Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for providers of air traffic management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC) No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation (EU) No 677/2011 (Text with EEA relevance. )

• (a) Pursuant to Article 7, a flight information services provider may declare its capability and means of discharging the responsibilities associated with the services provided where it meets, in addition to the requirements referred to in Article 8b(1) of Regulation (EU) No 216/2008, the following alternative requirements:
• (1) the flight information services provider provides, or plans to provide, its services by operating regularly not more than one working position;
• (2) those services are of a temporary nature, for a duration agreed with the competent authority as necessary to ensure proportional safety assurance.

• (b) A flight information services provider declaring its activities shall:
• (1) provide the competent authority with all the relevant information prior to commencing operations, in a form and manner established by the competent authority;
• (2) provide the competent authority with a list of the alternative means of compliance used, in accordance with point ATM/ANS.OR.A.020;
• (3) maintain compliance with the applicable requirements and with the information given in the declaration;
• (4) notify the competent authority of any changes to its declaration or the means of compliance it uses through submission of an amended declaration;
• (5) provide its services in accordance with its operations manual and comply with all the relevant provisions contained therein.

• (c) Before ceasing the provision of its services, the flight information services provider declaring its activities shall notify the competent authority within a period determined by the competent authority.

• (d) A flight information services provider declaring its activities shall comply with the following requirements set out in:
• (1) point ATM/ANS.OR.A.001 Scope;
• (2) point ATM/ANS.OR.A.020 Means of compliance;
• (3) point ATM/ANS.OR.A.035 Demonstration of compliance;
• (4) point ATM/ANS.OR.A.040 Changes — general;
• (5) point ATM/ANS.OR.A.045 Changes to the functional system;
• (6) point ATM/ANS.OR.A.050 Facilitation and cooperation;
• (7) point ATM/ANS.OR.A.055 Findings and corrective actions;
• (8) point ATM/ANS.OR.A.060 Immediate reaction to a safety problem;
• (9) point ATM/ANS.OR.A.065 Occurrence reporting;
• (10) point ATM/ANS.OR.B.001 Technical and operational competence and capability;
• (11) point ATM/ANS.OR.B.005 Management system;
• (12) point ATM/ANS.OR.B.020 Personnel requirements;
• (13) point ATM/ANS.OR.B.035 Operations manuals;
• (14) point ATM/ANS.OR.D.020 Liability and insurance cover,
• (15) Annex IV.

• (e) A flight information services provider declaring its activities shall only start operation after receiving the acknowledgement of receipt of the declaration from the competent authority.

ATM/ANS.OR.A.020 Means of compliance

• (a) Alternative means of compliance (AltMOC) to the AMC adopted by the Agency may be used by the service provider to establish compliance with the requirements of this Regulation.

• (b) When the service provider wishes to use an AltMOC, it shall, prior to implementing it, provide the competent authority with a full description of the AltMOC. The description shall include any revisions to manuals or procedures that may be relevant, as well as an assessment demonstrating compliance with the requirements of this Regulation. A service provider may implement these alternative means of compliance subject to prior approval by the competent authority and upon receipt of the notification as prescribed in point ATM/ANS.AR.A.015(d).

ATM/ANS.OR.A.025 Continued validity of a certificate

• (a) A service provider's certificate shall remain valid subject to:
• (1) the service provider remaining in compliance with the applicable requirements of this Regulation, including those concerning facilitating and cooperating for the purposes of the exercise of the powers of the competent authorities and those concerning the handling of findings as specified in points ATM/ANS.OR.A.050 and ATM/ANS.OR.A.055 respectively;
• (2) the certificate not having been surrendered, suspended or revoked.

• (b) Upon revocation or surrender, the certificate shall be returned to the competent authority without delay.

ATM/ANS.OR.A.030 Continued validity of a declaration of a flight information services provider

A declaration made by the flight information services provider in accordance with point ATM/ANS.OR.A.015 shall remain valid subject to:

• (a) the flight information services remaining in compliance with the applicable requirements of this Regulation, including those concerning facilitating and cooperating for the purposes of the exercise of the powers of the competent authorities and those concerning the handling of findings as specified in point ATM/ANS.OR.A.050 and ATM/ANS.OR.A.055 respectively;

• (b) the declaration not having been withdrawn by the provider of such services or deregistered by the competent authority.

