21.B.30 Allocation of tasks to qualified entities [applicable until 21 February 2026] / 21.B.30 Allocation of tasks [applicable from 22 February 2026 – Regulation (EU) 2023/203]

(a)The competent authority may allocate tasks related to the initial certification or to the continuing oversight of products and parts, as well as of natural or legal persons subject to Regulation (EU) 2018/1139 and its delegated and implementing acts to qualified entities. When allocating tasks, the competent authority shall ensure that it has:

1.put a system in place to initially and continuously assess whether the qualified entity complies with Annex VI to Regulation (EU) 2018/1139. That system and the results of the assessments shall be documented;

2.established a written agreement with the qualified entity, approved by both parties at the appropriate management level, which stipulates:

(i)the tasks to be performed;

(ii)the declarations, reports and records to be provided;

(iii)the technical conditions to be met when performing such tasks;

(iv)the related liability coverage;

(v)the protection given to the information acquired when carrying out such tasks.

(b)The competent authority shall ensure that the internal audit process and safety risk management process established pursuant to point 21.B.25(a)(5) cover all the certification and continuing oversight tasks performed by the qualified entity on its behalf.

(c)For the certification and oversight of the organisation’s compliance with points 21.A.139A and 21.A.239A, the competent authority may allocate tasks to qualified entities in accordance with point (a), or to any relevant authority responsible for information security or cybersecurity within the Member State. When allocating tasks, the competent authority shall ensure that:

(1)all aspects related to aviation safety are coordinated and taken into account by the qualified entity or relevant authority;

(2)the results of the certification and oversight activities performed by the qualified entity or relevant authority are integrated in the overall certification and oversight files of the organisation;

(3)its own information security management system established in accordance with point 21.B.25(e) covers all the certification and continuing oversight tasks performed on its behalf. [point (c) is applicable from 22 February 2026 – Regulation (EU) 2023/203]