ATM/ANS.OR.A.045 Changes to a functional system

NOTIFICATION The notification of a change should not be considered complete until the following information is provided:

(a)Name of the organisation notifying the change;

(b)Unique identifier of change;

(c)Version number of notification;

(d)Title of the change;

(e)Date of the submission of the original of this change notification;

(f)Scheduled date of entry into service (even if only approximate);

(g)Details of the change and its impact;

(h)The list of the service providers and other aviation undertakings that are affected by the change as identified in ATM/ANS.OR.A.045(a)(3);

(i)Entity in charge of the assurance case; and

(j)Identity of a point of contact for communications with the competent authority.

NOTIFICATION

(a)A change should be notified as soon as the data defined in AMC1 ATM/ANS.OR.A.045(a) is available. The decision to review a change by the competent authority will be based, in most circumstances, on the notification data. Exceptions to this are cases where the competent authority is not familiar with the type of change or the complexity of the change requires a more thorough consideration.

(b)Early and accurate notification facilitates the interactions between the provider and the competent authority and, thus, maximises the likelihood of introducing a change into service in due time and according to the service provider’s initial schedule when the competent authority has decided to review an assurance case. Therefore, it is advisable that the change description identified in AMC1 ATM/ANS.OR.A.045(a) is completed as soon as possible and contains the following data:

(1)Purpose of the change;

(2)Reasons for the change;

(3)Place of implementation;

(4)New/modified functions/services brought about by the change;

(5)High-level identification of the constituents of the functional system being changed, and what is modified in their functionality;

(6)Consequence of the change, i.e. the harmful effects of the hazards associated with the change — see (f) below and also the definition of ‘risk’ in Annex I (85).

(c)The information provided in (b) may expedite the decision whether to review or not the proposed change, because it will allow the competent authority to gain complete knowledge of the change and, consequently, reduces the need for additional information. However, lack of some of this data should not delay the service provider’s submission of the notification if to do so is likely to impede the introduction of the change. It should be noted that early interaction with its competent authority may help to complete the missing data.

(d)The service provider should take into account that an early, clear and accurate change notification will assist the competent authority in making the decision to review or not the change and may prevent any inconvenience such as:

(1)the competent authority having to ask for more information about the change in order to make its decision as required in ATM/ANS.OR.A.045(a)(2);

(2)the competent authority deciding to review a change unnecessarily because the notification is not clear enough; or

(3)the delay in the competent authority deciding whether to review a change, caused by the lack of information, having an impact on the proposed date of entry into service.

(e)It is recognised that the understanding of the change will improve as the change process progresses and the interaction between the competent authority and the service provider strengthens. The service provider should notify the competent authority when the information provided in the previous notification is no longer valid or when the information previously missing becomes available. When additional information — other than the data specified in AMC1 ATM/ANS.OR.A.045(a) — is supplied at the competent authority’s request, then no update of the notification is required.

(f)For air traffic services (ATS) providers, the consequences of the change specified in (b)(6), should be expressed in terms of the harmful effects of the change, i.e. the effects of the hazards associated with safety risks. These could be the result of a preliminary safety assessment, if available, or an early hazard analysis that concentrates on the service level effects. For service providers other than air traffic services providers, the consequences should be expressed in terms of what aspects of the performance of the service are impacted by the change.

(g)The point of contact, as required in point (j) in AMC1 ATM/ANS.OR.A.045(a), provides a focal point for the competent authority to contact when seeking complementary information about the change when required. The aim is to improve communications between the provider and the competent authority about the change.

(h)All notified changes should be unambiguously identified. The service provider and its competent authority should agree on a means of referencing so as to associate a unique identifier to a given notified change.

(i)For routine changes, the notification to the competent authority may be done in a simpler manner, e.g. using forms less detailed than those specified in AMC1 ATM/ANS.OR.A.045(a) or notifying these changes collectively after being implemented at regular periods of times agreed between the provider and the competent authority. A service provider and its competent authority should coordinate so as to reach a common agreement on these types of changes that may not be reviewed by the competent authority. The list of such changes should be documented and formalised. The formalised agreement becomes part of the change management procedures identified in ATM/ANS.OR.B.010. Consequently, the list will be reviewed by the competent authority as part of the audits it performs that are described in ATM/ANS.AR.C.010(a). The relevant audit activity is detailed in AMC1 ATM/ANS.AR.C.010(a)(a)(2).