ATM/ANS.OR.A.035 Demonstration of compliance

A service provider shall provide all the relevant evidence to demonstrate compliance with the applicable requirements of this Regulation at the request of the competent authority.

ATM/ANS.OR.A.040 Changes — general

• (a) The notification and management of:
• (1) a change to the functional system or a change that affects the functional system shall be carried out in accordance with point ATM/ANS.OR.A.045;
• (2) a change to the provision of service, the service provider's management system and/or safety management system, that does not affect the functional system, shall be carried out in accordance with point (b).

• (b) Any change as referred to in point (a)(2) shall require prior approval before implementation, unless such a change is notified and managed in accordance with a procedure approved by the competent authority as laid down in point ATM/ANS.AR.C.025(c).

ATM/ANS.OR.A.045 Changes to a functional system

• (a) A service provider planning a change to its functional system shall:
• (1) notify the competent authority of the change;
• (2) provide the competent authority, if requested, with any additional information that allows the competent authority to decide whether or not to review the argument for the change;
• (3) inform other service providers and, where feasible, aviation undertakings affected by the planned change.

• (b) Having notified a change, the service provider shall inform the competent authority whenever the information provided in accordance with points (a)(1) and (2) is materially modified, and the relevant service providers and aviation undertakings whenever the information provided in accordance with point (a)(3) is materially modified.

• (c) A service provider shall only allow the parts of the change, for which the activities required by the procedures referred to in point ATM/ANS.OR.B.010 have been completed, to enter into operational service.

• (d) If the change is subject to competent authority review in accordance with point ATM/ANS.AR.C.035, the service provider shall only allow the parts of the change for which the competent authority has approved the argument to enter into operational service.

• (e) When a change affects other service providers and/or aviation undertakings, as identified in point (a)(3), the service provider and these other service providers, in coordination, shall determine:
• (1) the dependencies with each other and, where feasible, with the affected aviation undertakings;
• (2) the assumptions and risk mitigations that relate to more than one service provider or aviation undertaking.

• (f) Those service providers affected by the assumptions and risk mitigations referred to in point (e)(2) shall only use, in their argument for the change, agreed and aligned assumptions and risk mitigations with each other and, where feasible, with aviation undertakings.

• (g) Before integrating ATM/ANS equipment into the functional system, the ATM/ANS provider shall ensure that:
• (1) new or modified ATM/ANS equipment is certified by the Agency in accordance with Delegated Regulation (EU) 2023/1768 and manufactured by an approved design or production organisation pursuant to Commission Implementing Regulation (EU) 2023/1769 ([^E0012]); or
• (2) new or modified ATM/ANS equipment is declared by an approved design organisation pursuant to Delegated Regulation (EU) 2023/1768 and manufactured by an approved design or production organisation pursuant to Implementing Regulation (EU) 2023/1769; or
• (3) new or modified ATM/ANS equipment is issued with a statement of compliance in accordance with Article 6(1) of Delegated Regulation (EU) 2023/1768; or
• (4) when the ATM/ANS equipment is not subject to the conformity assessment under Delegated Regulation (EU) 2023/1768, the particular ATM/ANS equipment has been verified to comply with the applicable specifications and qualifications.

• (h) The ATM/ANS provider shall ensure that the ATM/ANS equipment has been verified to comply with the equipment manufacturer’s specifications, including installation and on-site test(s).

• (i) Before the ATM/ANS provider puts the ATM/ANS equipment into service, it shall ensure that the modified functional system integrating this ATM/ANS equipment meets all the applicable requirements and shall identify all deviations and limitations.

• (j) When the ATM/ANS provider puts the ATM/ANS equipment into service, it shall ensure that the ATM/ANS equipment, or the modified one, is deployed according to the conditions of use, as well as to any applicable limitations, and meets all the applicable requirements.

ATM/ANS.OR.A.050 Facilitation and cooperation

A service provider shall facilitate inspections and audits by the competent authority or by a qualified entity acting on its behalf and it shall cooperate as necessary for the efficient and effective exercise of the powers of the competent authorities referred to in Article 5.

