This article is for customers of maintenance shops and continuing airworthiness management organizations approved under EU aviation rules. If a provider loses access to its records or discovers that a file has changed unexpectedly, its customer needs to know which records remain trustworthy and how work can continue safely. Part-IS, the European aviation information-security framework, addresses risks to aviation safety from information and systems. It does not make every certificate issued by a covered organization automatically authentic.
For a customer, the useful conversation is therefore about the records used for your aircraft: how the provider protects them, handles a suspected change and recovers them after an incident. Ask for an explanation you can use in a handover, not just a statement that the organization is compliant.
Which organizations and which regulation?
EASA community post of February 23, 2026 confirms that Implementing Regulation (EU) 2023/203 became applicable on February 22, 2026. Article 2 of Regulation (EU) 2023/203 includes covered Part-145 approved maintenance organizations and continuing airworthiness management organizations, known as CAMOs. A CAMO manages an aircraft's continuing airworthiness, including keeping track of the maintenance it needs.
The scope has exceptions. Article 2 excludes Part-145 organizations and CAMOs solely involved with aircraft under Part-ML, the maintenance framework for certain lighter aircraft. It does not list Part-CAO combined airworthiness organizations. An FAA or other non-EU approval alone is not one of these EU approval categories; a shop outside the EU may nevertheless also hold a covered EU approval. Check the provider's actual approvals, not just its address.
A provider may also have the aviation authority's approval not to implement specified information-security requirements, based on a documented assessment showing no potential aviation-safety impact. That is the limited route in IS.I.OR.200(e), not a provider deciding for itself that the rules are unnecessary. Reporting and confidentiality obligations specified there still apply.
Delegated Regulation (EU) 2022/1645 instead covers specified design and production organizations, aerodromes and apron management providers, with its own exclusions, and has applied since October 16, 2025.
Article 5(1) of Regulation 2023/203 also recognizes compliance with security requirements under Article 14 of the NIS Directive (EU) 2016/1148 (since replaced by NIS2, Directive (EU) 2022/2555) when those requirements are equivalent to Part-IS. NIS concerns network and information-system security; a general claim of NIS compliance does not by itself establish that equivalence. EASA's Easy Access Rules provide a convenient compilation alongside the official texts.
What the framework asks the provider to manage
Under IS.I.OR.200, covered organizations must organize their information-security work: identify risks, act on them, detect and handle relevant incidents, recover, and keep the processes under review. The scale of the arrangements follows the nature and complexity of their activities.
IS.I.OR.245 separately addresses records of those information-security activities, which must be archived, traceable and kept for stated periods. It should not be read as a single new retention period for every aircraft maintenance record. Those are different sets of records with different purposes.
Four questions tied to your aircraft's file
The following are suggested customer questions, not a claim that Part-IS gives customers unrestricted access to a provider's security documentation:
- Which systems hold the records you will hand over to us? Ask how the relevant maintenance files, attachments and releases fit into the provider's risk assessment. If an outside service stores them, include that handover in the explanation.
- How would you investigate an unexpected change? Ask the provider to explain how it identifies the authoritative version and the person authorized to issue or correct it. A useful answer describes what you would receive if a record needed correction.
- How would you restore our access after an incident? Ask who would coordinate the response, how recovered records would be checked and how you would learn that a supplied file might be affected. Agree the customer communication process without requesting passwords or sensitive defensive details.
- What can you demonstrate safely? Ask which framework you are assessed against, including any equivalence relied on under Article 5. A redacted example of a record-recovery check may be more useful than a generic promise about backups. Agree appropriate evidence and confidentiality arrangements with the provider.
In a fictional example, an owner receives two different PDFs with the same maintenance-release reference. A helpful provider response identifies which version is authoritative, explains the correction and supplies the relevant record through an agreed channel. A sentence saying “we comply with Part-IS” does not resolve that discrepancy.
Keep certificate verification as a separate check
An information-security system reduces and manages risk. The recipient still needs to establish what the particular release covers, who issued it and whether it matches the aircraft or component concerned. Neither a security policy nor a preserved digital fingerprint proves that maintenance was performed correctly.
For the separate question of checking documentary evidence while a service is unavailable, see certificate proof that can survive an aviation cyberattack. Start the supplier conversation with one real handover: ask how your next maintenance release will be protected, corrected if necessary and recovered if access is interrupted.