NOTIFICATION — SOFTWARE CRITICALITY Depending on the complexity of the change to the functional system and the criticality of the software, the depth of the evaluation may vary. The service provider should coordinate as soon as possible with the competent authority in order to define a software oversight strategy as part of the change review activities, if a decision for change review is taken.

NOTIFICATION TO USERS OF THE SERVICE Having notified a change, the service provider should:

(a)individually inform all known service providers potentially affected by the notified change; and

(b)inform all aviation undertakings potentially affected by the change either individually or via a representative body of aviation undertakings or by publishing details of the planned change in a dedicated publication of the service provider or aeronautical information publications such as an aeronautical information circular (AIC).

DEDICATED PUBLICATION FOR PROPOSED CHANGES The final users of services potentially affected by a change to a functional system may not be known by the service provider proposing the change. However, this should not prevent the service provider from using other means for notification than direct communication with the interested parties. In that case, the changes may be published in a dedicated website where the users of the service can periodically check for current proposed changes to the functional system that may affect them.

MODIFICATION OF A NOTIFIED CHANGE

(a)The service provider should inform the competent authority that was initially notified about any update in the notification data when the information provided in a previous notification about the same change is no longer valid or when information previously missing becomes available. The other service providers and aviation undertakings should also be informed, when they are affected by the new data.

(b)The cancellation of a previously notified change should be considered as a modification of a notified change. Therefore, the service provider should inform about this update the competent authority, and inform other service providers and aviation undertakings that were initially informed about the change.

ENTRY INTO OPERATIONAL SERVICE OF A CHANGE SELECTED FOR REVIEW The service provider should not start the implementation of any part of the change that has the potential to affect the safety of the services currently being provided until a valid safety (support) assessment for that part of the change exists and, if the change is subject to competent authority review, it has been approved by the competent authority.

TRANSITION INTO SERVICE

(a)No matter whether the competent authority has decided to review the notified change or not, the service provider should not start the implementation of any part of the change that has the potential to affect the safety of any of the services it provides, e.g. the functions performed or the performance of the services, until it has produced a valid argument in accordance with ATS.OR.205(a)(2) or/and ATM/ANS.OR.C.005(a)(2), as appropriate.

(b)Implementation of the change, which means the creation and installation of the items to be used in the changed operational system may or may not affect the performance of the current services offered by the service provider. For example, much of the implementation of equipment and procedures can be performed ‘off line’, i.e. in development facilities that do not interact with the operational services and installation may be started, provided the items are not connected to the operational system and their presence in the operational environment does not affect the current services. However, these items must not be introduced into the operational system, i.e. they must not affect the behaviour of any operational service, until a valid assurance case exists and, if the change is subject to competent authority review, before the competent authority has approved the change.

(c)The installation of an artefact may have an impact on services other than the service being changed. This can happen where the installation involves disrupting these other services, e.g. aerodrome operations may be disrupted because runways or taxiways are being used by constructor’s vehicles or are being interfered with. In this case, the scope of the change includes these other services (please refer to ATM/ANS.OR.C.005(a)(1)(iii) & (iv) or ATS.OR.205(a)(1)(iii) & (iv), as appropriate) and the assessment of the change includes the effects installation may have on them, including where the installation does not go according to plan.

CHANGES AFFECTING MULTIPLE SERVICE PROVIDERS — OVERARCHING SAFETY ARGUMENT A change as defined in ATM/ANS.OR.A.045(e) may involve more than one service provider changing their functional systems. In this case, the change will consist of a set of changes to different ATM/ANS functional systems or their context. However, no matter how many individual changes to service providers’ functional systems are part of the change, they should be coordinated. An overarching safety argument, coherent with the arguments of the individual changes, that claims the complete change is safe should be provided.