ATM/ANS.OR.A.055 Findings and corrective actions

After receipt of notification of findings from the competent authority, the service provider shall:

• (a) identify the root cause of the non-compliance;

• (b) define a corrective action plan that meets the approval by the competent authority;

• (c) demonstrate corrective action implementation to the satisfaction of the competent authority within the time period proposed by the service provider and agreed with that authority, as defined in point ATM/ANS.AR.C.050(e).

ATM/ANS.OR.A.060 Immediate reaction to a safety problem

• (a) A service provider shall implement any safety measures, including safety directives, mandated by the competent authority in accordance with point ATM/ANS.AR.A.025(c). When a safety directive is issued to correct the condition referred to in the statement of compliance issued in accordance with Article 6 of Delegated Regulation (EU) 2023/1768, the ATM/ANS provider shall, unless otherwise determined by the competent authority in case urgent action is needed:
• (1) propose appropriate corrective action and submit details of that proposal to the competent authority for approval;
• (2) following the approval by the competent authority, comply therewith.

ATM/ANS.OR.A.065 Occurrence reporting

• (a) As part of its management system, the ATM/ANS provider shall establish and maintain an occurrence-reporting system, including mandatory and voluntary reporting. ATM/ANS providers established in a Member State shall ensure that the system complies with the requirements of Regulation (EU) No 376/2014 and Regulation (EU) 2018/1139, as well as with the delegated and implementing acts adopted on the basis of those regulations.

• (b) The ATM/ANS provider shall report to the competent authority and to any other organisation required to be informed by the Member State, where the ATM/ANS provider provides its services, any safety-related event or condition that endangers or, if not corrected or addressed, could endanger an aircraft, its occupants or any other person, and in particular any accident or serious incident.

• (c) Without prejudice to point (b), the ATM/ANS provider shall report to the competent authority and to the organisation responsible for the design and/or maintenance of the ATM/ANS systems and constituents, if different from the ATM/ANS provider, any malfunction, technical defect, exceedance of technical limitations, occurrence, or other irregular circumstance that has or may have endangered the safety of services and has not resulted in an accident or serious incident.

• (d) Without prejudice to Regulation (EU) No 376/2014 and the delegated and implementing acts adopted on the basis thereof, reports shall:
• (1) be made as soon as practicable, but in any case within 72 hours after the ATM/ANS provider has become aware of the event or condition to which the report relates, unless exceptional circumstances prevent this;
• (2) be made in a form and manner established by the competent authority;
• (3) contain all pertinent information about the condition known to the ATM/ANS provider.

• (e) For ATM/ANS providers that are not established in a Member State, initial mandatory reports shall:
• (1) appropriately safeguard the confidentiality of the identity of the reporter and of the persons mentioned in the report;
• (2) be made as soon as practicable, but in any case within 72 hours after the ATM/ANS provider has become aware of the occurrence, unless exceptional circumstances prevent this;
• (3) be made in a form and manner established by the competent authority;
• (4) contain all pertinent information about the condition known to the ATM/ANS provider.

• (f) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, where relevant, a follow-up report providing details of actions the organisation intends to take to prevent similar occurrences in the future shall be made as soon as these actions have been identified; those follow-up reports shall:
• (1) be sent to the relevant entities initially reported to in accordance with points (b) and (c); and
• (2) be made in a form and manner established by the competent authority.

ATM/ANS.OR.A.070 Contingency plans

A service provider shall have in place contingency plans for all the services it provides in the case of events which result in significant degradation or interruption of its operations.

ATM/ANS.OR.A.075 Open and transparent provision of services

• (a) A service provider shall provide its services in an open and transparent manner. It shall publish the conditions of access to its services and changes thereto and establish a consultation process with the users of its services on a regular basis or as needed for specific changes in service provision, either individually or collectively.

• (b) A service provider shall not discriminate on grounds of nationality or other characteristic of the user or the class of users of its services in a manner that is contrary to Union law.

ATM/ANS.OR.A.080 Provision of aeronautical data

• (a) A service provider shall ensure that aeronautical data related to its services is provided in due time to the AIS provider.

