ATCO.AR.B.005 Allocation of tasks to qualified entities

[applicable until 21 February 2026 - Regulation (EU) 2023/893] ATCO.AR.B.005 Allocation of tasks [applicable from 22 February 2026 – Regulation (EU) 2023/203]

(a)If the competent authority allocates tasks related to the initial certification or continuous oversight of persons or organisations subject to Regulation (EC) No 216/2008 and its implementing rules, they shall only be allocated to qualified entities. When allocating tasks, the competent authority shall ensure that it has:

(1)a system in place to initially and continuously assess that the qualified entity complies with Annex V to Regulation (EC) No 216/2008. This system and the results of the assessments shall be documented;

(2)established a documented agreement with a qualified entity, approved by both parties at the appropriate management level, which clearly defines:

(i)the tasks to be performed;

(ii)the declarations, reports and records to be provided;

(iii)the technical conditions to be met in performing such tasks;

(iv)the related liability coverage; and

(v)the protection given to information acquired in carrying out such tasks. [applicable until 3 August 2024 - Regulation (EU) 2015/340]

(a)If the competent authority allocates tasks related to the initial certification or continuous oversight of persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts, they shall only be allocated to qualified entities. When allocating tasks, the competent authority shall ensure that it has:

(1)a system in place to initially and continuously assess that the qualified entity complies with Annex VI to Regulation (EU) 2018/1139. This system and the results of the assessments shall be documented;

(2)established a documented agreement with a qualified entity, approved by both parties at the appropriate management level, which clearly defines:

(i)the tasks to be performed;

(ii)the declarations, reports and records to be provided;

(iii)the technical conditions to be met in performing such tasks;

(iv)the related liability coverage; and

(v)the protection given to information acquired in carrying out such tasks. [applicable from 4 August 2024 - Implementing Regulation (EU) 2023/893]

(b)The competent authority shall ensure that the internal audit process and a safety risk management process required by ATCO.AR.B.001(a)(4) cover all certification or oversight tasks performed on its behalf.

(c)With regard to the certification and oversight of the organisation’s compliance with point ATCO.OR.C.001A, the competent authority may allocate tasks to qualified entities in accordance with point (a), or to any relevant authority responsible for information security or cybersecurity within the Member State. When allocating tasks, the competent authority shall ensure that:

(1)all aspects related to aviation safety are coordinated and taken into account by the qualified entity or relevant authority;

(2)the results of the certification and oversight activities performed by the qualified entity or relevant authority are integrated in the overall certification and oversight files of the organisation;

(3)its own information security management system established in accordance with point ATCO.AR.B.001(e) covers all the certification and continuing oversight tasks performed on its behalf. [applicable from 22 February 2026 – Regulation (EU) 2023/203]