CHANGES AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — GENERAL

(a)Any change proposed by a service provider as defined in ATM/ANS.OR.A.045(a) affects other service providers and/or aviation undertakings when:

(1)the proposed change may alter the service delivered to other service providers and aviation undertakings as users of that service; or

(2)the proposed change may alter the operational context in which the services of other service providers and aviation undertakings are delivered or in which the aviation undertakings are operating.

(b)The changes referred to in ATM/ANS.OR.A.045(e) could be considered ‘multi-actor changes’ and are those changes that require coordination between the service provider(s) proposing the change and any service providers and aviation undertakings affected by the change(s) due to the presence of dependencies between the service providers that planned the change and other affected service providers and/or other aviation undertakings. This coordination is essential to ensure a correct safety (support) assessment when there are dependencies.

(c)A single-actor change is one that is limited to those cases where a change to a service provider’s functional system alters neither the service nor the operational context of other service providers and aviation undertakings.

AFFECTED STAKEHOLDERS — SERVICE PROVIDERS AND AVIATION UNDERTAKINGS

(a)‘Other service providers’ mentioned in ATM/ANS.OR.A.045(e) refers to European service providers other than the service provider proposing the change, that are regulated in accordance with Regulation (EC) No 216/2008 and its implementing rules;

(b)Aviation undertakings affected by the change included in ATM/ANS.OR.A.045(e) can be understood as the stakeholders and professional associations with dependencies with the changed service, and may include the following:

(1)service providers that do not fall under the remit of Regulation (EC) No 216/2008 and its implementing rules, e.g. non-European service providers;

(2)aerodrome operators;

(3)aircraft operators;

(4)airframe and equipment manufacturers;

(5)maintenance organisations;

(6)regulatory bodies, e.g. European Commission, EASA, national aviation authorities (NAAs); and

(7)other bodies not regulated by Regulation (EC) No 216/2008 and its implementing rules, e.g. power suppliers or military authorities.

CHANGE AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — COORDINATION

(a)ATM/ANS.OR.A.045(e) applies to all the affected service providers involved in the change, and, therefore, they should coordinate dependencies as well as shared assumptions and shared risk mitigations. They should only use the agreed and aligned assumptions and mitigations that are related to more than one service provider or aviation undertaking in their safety or safety support cases, as required by ATM/ANS.OR.A.045(f).

(b)Assumptions and risk mitigations used during the assessment of the change that are not shared by the affected service providers, can be handled independently by each service provider, and do not need agreement.

(c)This coordination means that the affected service providers:

(1)have jointly identified the scope of their responsibilities with regard to the change, and in particular their safety responsibilities, e.g. what part of the change will be covered in whose safety (support) assessment case;

(2)have jointly identified the dependencies;

(3)have jointly identified the hazards associated with the change in the common context;

(4)have mutually agreed on the assumptions for the change that jointly relate to them; and

(5)have mutually agreed on the mitigations for risks that require joint implementation.

(d)Service providers would need to achieve a common understanding about:

(1)consequences in the shared operational context; and

(2)chains of causes/consequences.

(e)Service providers would jointly need to identify their dependencies to be able to assess the change to their functional systems.

(f)Where necessary in relation to the dependences identified in accordance with GM1 ATM/ANS.OR.A.045(e)(1), the service providers may perform together:

(1)identification of hazards/effects;

(2)assessment of risks;

(3)evaluation of risks;

(4)planning and assessment of risk mitigations; and

(5)verification.

(g)The level of interaction and coordination between service providers and aviation undertakings will vary depending on the particular needs of the change at hand.

COORDINATION WITH AFFECTED AVIATION UNDERTAKINGS

(a)The aviation undertakings are the entities, persons or organisations as defined in point 34 of Annex I to Regulation (EU) 2017/373 and thus, ATM/ANS.OR.A.045(e) does not apply to them. However, any service provider affected by a change should seek the participation of aviation undertakings when assumptions and risk mitigations used in the safety (support) assessment are shared with those aviation undertakings.

(b)When the number of aviation undertakings affected by the change is large, the service providers may not need to involve every individual stakeholder. If a body can represent the views of a group of affected aviation undertakings, it may suffice to involve that representative body to obtain the supporting evidence to move forward with the assessment of the change.