• (b) When aeronautical data related to its services is published, the service provider shall:
• (1) monitor the data;
• (2) notify the AIS provider of any changes necessary to ensure that the data is correct and complete;
• (3) notify the AIS provider when the data is incorrect or inappropriate.

ATM/ANS.OR.A.085 Aeronautical data quality management

When originating, processing or transmitting data to the AIS provider, the service provider shall:

• (a) ensure that aeronautical data referred to in Appendix 1 conform to the specifications of the aeronautical data catalogue;

• (b) ensure that the following data quality requirements are met:
• (1) the accuracy of aeronautical data is as specified in the aeronautical data catalogue;
• (2) the integrity of aeronautical data is maintained;
• (3) based on the integrity classification specified in the aeronautical data catalogue, procedures are put in place so that:
• (i) for routine data, corruption is avoided throughout the processing of the data;
• (ii) for essential data, corruption does not occur at any stage of the entire process and additional processes are included, as needed, to address potential risks in the overall system architecture to further assure data integrity at this level;
• (iii) for critical data, corruption does not occur at any stage of the entire process and additional integrity assurance processes are included to fully mitigate the effects of faults identified as potential data integrity risks by thorough analysis of the overall system architecture;
• (4) the resolution of aeronautical data is commensurate with the actual data accuracy;
• (5) the traceability of aeronautical data is ensured;
• (6) the timeliness of the aeronautical data is ensured, including any limits on the effective period of the data;
• (7) the completeness of the aeronautical data is ensured;
• (8) the delivered data meet the specified format requirements;

• (c) with regard to data origination, establish specific formal arrangements with the party originating data that contain instructions for data creation, modification or deletion, which include as a minimum:
• (1) an unambiguous description of the aeronautical data to be created, modified or deleted;
• (2) the entity to which the aeronautical data is to be provided;
• (3) the date and time by which the aeronautical data is to be provided;
• (4) the format of the data origination report to be used;
• (5) the format of the aeronautical data to be transmitted;
• (6) the requirement to identify any limitation on the use of the data;

• (d) ensure that data validation and verification techniques are employed to ensure that the aeronautical data meets the associated data quality requirements and in addition:
• (1) the verification shall ensure that aeronautical data is received without corruption and that corruption does not occur at any stage of the entire aeronautical data process;
• (2) aeronautical data and aeronautical information entered manually shall be subject to independent verification to detect any errors that may have been introduced;
• (3) when using aeronautical data to derive or calculate new aeronautical data, the initial data shall be verified and validated, except when provided by an authoritative source;

• (e) transmit aeronautical data by electronic means;

• (f) establish formal arrangements with:
• (1) all parties transmitting data to them;
• (2) other service providers or aerodrome operators when exchanging aeronautical data and aeronautical information;

• (g) ensure that the information listed in point AIS.TR.505(a) is provided in due time to the AIS provider;

• (h) collect and transmit metadata which include as a minimum:
• (1) the identification of the organisations or entities performing any action of originating, transmitting or manipulating the aeronautical data;
• (2) the action performed;
• (3) the date and time the action was performed;

• (i) ensure that tools and software used to support or automate aeronautical data and aeronautical information processes perform their functions without adversely impacting the quality of aeronautical data and aeronautical information;

• (j) ensure that digital data error detection techniques are used during the transmission or storage of aeronautical data, or both, in order to support the applicable data integrity levels;

• (k) ensure that the transfer of aeronautical data is subject to a suitable authentication process such that recipients are able to confirm that the data has been transmitted by an authorised source;

• (l) ensure that errors identified during data origination and after data delivery are addressed, corrected or resolved and that priority is given to managing errors in critical and essential aeronautical data.

ATM/ANS.OR.A.090 Common reference systems for air navigation

For the purpose of air navigation, service providers shall use:

• (a) the World Geodetic System – 1984 (WGS-84) as the horizontal reference system;

• (b) the mean sea level (MSL) datum as the vertical reference system;

• (c) the Gregorian calendar and coordinated universal time (UTC) as the temporal reference systems.

SUBPART B — MANAGEMENT (ATM/ANS.OR.B)

ATM/ANS.OR.B.001 Technical and operational competence and capability

A service provider shall ensure that it is able to provide its services in a safe, efficient, continuous and sustainable manner, consistent with any foreseen level of overall demand for a given airspace. To this end, it shall maintain adequate technical and operational capacity and expertise.

