Skip to content

A gradual release of Avioverse begins in October 2026. Request early access →

IS.D.OR.225 Response to findings notified by the competent authority

Delegated Regulation (EU) 2022/1645 · Regulations (EU) 2023/203 and 2022/1645 · EAR revision 5 Dec 2025

IRImplementing rule

IS.D.OR.225Response to findings notified by the competent authority

(a)After receipt of the notification of findings submitted by the competent authority, the organisation shall:

(1)identify the root cause or causes of, and contributing factors to, the non-compliance;

(2)define a corrective action plan;

(3)demonstrate the correction of the non-compliance to the satisfaction of the competent authority.

(b)The actions referred to in point (a) shall be carried out within the period agreed with the competent authority.

IR · IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · Regulation (EU) 2022/1645 · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

AMCAcceptable means of compliance

AMC1 IS.D.OR.225Response to findings notified by the competent authority

Show the text

The compliance with IS.D.OR.225 should be managed as required for each organisation in the corresponding implementing regulation for the domain as identified in point Article 2(1) of Regulation (EU) 2022/1645 concerning the response to findings notified by the competent authority. The domain regulation may require the organisation to respond to the findings in accordance with their categorisation.

AMC · AMC1 IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · ED Decision 2023/009/R · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

GMGuidance material

GM1 IS.D.OR.225Response to findings notified by the competent authority

Show the text

The requirement for the categorisation of findings and the period within which the actions in IS.D.OR.225(a) should be performed can be found in the corresponding implementing regulation for the domain, under the authority requirements. For the opening of findings related to this Regulation, the competent authority will follow the above-mentioned requirement.

GM · GM1 IS.D.OR.225 — Regulations (EU) 2023/203 and 2022/1645 · ED Decision 2023/009/R · Part-IS Easy Access Rules · EAR revision 5 Dec 2025

All rules in ANNEX — INFORMATION SECURITY — ORGANISATION REQUIREMENTS [PART-IS.D.OR]

Consolidated from the EASA Easy Access Rules (revision 5 Dec 2025, extracted 17 Aug 2026) for convenience. Not the official publication — verify against the Official Journal of the European Union and the EASA publications before operational use.

Ask Metis about IS.D.OR.225 →

Metis opens with Avioverse in October 2026 · request early access.