A shift of approach beyond the deadlines
Regulation 2024/356 rewrites essential parts of the European regulatory framework applicable to CAMOs (Continuing Airworthiness Management Organisations) and replaces much of the previous Part-M regime. While the technical press tends to highlight the new transition windows -18 months for major commercial operators, 12 for general operators with mixed fleets-, the substantive change is not the timeline. It is the supervisory philosophy: AESA and EASA are moving from a model based on periodic documentary reviews to one of continuous sampling and operational telemetry.
Five implications worth reviewing
First, the redesign of the internal audit programme. The regulation requires a dynamic risk matrix, fed by Safety Management System (SMS) data and fleet reports. Internal audit can no longer follow a rigid review calendar; it must react to operational deviations within a reasonable timeframe. In practice, this forces a review of the compliance officer's procedures and, in many cases, investment in tools that automate risk traceability.
Second, Contracted Maintenance Agreements (CMOR) require a new layer of prior assessment. The CAMO must certify that the subcontractor maintains an equivalent level of airworthiness control, including documented evidence for each release-to-service and an operational contingency plan. For operators with internationally distributed Part-145 networks, this can triple the volume of documentation.
Third, nominated post holders (Form 4) now face an expanded qualification profile. In addition to the classic experience requirements, accredited training in operational data management and SMS trend interpretation is required. Existing appointments retain their validity, but appointments made after 1 January 2027 must document this expanded profile.
Fourth, digital records cease to be optional and become mandatory. Qualified eIDAS electronic signatures become the minimum standard for release-to-service, and M&E (maintenance and engineering) systems must be remotely auditable by the authority. This forces a review of contracts with software providers and confirmation that export APIs comply with the published technical format.
Fifth, quarterly reports replace the annual model. Four times a year, the CAMO will deliver to the authority a standardised dashboard with operational metrics (open MEL deferrals, non-conformity findings, progress on corrective actions). The first deliverable falls due on 31 March 2027.
What operators should do
The first step is an honest gap-analysis against the new regulation, ideally coordinated between the technical and legal departments. The second is to review the CAMO manual to align it with the new philosophy: the manual ceases to be a static document and becomes a living operational roadmap. The third is to prepare nominated post holders with the training credentials required by the new Annex IV.
At Legalair we are supporting several Spanish operators through this process. If you would like a diagnostic session to identify the critical points of your CAMO under the new regulation, get in touch.