ATM/ANS.OR.B.005 Management system

• (a) A service provider shall implement and maintain a management system that includes:
• (1) clearly defined lines of responsibility and accountability throughout its organisation, including a direct accountability of the accountable manager;
• (2) a description of the overall philosophies and principles of the service provider with regard to safety, quality, and security of its services, collectively constituting a policy, signed by the accountable manager;
• (3) the means to verify the performance of the service provider's organisation in light of the performance indicators and performance targets of the management system;
• (4) a process to identify changes within the service provider's organisation and the context in which it operates, which may affect established processes, procedures and services and, where necessary, change the management system and/or the functional system to accommodate those changes;
• (5) a process to review the management system, identify the causes of substandard performance of the management system, determine the implications of such substandard performance, and eliminate or mitigate such causes;
• (6) a process to ensure that the personnel of the service provider are trained and competent to perform their duties in a safe, efficient, continuous and sustainable manner. In this context, the service provider shall establish policies for the recruitments and training of its personnel;
• (7) a formal means for communication that ensures that all personnel of the service provider are fully aware of the management system that allows critical information to be conveyed and that makes it possible to explain why particular actions are taken and why procedures are introduced or changed;
• (8) a process to ensure that the design of ATM/ANS equipment, or the changes to its design, subject to Article 6 of Delegated Regulation (EU) 2023/1768 comply with the applicable specifications, including independent checking function of the demonstration of compliance on the basis of which the ATM/ANS provider issues a statement of compliance and the associated compliance documentation thereto.

• (b) A service provider shall document all management system key processes, including a process for making personnel aware of their responsibilities, and the procedure for the amendment of those processes.

• (c) A service provider shall establish a function to monitor compliance of its organisation with the applicable requirements and the adequacy of the procedures. Compliance monitoring shall include a feedback system of findings to the accountable manager to ensure effective implementation of corrective actions as necessary.

• (d) A service provider shall monitor the behaviour of its functional system and, where underperformance is identified, it shall establish its causes and eliminate them or, after having determined the implication of the underperformance, mitigate its effects.

• (e) The management system shall be proportionate to the size of the service provider and the complexity of its activities, taking into account the hazards and associated risks inherent in those activities.

• (f) Within its management system, the service provider shall establish formal interfaces with the relevant service providers and aviation undertakings in order to:
• (1) ensure that the aviation safety hazards entailed by its activities are identified and evaluated, and the associated risks are managed and mitigated as appropriate;
• (2) ensure that it provides its services in accordance with the requirements of this Regulation.

• (g) In the case that the service provider holds also an aerodrome operator certificate, it shall ensure that the management system covers all activities in the scope of its certificates.

ATM/ANS.OR.B.005A Information security management system

In addition to the management system referred to in point ATM/ANS.OR.B.005, the service provider shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

ATM/ANS.OR.B.010 Change management procedures

• (a) A service provider shall use procedures to manage, assess and, if necessary, mitigate the impact of changes to its functional systems in accordance with points ATM/ANS.OR.A.045, ATM/ANS.OR.C.005, ATS.OR.205 and ATS.OR.210, as applicable.

• (b) The procedures referred to in point (a) or any material modifications to those procedures shall:
• (1) be submitted, for approval, by the service provider to the competent authority;
• (2) not be used until approved by the competent authority.

• (c) When the approved procedures referred to in point (b) are not suitable for a particular change, the service provider shall:
• (1) make a request to the competent authority for an exemption to deviate from the approved procedures;
• (2) provide the details of the deviation and the justification for its use to the competent authority;
• (3) not use the deviation before being approved by the competent authority.

ATM/ANS.OR.B.015 Contracted activities

• (a) Service providers may contract activities to external organisations, as necessary, in support of their operations.

• (b) Without prejudice to Article 7(4) of Regulation (EU) 2024/2803, a service provider shall ensure that the activities comprised in ATM/ANS falling under the definition set out in Article 3, point (5), of Regulation (EU) 2018/1139 for which specific requirements as set out in Annexes III to XIII are applicable under this Regulation shall only be contracted to an organisation that holds a certificate including the relevant term(s) of approval, or has submitted a declaration, as applicable.

