Part 135 SMS Deadline: What Must Be Working by May 28, 2027

If you hold a certificate today and haven’t started, you’re not behind everyone else. This article covers what the deadline actually demands, what the declaration means, and how to work backward from May 2027 to a start date. For the component-by-component picture of what Part 5 requires, start with the Part 135 SMS guide.

Three wrong ideas about this deadline, cleared first

“The FAA will review my SMS and tell me when I’m done.” It won’t. For operators already holding a certificate, FAA guidance says plainly that the agency will not review your SMS before you implement it. You build it, you validate your own compliance with Part 5, and you submit the declaration. New applicants are different, because their SMS is validated during the certification process. If you’re already flying, there is no approval letter coming.

“Buying SMS software makes me compliant.” Software is a filing cabinet. A good one is worth having, and nothing in Part 5 is satisfied by a purchase order. §5.21 requires a written safety policy. §5.55 requires a defined process for conducting risk assessment. §5.71(a) requires you to monitor the safety performance of your operation. Those are things your organization does, not things a vendor hosts. The vendors selling you compliance-in-a-box are not lying about their product. They’re letting you believe something about the rule.

“The deadline is a paperwork date I can hit in the last month.” The declaration attests that a system meeting a federal standard exists and is implemented. A manual written in April 2027 with no operating history behind it produces a declaration that arrives on time and describes nothing. Both declarations look identical in the FAA’s inbox. Only one of them is true.

What the Part 135 SMS deadline actually requires

Part 5 is built from four components, plus documentation and records. By May 28, 2027, each one has to exist in your operation, not just in your manual.

A safety policy (§5.21). A written statement of your safety objectives and your organization’s commitment to them. This is the shortest component to write and the easiest to write badly, because a policy nobody in the operation has read is a compliance artifact, not a policy.

An accountable executive who actually qualifies (§5.25(a)). The rule lists the criteria: final authority over the operations conducted under your certificate, control of the financial resources, control of the human resources, and ultimate responsibility for the safety performance of the organization. If you name someone who fails one of those criteria, you’ve built a safety program whose top can’t fix what the system finds. In most small operations the answer is the owner, and that’s fine. FAA guidance says the job title is not what matters.

Safety risk management (§§5.51 through 5.55). A process for analyzing your systems and identifying hazards (§5.53), and a defined process for assessing and controlling the risk those hazards carry (§5.55). This is where new routes, new aircraft, and new kinds of work get examined before they bite.

Safety assurance (§§5.71 through 5.75). Monitoring your own safety performance (§5.71(a)), assessing what the monitoring tells you (§5.73), and improving what the assessment finds wanting (§5.75). Notice what this component implies about timing. Assurance can only exist once the system has run long enough to produce something to assure. It cannot be back-filled in the final month, and it’s the part of the declaration most likely to be describing thin air.

Safety promotion (§§5.91 and 5.93). Your people trained to the competencies their SMS roles require (§5.91), and safety information actually communicated through the operation (§5.93).

Documentation and records (§§5.95 and 5.97). The system documented, and its outputs retained. Safety assurance outputs are kept a minimum of five years (§5.97). Whatever system you choose to hold those records, you’re choosing something you will live with into the 2030s.

Nobody signs off on this but you

This is the part that reshapes the timeline, so sit with it for a minute.

For existing certificate holders, there is no inspector who sits down with your program and tells you that you’re done. You develop the SMS, you implement it, you validate your own compliance with Part 5, and then you sign a declaration attesting that a system meets a federal standard. No government employee will have looked at it first.

If you’ve spent a career in aviation getting things approved, checked, and signed off by somebody else, this is a genuinely different situation. The habit of building toward an external check, and letting the check catch what you missed, has no check to lean on here.

You are the approval authority now.

That’s why the declaration date and the finish-the-build date are not the same date. Validating your own compliance takes time, and it takes a system with enough operating history to validate.

The deadline exists because the record keeps showing the same failure

Go read almost any accident report involving an organization rather than a lone pilot, and a pattern shows up: the information that would have prevented the accident was already inside the organization. A warning that sat in a file. A procedure in the company’s own manual that stopped being followed and nobody noticed. The failure was rarely ignorance. It was a system that knew and didn’t act.

That is the specific failure a safety management system exists to prevent. Hazard reporting, risk assessment, and safety assurance are, together, a machine for forcing what the organization knows into what the organization does. Our view is that this is the honest reason to build one, and the compliance deadline is just the reason to build it now.

Work backward from May 28, 2027, not forward from today

The rule gives you one date. Our recommendation, and this is a recommendation rather than a requirement, is that you plan to sign the declaration with real operating history behind it: several months of risk management outputs, at least one full safety assurance cycle, and people who have actually used the reporting system rather than merely been told it exists. Work backward from there and the build has to be substantially finished well before the spring of 2027.

May 28, 2027 is the last day to declare. It is not the last day to start. Those two dates are many months apart, and every week between now and then belongs to one side of that gap or the other.

One more thing worth saying because others won’t: the rule sets a compliance date, and it does not prescribe a specific enforcement consequence for missing it. Be suspicious of anyone who invents one to scare you into a contract. What is certain is simpler. After that date, Part 5 applies to your certificate (§5.1), declared or not, and you’d rather have that conversation with your FSDO from in front of the requirement than from behind it.

Where to start this week

Start by finding out where you actually stand. The SMS readiness scorecard walks you through the questions an honest self-assessment asks, in the order Part 5 asks them, and takes less time than one leg of a repositioning flight.

If you want a second set of eyes before you commit to a build plan, an independent SMS gap analysis measures the distance between what you have today and what Part 5 requires, so the next eighteen months get spent closing gaps instead of guessing at them.

Either way, do the assessment before you do anything else. You can’t work backward from the deadline until you know where you’re starting from.

Frequently Asked Questions