CHANGE AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — ASSUMPTIONS AND RISK MITIGATIONS In order to satisfy ATM/ANS.OR.A.045(e)(2), the affected service providers coordination will identify those assumptions and risk mitigations that relate to:

(a)more than one service provider;

(b)a service provider and one or more aviation undertakings; or

(c)multiple service providers and aviation undertakings.

LACK OF COORDINATION

(a)If an aviation undertaking decides not to cooperate, the service provider, who has identified dependencies with the aviation undertaking, in accordance with ATM/ANS.OR.A.045(e)(1), needs to consider the impact of having the assumptions and risk mitigations not agreed with that aviation undertaking. It should propose a way forward by doing one or more of the following:

(1)making the assumptions themselves and providing evidence that supports them;

(2)adding additional mitigating measures so that the change remains acceptably safe;

(3)modifying the scope of the change, or even reconsidering and cancelling the change.

(b)The service provider affected by a lack of cooperation with an aviation undertaking may wish to inform its competent authority about those aviation undertakings that are not participating and its form of non-participation, in order to seek the assistance of the competent authority in trying to persuade the aviation undertaking to participate.

GENERAL The ATM/ANS provider should ensure that an EASA release form or a statement of compliance, as appropriate, exists for each ATM/ANS equipment affected by the change prior to putting the changed functional system into service as a part of the corresponding safety assessment or safety support assessment, as applicable.

MODIFIED ATM/ANS EQUIPMENT ATM/ANS equipment is considered ‘modified’ in the context of changes to functional systems when there is: a modification of the hardware (HW) or software (SW) that forms the ATM/ANS equipment itself [software and hardware]; or a modification of the usage of the ATM/ANS equipment, when such usage is part of the applicable detailed specifications or any identified limitation. For that purpose, the category of the equipment [certification, declaration, or statement of compliance] or the applicable detailed specifications may be impacted and therefore reassessed. Modifications of the usage of the equipment are modifications to the way the components of the functional system are organised. In other words, such modifications are modifications to the architecture of the functional system, and, thus, subject to safety (support) assessment.

EQUIPMENT NOT SUBJECT TO CONFORMITY ASSESSMENT

(a)Some equipment (such as HW and SW used to provide flight procedure design and data services) will not be subject to the ATM/ANS conformity assessment framework under Delegated Regulation (EU) 2023/1768, but it will be subject to safety (support) assessment requirements specified by this Regulation. Such equipment belongs to the functional system of the ATM/ANS provider and, consequently, Regulation (EU) 2017/373 applies to it.

(b)Following point (a), there will be no obligation for such equipment to be manufactured by an approved DPO or for the ANSP to issue a SoC.

ATM/ANS EQUIPMENT INTO SERVICE

(a)The ATM/ANS provider should ensure that the new or modified ATM/ANS equipment is deployed as necessary to support the minimum requirements for separation of aircraft.

(b)The ATM/ANS provider should ensure that, before putting into service the new or modified ATM/ANS equipment, it implements the most efficient deployment solutions taking into account the local operating environments, constraints and needs as well as airspace users’ capabilities.

(c)As part of the change management procedures as laid down in ATM/ANS.OR.B.010, the ATM/ANS provider should establish deployment procedures for putting ATM/ANS equipment into service to ensure:

(1)the safe integration of new or modified ATM/ANS equipment in its functional system; and

(2)that the new or modified ATM/ANS equipment is deployed according to the conditions of use, as well as according to any prescribed limitations.

(d)The deployment procedures referred to in point (c) could be integrated with the compliance procedures established in accordance with AMC1 ATM/ANS.OR.B.005(a)(8).

ATM/ANS EQUIPMENT INTO SERVICE | DEPLOYMENT ACTIVITIES Deployment activities that may be conducted as part of a deployment procedure may include the following:

(a)Assessment of the deployment environment where the ATM/ANS equipment will be operating, including both the physical and operating context, in order to determine whether the conditions of use or limitations are adhered to;

(b)Performance of testing and inspections of the ATM/ANS equipment in its deployment environment to determine whether the conditions of use or limitations are adhered to. The testing may include a period of operation in the deployment environment of a sufficient duration to ensure that the conditions of use or limitations are adhered to.