21.A.5 Record-keeping

GENERAL

(a)The record-keeping system should ensure that all the records that are required by point 21.A.5 are accessible within a reasonable time. Those records should be organised in a manner that ensures their traceability and retrievability throughout the required retention period.

(b)The records should remain legible throughout the required retention period and be protected against damage, alteration, and tampering.

(c)The format of the records should be specified in the organisation’s procedures.

(d)The organisation should ensure that copies of all the documents and supporting information that are developed:

(1)under the privileges that are defined under points 21.A.163 and 21.A.263; or

(2)for type certificates (TCs), restricted type certificates (RTCs), supplemental type certificates (STCs), major changes, and major repairs that are not issued under the privileges that are defined under point 21.A.263, are retained throughout the operational life of the product or part.

(e)The retention period starts when the record is created or when it is last amended. If the organisation transfers a certificate or a letter of agreement to another natural or legal person, the records related to the certificate or to the letter of agreement should be transferred to the new holder.

GENERAL For organisations that hold or have applied for a type certificate (TC), restricted type certificate (RTC), supplemental type certificate (STC), a European technical standard order (ETSO) authorisation, a change to the TC approval, a repair design approval, a permit to fly, a production organisation approval (POA), or a letter of agreement under Part 21, the relevant design information/data includes at least the following, as applicable: — design data such as type design data, as defined in point 21.A.31, and changes to that data, ETSO design data, and repair design data; — drawings and test reports, including inspection records for the product tested; — the certification programme, including related certification basis data (certification review items (CRIs), special conditions (SCs), equivalent safety findings (ESFs)); and — compliance demonstration data. For repair designs, the record-keeping requirement of point 21.A.5 applies to the data described in AMC1 21.A.433(b). For production organisations (POs), the relevant records include at least: — conformity justification data; and — conformity attestation data (e.g. EASA Form 1 or EASA Form 52).

RECORDING AND ARCHIVING SYSTEM The main objective of record-keeping in design organisations (DOs) and production organisations (POs) is to ensure the retrievability of data that is required for the continued airworthiness of in-service products. In addition, records within the design environment are essential to ensure proper control of the configuration of the type design and of its compliance with the certification basis. In the production environment, records are also required, to ensure that products or parts are in conformity with the applicable data throughout the manufacturing cycle. In addition, certain records of milestones are needed, to subsequently provide objective evidence that all the prescribed stages of the production process have been satisfactorily completed. Therefore, the approved DO or PO (or a natural or legal person that is demonstrating their design capability through an agreement on alternative procedures or through the acceptance of the organisation’s certification programme, or a natural or legal person that produces products and parts under Part 21, Subpart F) are required to implement a system for the compilation and retention of records during all stages of design or production, which covers short-term and long-term records as appropriate to the nature of the product and its processes. The management of such information is subject to the appropriately documented procedures in the management system that is required by points 21.A.139 and 21.A.239 or to the manual/procedures that are required by points 21.A.14(b), 21.A.125A(b), or 21.A.602B(b)(2), as appropriate. This also applies in case of demonstrating the design capability through the acceptance of the certification programme under point 21.A.14(c). All forms of recording media are acceptable (paper, film, magnetic, etc.), including the use of electronic records*, provided that they can meet the required duration for archiving under the given conditions and that the continued readability of the records is ensured. The related procedures are required to: identify the records to be kept; describe the organisation of, and responsibility for, the archiving system (its location, compilation, format) and the conditions for access to the information (e.g. by product, subject, etc.); control access to the data and provide effective protection from deterioration or accidental damage, alteration, and tamperering; ensure the continued readability of the records; demonstrate to the competent authority the proper functioning of the record system; and define an archiving period for each type of data as follows: production data that supports the conformity of a product, part, or appliance is kept for not less than 3 years from the issue date of the related statement of conformity or authorised release certificate; and design data, including data that supports the compliance of a product, part, or appliance with the certification basis (see GM1 21.A.5), as well as data that is considered essential for continuing airworthiness, is kept throughout the operational life of the product, part, or appliance; such continued airworthiness data may include, but are not limited to, in-service occurrence reports and mandatory continuing-airworthiness information; for organisations that are approved according to Part 21, Subparts G and J and organisations that demonstrate their design capability through an agreement on alternative procedures or acceptance of their certification programme by EASA, ensure that the recording and record-keeping systems that are used by the partners, suppliers, and subcontractors meet the record-keeping objectives with the same level of confidence as they do for their own system;. in each case, it should be defined who should retain the data record (organisation, partner, supplier, or subcontractor), as well as the method of surveillance of the recording/record-keeping system of the partners, suppliers, or subcontractors; and for natural or legal persons that produce items under Part 21, Section A, Subpart F, the data on supplied parts may be retained by the supplier if the supplier has a system that is agreed by the competent authority under Part 21, Section A, Subpart F; in each case, the PO is required to define the archiving period and satisfy itself and the competent authority that the recording media are acceptable. *Related to electronic records, the following definitions apply: — electronic record: electronic or digital data that is created, generated, sent, communicated, received, or stored by electronic means; — electronic data: it is typically in the form of documentation that is statically stored in a computer file that is not modifiable (e.g. pdf of a scanned document with wet ink signatures); and — digital data: it is typically in the form of computer-generated bytes of information that is stored in a computer workable file (e.g. MS Word file, MS Excel file, 3D CAD file).

RECORD OF STAFF INVOLVED IN DESIGN OR PRODUCTION

(a)The following should be the minimum information to be recorded for each person that exercises the privileges of an organisation that is approved according to Part 21, Subparts G and J, or according to points 21.A.163 or 21.A.263, or that carries out the independent monitoring of compliance and adequacy according to points 21.A.139(e) and 21.A.239(e), or that carries out the independent verification function of demonstration of compliance pursuant to point 21.A.239(d)(2):

(a)name;

(b)date of birth;

(c)basic training received and standard attained;

(d)specific training received and standard attained;

(e)continuation training received (if appropriate);

(f)experience gained;

(g)scope of the authorisation;

(h)date of first issue of the authorisation;

(i)expiry date of the authorisation (if appropriate;

(j)identification number of the authorisation (or equivalent means to identify the link between the authorisation and the staff member that holds the authorisation); and

(k)changes to the data.

(b)The record may be kept in any format and should be controlled through an internal procedure of the organisation. That procedure is part of the management system.

(c)The staff member should be given reasonable access, on request, to their own records as per Regulation (EU) 2016/679.

(d)A design organisation (DO) or production organisation (PO) should keep the record for at least 3 years after the staff member is no longer employed by the organisation or has changed their position in the organisation, or after the withdrawal of the authorisation, whichever occurs sooner.

(e)Records of authorisation of the production staff are to be archived for at least 3 years after the staff member is no longer employed by the organisation or as soon as the authorisation is withdrawn. This staff member is any person that has an activity that is essential for ensuring: the conformity to applicable design data, or a condition for the safe operation of a product, part, or appliance.