• (c) Ancillary activities may be contracted to an organisation that does not hold a certificate, nor has submitted a declaration.

• (d) Ancillary activities shall only be contracted where it has been ascertained that any impact on the provision of the services can be effectively managed.

• (e) The service provider shall regularly monitor the performance of its contracted activities.

ATM/ANS.OR.B.016 Use of resources from non-certified organisations

Where a service provider makes use of personnel or equipment provided by an external organisation, it shall ensure that:

• (a) such personnel and equipment are fully integrated into its functional and management system, and that operational control is maintained;

• (b) the responsibility for the activity remains fully with the service provider;

• (c) a formal contract is concluded to this effect.

ATM/ANS.OR.B.020 Personnel requirements

• (a) A service provider shall appoint an accountable manager, who has the authority over ensuring that all activities can be financed and carried out in accordance with the applicable requirements. The accountable manager shall be responsible for establishing and maintaining an effective management system.

• (b) A service provider shall define the authority, duties and responsibilities of the nominated post holders, in particular of the management personnel in charge of safety, quality, security, finance and human resources-related functions as applicable.

ATM/ANS.OR.B.025 Facilities requirements

A service provider shall ensure that there are adequate and appropriate facilities to perform and manage all tasks and activities in accordance with the applicable requirements.

ATM/ANS.OR.B.030 Record-keeping

• (a) A service provider shall establish a system of record-keeping that allows adequate storage of the records and reliable traceability of all its activities, covering in particular all the elements indicated in point ATM/ANS.OR.B.005.

• (b) The format and the retention period of the records referred to in point (a) shall be specified in the service provider's management system procedures.

• (c) Records shall be stored in a manner that ensures protection against damage, alteration and theft.

ATM/ANS.OR.B.035 Operations manuals

• (a) A service provider shall provide and keep up to date its operations manuals relating to the provision of its services for the use and guidance of operations personnel.

• (b) It shall ensure that:
• (1) operations manuals contain the instructions and information required by the operations personnel to perform their duties;
• (2) relevant parts of the operations manuals are accessible to the personnel concerned;
• (3) the operations personnel are informed of amendments to the operations manual applying to their duties in a manner that enables their application as of their entry into force.

SUBPART C — SPECIFIC ORGANISATION REQUIREMENTS FOR SERVICE PROVIDERS OTHER THAN ATS PROVIDERS (ATM/ANS.OR.C)

ATM/ANS.OR.C.001 Scope

This Subpart establishes the requirements to be met by the service provider other than the air traffic services provider, in addition to the requirements set out in Subparts A and B.

ATM/ANS.OR.C.005 Safety support assessment and assurance of changes to the functional system

• (a) For any change notified in accordance with point ATM/ANS.OR.A.045(a)(1), the service provider other than the air traffic services provider shall:
• (1) ensure that a safety support assessment is carried out covering the scope of the change which is:
• (i) the equipment, procedural and human elements being changed;
• (ii) interfaces and interactions between the elements being changed and the remainder of the functional system;
• (iii) interfaces and interactions between the elements being changed and the context in which it is intended to operate;
• (iv) the life cycle of the change from definition to operations including transition into service;
• (v) planned degraded modes;
• (2) provide assurance, with sufficient confidence, via a complete, documented and valid argument that the service will behave and will continue to behave only as specified in the specified context.

• (b) A service provider other than an air traffic services provider shall ensure that the safety support assessment referred to in point (a) comprises:
• (1) verification that:
• (i) the assessment corresponds to the scope of the change as defined in point (a)(1);
• (ii) the service behaves only as specified in the specified context;
• (iii) the way the service behaves complies with and does not contradict any applicable requirements of this Regulation placed on the services provided by the changed functional system; and
• (2) specification of the monitoring criteria necessary to demonstrate that the service delivered by the changed functional system will continue to behave only as specified in the specified context.

