Cybersecurity Database

Regulation

Part-IS: aviation information security

Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS)

In force since 22 February 2023Record checked against the official source on 29 October 2026 · Methodology

Official source: https://eur-lex.europa.eu/eli/reg_impl/2023/203/oj

Official sourceWayback Machine snapshot
Official number
Implementing Regulation (EU) 2023/203
Date adopted
Entry into force

Summary

The regulation introduces into European civil aviation an obligation to manage information security risks that can affect flight safety. It applies to competent authorities and a broad range of organisations: air operators, maintenance and training organisations, air navigation and air traffic management service providers, and the network manager. Each must set up an information security management system, assess risks to its IT and OT systems, detect and respond to incidents, report them and cooperate with authorities. Together with Delegated Regulation (EU) 2022/1645, which covers aerodromes and design and production organisations, it forms the EASA Part-IS package.

Key dates

  1. Delegated Regulation (EU) 2022/1645 applies (aerodromes and design and production organisations)
  2. Part-IS applies to the EGNOS air navigation service provider
  3. Part-IS requirements apply to authorities and organisations

Information

Jurisdiction
European Union
Issuing body
European Commission
Type
Regulation
Available languages
English, Italian (official translation), French (official translation), Spanish (official translation), German (official translation)
Topics
Notes
Applies from 22 February 2026 (from 1 January 2026 for the EGNOS air navigation service provider). It was amended by Implementing Regulations (EU) 2023/1769, 2024/1109 and 2025/2293; the latter, of 10 November 2025, exempts organisations operating under a declaration from approval of changes to their management system and corrects some cross-references. Delegated Regulation (EU) 2022/1645 of 14 July 2022 (https://eur-lex.europa.eu/eli/reg_del/2022/1645/oj) sets the same requirements for aerodrome operators and design and production organisations and applies from 16 October 2025; Delegated Regulation (EU) 2025/22 extends it to ground handling organisations from 27 March 2031.
Related technical standards

Record details

Original title
Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS)
Title in other languages
  • Regolamento di esecuzione (UE) 2023/203 della Commissione che stabilisce norme per l’applicazione del regolamento (UE) 2018/1139 per quanto riguarda i requisiti relativi alla gestione dei rischi per la sicurezza delle informazioni con un potenziale impatto sulla sicurezza aerea (Part-IS)
  • Règlement d’exécution (UE) 2023/203 de la Commission établissant les modalités d’application du règlement (UE) 2018/1139 en ce qui concerne les exigences relatives à la gestion des risques liés à la sécurité de l’information ayant une incidence potentielle sur la sécurité aérienne (Part-IS)
  • Reglamento de Ejecución (UE) 2023/203 de la Comisión por el que se establecen normas para la aplicación del Reglamento (UE) 2018/1139 en lo que respecta a los requisitos relativos a la gestión de los riesgos para la seguridad de la información con un posible impacto en la seguridad aérea (Part-IS)
  • Durchführungsverordnung (EU) 2023/203 der Kommission zur Festlegung von Vorschriften für die Anwendung der Verordnung (EU) 2018/1139 hinsichtlich der Anforderungen an das Management von Informationssicherheitsrisiken mit potenziellen Auswirkungen auf die Flugsicherheit (Part-IS)
Licence / terms of use
EU reuse (Decision 2011/833/EU)
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

European Commission. (2022). Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS) (Implementing Regulation (EU) 2023/203). https://eur-lex.europa.eu/eli/reg_impl/2023/203/oj

Chicago

European Commission. "Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS)." 27 October 2022. https://eur-lex.europa.eu/eli/reg_impl/2023/203/oj.

BibTeX

@misc{eu_part_is_aviation_information_security_2023_203,
  author       = {{European Commission}},
  title        = {{Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS)}},
  year         = {2022},
  note         = {Implementing Regulation (EU) 2023/203},
  url          = {https://eur-lex.europa.eu/eli/reg_impl/2023/203/oj},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON