | Not applicable |
| AI summaries in the library | Each AI summary of an AD, SIB or library document carries the Metis mark and the note “Summarised by AI.”, shown with the summary and read by screen readers. | Compliant |
| 4 Human review of articles and guides | Each article and guide names its author, who reviews it and holds editorial responsibility. Name, role and contact are published. | Compliant |
| 2 Internal process and corrections | Every place a label appears is recorded and checked when screens change. Report a missing or wrong label to privacy@avioverse.io and we fix it without delay. | Compliant |
Management of change
Choose the route that matches your use. Each route starts from the CIA values and risk ratings above and lists what to put in place before use.
Personal assistant
You use Avioverse on your own account for your own work. No organisational change record is needed; this is your personal checklist.
- CIA values
- Confidentiality Low · Integrity Medium · Availability Low
- Risks
- R1, R2, R3 and R10 in section 03 apply to you as well. There is no organisational rating.
Your checklist
- Follow your employer’s policy on external software and AI tools.
- Upload only material you are allowed to use. Ask before uploading your organisation’s documents.
- Check each answer against the official source before you act on it. Metis shows the sources it used.
- Treat outputs as your own working aids. They do not replace approved documents or your organisation’s procedures.
- Sign-off:
- You.
- Next route:
- Move to “Adds to your tools” when you upload your organisation’s material, when an output goes into your organisation’s process or records, or when colleagues join you in a Team workspace.
Adds to your tools
Your organisation uses Avioverse alongside its existing systems, which stay the official record. Typical uses: research, drafting, comparisons and working trackers.
- CIA values
- Confidentiality Medium · Integrity High · Availability Low
- Risks
- R1–R11 in section 03, rated for “Adds to your tools”.
Before use
- Record the change: introduce Avioverse as a supporting tool for the work you name, and exclude official records and the only monitoring of ADs or regulatory changes.
- Add the Avioverse asset entry to your register: Confidentiality Medium, Integrity High, Availability Low.
- Name the service owner.
- Put the mitigations from the risk assessment in place, each with an owner, and have the residual risk accepted.
- Set the rule on what information may be uploaded.
- Define who reviews outputs, the competence they need and the check they perform.
- Brief users on what Avioverse is for, its limits and the upload rule.
- Set up a Team workspace and assign roles.
- Decide whether the browser extension is permitted, and for which of your systems.
- Add Avioverse to your leaver steps: remove the person from the Team and ask them to remove organisation material from their personal account.
- Set a review interval, such as twelve months or each new edition of this assessment.
- If your exposition and procedures do not change, this is normally an internal change under your own change procedure. Confirm this against your exposition.
- Sign-off:
- The person your change procedure names, normally the manager of the affected process.
- Next route:
- Move to “Replaces a system” when Avioverse becomes the only place a record is kept, or when a procedure names it as the system to use.
Replaces a system
Avioverse takes over work you did in another system, such as a spreadsheet for findings, trackers or the audit programme.
- CIA values
- Confidentiality High · Integrity High · Availability High
- Risks
- R1–R11 in section 03, rated for “Replaces a system”.
Before use
- Complete every action for “Adds to your tools”, with the register entry at Confidentiality High, Integrity High, Availability High.
- Amend the procedures that name the old system, and check whether your approval’s change rules require the authority to be notified or to approve.
- Decide which records in Avioverse are official. Export them to your records system on a schedule; our backups are for disaster recovery, not records retention.
- Migrate the data, then reconcile it against the source: counts, open items and due dates. Sign off the reconciliation.
- Run both systems in parallel for a set period and compare the results.
- Write down how the work continues if Avioverse is unavailable, using the latest export.
- Confirm you can export everything you need in a usable format before you retire the old system.
- Sign-off:
- The person your change procedure names for changes to procedures.
Supplier self-assessment
Our answers to the questions a supplier review normally asks. Contact us for anything not covered here.
| Topic | Our answer | Status |
|---|---|---|
| Company | Avioverse Ltd, Cyprus. The company number and registered office are published when Avioverse opens. | Before launch |
| Hosting and storage | Servers, database, files and backups are in the European Union. | In place |
| Service providers | Listed with their purpose, the data involved and their location in our privacy notice. | In place |
| Training on your content | We do not use your content to train AI models. | In place |
| Encryption in transit | All traffic to and from Avioverse uses HTTPS. | In place |
| Sign-in | Email code, password, or Google or Microsoft sign-in. | In place |
| Access control | Every workspace request is checked on the server. Team owners and admins manage members and roles. | In place |
| Record history | Audits and forms keep a history of review decisions and changes. Every AI generation is logged. | In place |
| Backups | Daily backups with an off-site copy. Up to a day of recent work could be lost after a disaster. | In place |
| Export | “Download my data” gives a machine-readable copy of your account at any time. | In place |
| Deletion | Account deletion is self-serve, with 30 days to change your mind. Erased data leaves backups within about two days. | In place |
| Human approval and answer checks | Deleting, scheduling and submitting forms in the browser need your approval. Answers show their sources and are checked against them. | In place |
| Security contact and breach notice | Report security issues to security@avioverse.io. We notify affected customers of personal-data breaches as the GDPR requires. | In place |
| Security testing | Dependencies are checked for known vulnerabilities on every push. No external penetration test yet. | Partial |
| Change notices | Changes to this assessment are published as new editions with their history. | In place |
| EU AI Act | We are the provider of Metis. See the Article 50 checklist. | In place |
Editions, sources and contact
· v2.2
Named the supplier as Avioverse Ltd, Cyprus. Its company number and registered office follow when Avioverse opens.
· v2.1
Added a gap analysis against the EU Code of Practice on transparency of AI-generated content, and updated the Article 50 marking row to match.
· v2.0
Rebuilt as Avioverse’s own self-assessment: one Part-IS asset entry with CIA values, a Part-IS risk assessment for adopting Avioverse (initial and residual risk on the ICAO 5×5 matrix), EASA AI levels with reasons, an Article 50 checklist, three change-management routes and a supplier questionnaire.
· v1.0
Initial organisational assessment pack.
Reassess when you change how you use Avioverse, when we publish a new edition, or after a relevant incident. Keep the edition you assessed with your change record.
Sources
- EASA Part-IS Easy Access Rules · Regulations (EU) 2023/203 and 2022/1645 with AMC/GM
- EASA risk-management FAQs · Authority guidance
- ICAO Doc 9859 Safety Management Manual, 4th edition · Source of the 5×5 risk matrix
- EASA AI Concept Paper, Issue 2 · Published guidance, 2024
- EASA AI Concept Paper, proposed Issue 3 · Proposal, 2026
- NPA 2025-07: AI trustworthiness · Regulatory proposal
- EU Artificial Intelligence Act · Regulation (EU) 2024/1689
- Commission guidelines on Article 50 transparency obligations · Adopted 2026
- Code of Practice on transparency of AI-generated content · Final, June 2026; not signed by Avioverse
Need more evidence for your review? Contact Avioverse