SUBPART D — SPECIFIC ORGANISATIONAL REQUIREMENTS FOR ANS AND ATFM PROVIDERS AND THE NETWORK MANAGER (ATM/ANS.OR.D)

ATM/ANS.OR.D.001 Scope

This Subpart establishes the requirements to be met by air navigation services (ANS) and air traffic flow management (ATFM) providers and the Network Manager, in addition to the requirements set out in Subparts A, B and C.

ATM/ANS.OR.D.005 Business, annual, and performance plans

(a) Business plan

• (1) Air navigation services and air traffic flow management providers shall produce a business plan covering a minimum period of five years. The business plan shall:
• (i) set out the overall aims and goals of the air navigation services and of the air traffic flow management providers, and their strategy towards achieving them in consistency with any overall longer-term plan of the air navigation services provider or of the air traffic flow management provider and with the relevant requirements of Union law for the development of infrastructure or other technology;
• (ii) contain performance targets in terms of safety, capacity, environment and cost-efficiency, as may be applicable pursuant to Commission Implementing Regulation (EU) No 390/2013 ([^E0013]).

• (2) The information listed in points (i) and (ii) of point (1) shall be aligned with the performance plan referred to in Article 11 of Regulation (EC) No 549/2004 and, as far as safety data is concerned, it shall be consistent with the state safety programme referred to in Standard 3.1.1 of Annex 19 to the Chicago Convention in its first edition of July 2013.

• (3) Air navigation services and air traffic flow management providers shall provide safety and business justifications for major investment projects including, where relevant, the estimated impact on the appropriate performance targets referred to in point (1)(ii) and identifying investments stemming from the legal requirements associated with the implementation of the Single European Sky ATM Research Programme (SESAR).

(b) Annual plan

• (1) Air navigation services and air traffic flow management providers shall produce an annual plan covering the forthcoming year which shall further specify the features of the business plan and describe any changes to it as compared to the previous plan.

• (2) The annual plan shall cover the following provisions on the level and quality of service, such as the expected level of capacity, safety, environment and cost-efficiency:
• (i) information on the implementation of new infrastructure or other developments, and a statement on how they will contribute to improving the performance of the air navigation services provider or of the air traffic flow management provider, including level and quality of services;
• (ii) performance indicators, as may be applicable, consistent with the performance plan referred to in Article 11 of Regulation (EC) No 549/2004, against which the performance level and quality of service may be reasonably assessed;
• (iii) information on the measures foreseen to mitigate the safety risks identified by the air navigation services and air traffic flow management provider, including safety indicators to monitor safety risk and, where appropriate, the estimated cost of mitigation measures;
• (iv) the air navigation services and air traffic flow management providers' expected short-term financial position as well as any changes to or impacts on the business plan.

(c) Performance part of the plans

The air navigation services and the air traffic flow management providers shall make the content of the performance part of their business plans and of their annual plans available to the Commission on its request, under the conditions set by the competent authority in accordance with national law.

ATM/ANS.OR.D.010 Security management

• (a) Air navigation services and air traffic flow management providers and the Network Manager shall, as an integral part of their management system as required in point ATM/ANS.OR.B.005, establish a security management system to ensure:
• (1) the security of their facilities and personnel so as to prevent unlawful interference with the provision of services;
• (2) the security of operational data they receive, or produce, or otherwise employ, so that access to it is restricted only to those authorised.

• (b) The security management system shall define:
• (1) the process and procedures relating to security risk assessment and mitigation, security monitoring and improvement, security reviews and lesson dissemination;
• (2) the means designed to identify, monitor and detect security breaches and to alert personnel with appropriate security warnings;
• (3) the means to control the effects of security breaches and to identify recovery action and mitigation procedures to prevent re-occurrence.

• (c) Air navigation services and air traffic flow management providers and the Network Manager shall ensure the security clearance of their personnel, if appropriate, and coordinate with the relevant civil and military authorities to ensure the security of their facilities, personnel and data.

• (d) The aspects related to information security shall be managed in accordance with point ATM/ANS.OR.B.005A.

ATM/ANS.OR.D.015 Financial strength — economic and financial capacity

Air navigation services and air traffic flow management providers shall be able to meet their financial obligations, such as fixed and variable costs of operation or capital investment costs. They shall use an appropriate cost-accounting system. They shall demonstrate their ability through the annual plan as referred to in point ATM/ANS.OR.D.005(b), as well as through balance sheets and accounts, as applicable under their legal statute, and regularly undergo an independent financial audit.

