Implementing ICAO Annex 19 SMS
in 90 days.

See the highlighted block above the contents list. The rest of this article is the operating manual behind that one-paragraph summary.

ICAO Annex 19 has been in force for over a decade. The four pillars of a Safety Management System — safety policy, safety risk management, safety assurance, and safety promotion — have not changed. The implementation guidance in ICAO Doc 9859 (Safety Management Manual, fourth edition) has not changed. What changes, every time an operator stands up an SMS, is how long the implementation takes.

Twelve-month implementations are common. Eighteen-month implementations are common. We have seen 36-month implementations. None of those durations are necessary; all of them produce the same artifact at the end. A safety policy signed by the accountable manager. A hazard register. A risk matrix. A handful of SPIs. A voluntary reporting system. An emergency response plan. A safety promotion plan. These are not nine months of work. They are 90 days of focused work, plus a long tail of refinement.

The 90-day plan below assumes one accountable manager, one named safety manager with at least 60% of their time available, a baseline of operational data already collected somewhere (even if it is on paper or in spreadsheets), and a willingness to ship Version 1 of the SMS imperfectly rather than ship Version 1.4 polished. If those assumptions hold, 90 days produces a safety system the regulator can audit. The next 90 days improve it. That is how mature SMS develops — iteratively, against operational reality, not in a binder waiting for sign-off.

“The single most useful thing about Annex 19 is that it is short. Doc 9859 is long; the Annex itself fits in your pocket. If you cannot describe your SMS in the vocabulary of the Annex, you do not have an SMS — you have a binder.”eAviora design partner conversation, 2026

The first 30 days are about installing the structure. Nothing in this phase generates a single safety insight; everything in this phase makes the next 60 days possible.

Week 01 — Accountabilities.The accountable manager (per EASA Part-ORO.GEN.210, FAA Part 5 5.21, or your local CAA equivalent) is named in writing. The safety manager reports functionally to the accountable manager, not into a quality or compliance silo. A safety policy is drafted — one page, signed, posted — covering the accountable manager's commitment to the SMS, the Just Culture stance, and the resourcing commitment.

Week 02 — Taxonomies.Three taxonomies must be locked in the first month: ICAO occurrence categories (Doc 9859 Appendix 2), the organisation's risk matrix (a 5×5 likelihood × severity grid is the default — tailored to your operation, not copied from a generic template), and the list of hazards relevant to the operation. The hazard list does not need to be complete in week 02. It needs to be a starting point that can grow.

Week 03 — Reporting channels.Three reporting channels go live: mandatory (regulator-required occurrences per ICAO Annex 13 and EU 376/2014), voluntary (anything a crew member chooses to report), and confidential (anonymised). The reporting form is one page maximum. If it is two pages, you will receive half the reports you would have. If it is digital, it is mobile-first — crew members file from the apron, not from a desk.

Week 04 — Emergency Response Plan. Annex 19 Appendix 2 requires a documented ERP. In week 04 it is a single document with role definitions, communication tree, regulator notification protocols, and recovery procedures. It is not yet exercised. It will be in days 61–90.

Annex 19 calls Safety Risk Management one of the four pillars. In days 31–60 it becomes operational. The reports landing in days 0–30 are now classified, scored, and turned into either hazards or actions.

Week 05 — Classification. Every occurrence received in the first 30 days is classified against the ICAO occurrence categories. Severity scored against the 5×5 matrix. Likelihood inferred from operational frequency (this is hard at week 05 because you have one month of data; that is fine, you re-score quarterly). Each occurrence either reinforces an existing hazard in the register or surfaces a new one.

Week 06 — Bowtie analysis on the top three hazards. Identify the three hazards with the highest current risk score. For each, draft a bowtie: threats on the left, the top event in the middle (the moment the hazard is no longer controlled), consequences on the right, preventive barriers between threats and the top event, recovery barriers between the top event and consequences. This is not a deliverable for the regulator yet — it is the artifact your safety review board will use in week 11.

Week 07 — SPI definitions.Three to five Safety Performance Indicators. Each one numeric, time-bound, and tied to a hazard. “Unstable approaches per 1000 sectors” is an SPI. “Improve safety culture” is not. Each SPI has an alert threshold (when investigation triggers) and a target (where the operation should be). Use ICAO Doc 9859 Section 4 as the anchor for what good SPIs look like.

Week 08 — Action plans. Every classified occurrence and every active hazard has at least one corrective or preventive action assigned, with a typed owner, a due date, and a named verifier. This is the CAPA pipeline. The pipeline runs open → in progress → verify → closed; closure cannot happen until effectiveness verification is signed. (The regulator will audit you on effectiveness verification more than on action creation. Get the gate right now.)

The third pillar — Safety Assurance — is the operator's ongoing check that the SMS is working. In days 61–90 it goes live and the fourth pillar (safety promotion) is seeded.

Week 09 — Safety review board.First meeting. Standing agenda: hazard register changes, SPI dashboard, open occurrences and actions, effectiveness verification queue. Cadence is monthly minimum, weekly during the 90-day implementation. Attended by the accountable manager — not delegated to a head of department. The safety review board is the structural mechanism through which the accountable manager exercises oversight; missing it is delegating accountability and the regulator will notice.

Week 10 — ERP exercise.A tabletop exercise of the emergency response plan with the actual people whose names are on it. The exercise reveals the gaps; the gaps go into the action plan; the action plan closes them. ICAO Annex 19 Appendix 2 expects regular ERP exercises — the first one in your 90 days is the start of that cadence, not a check-the-box.

