FAA Part 5 vs ICAO Annex 19:
one SMS can satisfy both.

See the highlighted block above the contents list. The rest of this article walks through how the two frameworks relate, where they align and where the emphasis differs, why one well-built SMS satisfies both, and what US certificate holders operating internationally should keep an eye on.

ICAO writes standards and recommended practices for its member States, not for individual operators. Annex 19 is the annex that consolidated safety management into one place: it defines the SMS framework of four components and twelve elements, and it obliges each State to run a State Safety Programme (SSP), the State-side counterpart through which the State manages safety in its own system and requires SMS of its service providers. The how-to guidance sits in ICAO Doc 9859, the Safety Management Manual, in its current edition.

14 CFR Part 5 is what that framework looks like after the United States transposes it. The FAA codified the SMS into Part 5 as enforceable regulation, originally for Part 121 air carriers. The 2024 final rule (published 2024-04-26, effective 2024-05-28) revised Part 5 and extended it to all Part 135 certificate holders, to 91.147 commercial air tour operators, and to certain Part 21 certificate holders.

So the relationship is vertical, not parallel. Annex 19 speaks to States; Part 5 is the State speaking to its certificate holders. When a US operator complies with Part 5, it is standing inside the US implementation of the Annex 19 system, which is also why the two feel so similar the moment you read them side by side. If you want the foundation first, start with what an SMS actually is and come back.

The alignment is structural, and it is nearly total. Both frameworks build the SMS on the same four components:

• Safety Policy: management commitment, accountability and the documented rules of the system.
• Safety Risk Management: hazard identification, risk assessment and mitigation before the event.
• Safety Assurance: performance monitoring, audits and continuous improvement after the controls are in place.
• Safety Promotion: training and communication that keep the system alive in the workforce.

Annex 19 breaks these four into twelve elements; Part 5 expresses the same substance as regulatory sections. The machinery underneath is recognisably identical: an accountable executive who owns the system, hazards flowing into a risk process, safety performance monitored against targets, and employees trained and informed. Both frameworks also put employee reporting at the center of hazard identification. The 2024 revisions to Part 5 make that concrete for US operators by requiring a confidential employee reporting system, a channel that protects the reporter's identity while feeding the risk process.

The practical consequence: a mapping table between Part 5 and the Annex 19 elements is short, stable and easy to maintain, because the two documents were never rivals. One descends from the other.

The differences are worth knowing precisely because the structures match. Four stand out.

Audience and legal force. Annex 19 is a set of standards and recommended practices addressed to States; it binds an operator only after a State transposes it. Part 5 is direct, enforceable regulation on the certificate holder. The same sentence about hazard identification reads as guidance in one document and as a compliance obligation in the other.

The declaration of compliance. The 2024 revisions require certificate holders to submit a declaration of compliance to the FAA: a formal, dated statement that the SMS meets the rule. Annex 19 defines no operator-level declaration instrument; acceptance mechanics are left to each State. If the declaration is on your desk, our declaration of compliance checklist covers what has to be true before you sign it.

Scalability language.Part 5 as revised applies regardless of operator size, explicitly including single-aircraft and single-pilot certificate holders, and the FAA's framing is that the SMS scales to the size and complexity of the operation rather than exempting the small. Annex 19 reaches operators only through each State's implementation, so its scaling is expressed at one remove. Part 5 puts the scaling question directly in the operator's lap.

Named mechanisms over principles. Part 5 turns principles into dated, inspectable artifacts: implementation plans (due 2024-11-28 for the newly covered operators), a confidential employee reporting system, and the declaration itself, with full implementation due 2027-05-28 for Part 135 and 91.147 operators and 2025-05-28 conformity for Part 121 carriers that already held an accepted SMS. The full timeline lives in our Part 5 final rule explainer.

Because the spine is shared, the correct number of safety management systems to build is one. Operators get into trouble when they treat Part 5 and Annex 19 as separate projects: two manuals, two hazard registers, two sets of records that immediately begin to disagree. The frameworks themselves never asked for that.

The working method is a single system with a single mapping. Build the SMS once on the four components: one safety policy with one accountable executive, one hazard register and risk methodology, one assurance cycle, one training and communication stream. Then maintain a requirement map that points each process at the Part 5 provision and the Annex 19 element it satisfies. Where the two differ, satisfy the more concrete demand, which is almost always the Part 5 mechanism, and the mapping shows the Annex coverage automatically. Our Annex 19 SMS in 90 days guide walks that build order in detail.

This is also where tooling stops being cosmetic. When occurrences, hazards, investigations, corrective actions, audits, findings and safety performance indicators live in one operational graph, as they do in the eAviora SMS module, the same linked records evidence a Part 5 inspection and an international audit without re-keying, because the evidence is the operation itself, not a binder assembled per framework.

For a US certificate holder that flies internationally, codeshares, or sells capacity to foreign customers, four watch-items keep the one-SMS strategy honest.

• Vocabulary. Foreign authorities, partners and due-diligence questionnaires phrase expectations in Annex 19 component-and-element language. Keep the mapping document current so you can answer in either dialect from the same records.
• Benchmark audits. International programmes such as IOSA frame safety management in international terms. An SMS whose records are linked and current makes that evidence cheap to produce; see how that plays out in IOSA compliance, ISARPs and evidence.
• Other regimes are separate. Part 5 compliance does not discharge foreign obligations. EASA embeds management-system requirements in its implementing rules (ORO.GEN.200 for air operators), and European occurrence reporting runs under EU 376/2014 on its own clock. Know which regime each report and requirement lives in, and check the current guidance of each authority you operate under.
• The home deadlines. The international frame must not distract from the US dates: 2025-05-28 for Part 121 conformity to the revised rule, and 2027-05-28 for Part 135 and 91.147 operators to have the SMS fully implemented with the declaration of compliance submitted.

None of these change the core conclusion. They are reasons to keep the mapping tight, not reasons to build a second system.