ATM/ANS.OR.D.020 Liability and insurance cover

• (a) Air navigation services and air traffic flow management providers and the Network Manager shall have in place arrangements to cover liabilities related to the execution of their tasks in accordance with the applicable law.

• (b) The method employed to provide the cover shall be appropriate to the potential loss and damage in question, taking into account the legal status of the providers concerned and the Network Manager and the level of commercial insurance cover available.

• (c) Air navigation services and air traffic flow management providers and the Network Manager which avail themselves of services of another service provider shall ensure that the agreements that they conclude to that effect specify the allocation of liability between them.

ATM/ANS.OR.D.025 Reporting requirements

• (a) Air navigation services and air traffic flow management providers shall provide an annual report of their activities to the competent authority.

• (b) For air navigation services and air traffic flow management providers, the annual report shall cover their financial results, without prejudice to Article 12 of Regulation (EC) No 550/2004, as well as their operational performance and any other significant activities and developments in particular in the area of safety.

• (c) The Network Manager shall provide an annual report of its activities to the Commission and the Agency. This report shall cover its operational performance, as well as significant activities and developments in particular in the area of safety.

• (d) The annual reports referred to in points (a) and (c) shall include as a minimum:
• (1) an assessment of the level of performance of services provided;
• (2) for air navigation services and air traffic flow management providers, their performance compared to the performance targets established in the business plan referred to in point ATM/ANS.OR.D.005(a), comparing actual performance against the performance set out in the annual plan by using the indicators of performance established in the annual plan;
• (3) for the Network Manager, its performance compared to the performance objectives established in the Network Strategy Plan, comparing actual performance against the performance set out in the Network Operational Plan by using the indicators of performance established in the Network Operational Plan;
• (4) an explanation for differences with the relevant targets and objectives and an identification of the measures required to address any gaps between the plans and actual performance, during the reference period referred to in Article 11 of Regulation (EC) No 549/2004;
• (5) developments in operations and infrastructure;
• (6) the financial results, where they are not published separately in accordance with Article 12(1) of Regulation (EC) No 550/2004;
• (7) information about the formal consultation process with the users of its services;
• (8) information about the human resources policy.

• (e) Air navigation services and air traffic flow management providers and the Network Manager shall make their annual reports available to the Commission and the Agency on their request. They shall also make those reports available to the public, under the conditions set by the competent authority in accordance with Union and national law.

Appendix 1

AERONAUTICAL DATA CATALOGUE

Introduction

• (a) The aeronautical data catalogue is a reference to the aeronautical data subjects, properties and sub-properties organised in:
• (1) aerodrome data;
• (2) airspace data;
• (3) ATS and other routes data;
• (4) instrument flight procedure data;
• (5) radio navigation aids/systems data;
• (6) obstacle data;
• (7) geographical position data.

• (b) The tables of the aeronautical data catalogue are composed of the following columns:
• (1) subject for which data can be collected;
• (2) property: an identifiable characteristic of a subject which may be further defined into sub-properties;
• (3) same as 2;
• (4) types: the data is classified into different types;
• (5) description: a description of the data item;
• (6) notes: containing additional information or conditions for the provision of the data;
• (7) accuracy: requirements for aeronautical data are based on a 95 % confidence level;
• (8) integrity classification;
• (9) origination type: data is identified as surveyed, calculated or declared;
• (10) publication resolution;
• (11) chart resolution.

Note for items 2 and 3 under point (b): the classification of a catalogue element as subject, property or sub-property does not impose a certain data model.

Note for item 7 under point (b): for those fixes and points that serve a dual purpose, e.g. holding point and missed approach point, the higher accuracy applies. Accuracy requirements for obstacle and terrain data are based on a 90 % confidence level.

Note for item 10 under point (b): the publication resolutions for geographical position data (latitude and longitude) are applicable to coordinates formatted in degrees, minutes, seconds. When a different format is used (such as degrees with decimals for digital data sets) or when the location is significantly further to the north/south, the publication resolution needs to be commensurate with the accuracy requirements.

1. Aerodrome data