Week 11 — Internal audit / compliance check. The compliance monitoring function (or its EASA Part-ORO equivalent) audits the SMS itself against Annex 19. The objective is not to find nothing; it is to find what is missing and put it in the action plan. Findings flow into the same CAPA pipeline as occurrence findings.

Week 12 — Safety promotion + go-live.The fourth pillar — safety promotion — goes live. A standing safety bulletin (monthly, one page) summarising the SPI dashboard, the top three hazards, the lessons from closed actions. Crew briefings refer to it. Regulator notification of go-live is sent. Day 90: you have an SMS the regulator can audit.

1. Safety policy & objectives— written, signed by the accountable manager, posted. Days 1–7. Objectives are SMART, reviewed at the safety review board.
2. Safety risk management— hazard register, risk matrix, bowtie on top hazards, action plan with effectiveness verification gate. Days 8–60. Continues forever.
3. Safety assurance— SPIs, safety review board, internal audit, ERP exercises. Days 50–90. Continues forever.
4. Safety promotion— safety bulletin, briefings, training that pulls from the SMS data (not a generic syllabus). Days 80–90. Continues forever.

You ship:

• A safety policy and objectives, signed and visible.
• A hazard register with at least 30 entries by day 90, growing weekly.
• A 5×5 risk matrix tailored to the operation.
• Bowtie analysis on the top 3–5 hazards.
• 3–5 SPIs with thresholds and targets, dashboard updated weekly.
• A CAPA pipeline with effectiveness verification enforced as a gate.
• Three reporting channels (mandatory, voluntary, confidential) accepting submissions.
• A documented and once-exercised emergency response plan.
• An internal audit of the SMS against Annex 19 with findings logged.
• A safety promotion bulletin (issue 1 of n).
• A monthly safety review board chaired by the accountable manager.

You don't ship (yet):

• Bowtie on every hazard. (You will get there in months 4–12.)
• SPI predictive analytics. (Statistical Process Control on SPI trends becomes useful when you have 6+ months of data.)
• Cross-organisational benchmarks. (Your data is too fresh.)
• Full IOSA / IS-BAO alignment. (Out of scope of Annex 19; that is a separate audit.)
• A polished safety culture survey. (Your culture is what your reporting volume tells you it is. Watch that number first.)

Four patterns reliably turn a 90-day plan into a 12-month plan. Recognising them early is the cheapest way to avoid them.

1. The binder-first implementation.A safety manager spends months drafting an SMS Manual before the first occurrence is reported. The manual is comprehensive and correct; the operation has no live SMS for the duration. The fix: ship Version 1 of the manual at day 30 (10 pages, all the section headings are present, content is “to be expanded as the SMS matures”), and let the operational reality fill it in.

2. The taxonomy-paralysis implementation. Three months are spent debating whether the 5×5 matrix should be 4×5 or 5×5, whether barriers should be eight categories or twelve, whether SPIs should be lagging or leading. None of these debates produce safer flights. The fix: pick the ICAO Doc 9859 defaults, decide that you will revisit them at the 6-month review, and move on.

3. The tool-first implementation. A platform is procured before the policy, the matrix, the SPIs, or the hazards exist. Six months are spent configuring the tool. The fix: stand up the SMS on paper or in a spreadsheet for 90 days. You will know precisely what the tool needs to do. Then procure.

4. The accountable-manager-absent implementation.The safety manager runs the project alone. The accountable manager signs documents but does not chair the safety review board, does not own SPIs, does not see the effectiveness verification queue. The regulator's audit reveals the gap on day one. The fix: a 30-minute weekly slot in the accountable manager's calendar, blocked, attended.

eAviora is an AI-native aviation safety intelligence platform built around the ICAO Annex 19 vocabulary. The product was designed to remove the multi-month tool-procurement detour from the 90-day plan, not to add a 14th system to the airline's operational stack.

For an operator running the 90-day plan, the relevant surfaces are:

• SMS module— occurrence intake (mandatory, voluntary, confidential), hazard register, risk matrix, bowtie analysis with barriers as typed objects.
• Actions (CAPA)— the corrective and preventive action pipeline with effectiveness verification as a hard gate before closure.
• Compliance— Annex 19 / EASA Part-ORO / FAA Part 5 alignment tracking with traceable evidence per requirement.
• Safety analytics — SPI library, thresholds, trend dashboards, the data the safety review board reads weekly.

Cohort-01 design partners receive direct access to the founder and a configuration session on the 90-day plan. See the Buyer's Guide for the full evaluation framework, or contact us to discuss your operation.

• ICAO Annex 19 — Safety Management. Second edition (2016). The 30-page Standard.
• ICAO Doc 9859 — Safety Management Manual. Fourth edition (2018). The 226-page guidance. Sections 4 (Safety Performance) and 5 (Safety Management Implementation) are the load-bearing chapters for this article.
• EASA Part-ORO.GEN. Annex III to Commission Regulation (EU) 965/2012 — air operations organisation requirements (accountable manager, management system, compliance monitoring).
• FAA AC 120-92B — Safety Management Systems for Aviation Service Providers. The US implementation guidance under 14 CFR Part 5.
• EU Regulation 376/2014. Reporting, analysis and follow-up of occurrences in civil aviation. Articles 4 (mandatory), 5 (voluntary), and 16 (Just Culture protection).
• ICAO Annex 13 — Aircraft Accident and Incident Investigation. Definitions of accident, serious incident, incident.