Part 135 SMS: what must be
working by 2027.

See the highlighted block above the contents list. The rest of this article explains what a fully implemented SMS looks like in evidence rather than in a manual, walks the four components as running records, backward-plans the runway from 2027-05-28, names the traps that catch small charter operators, and shows where software removes the administrative weight instead of adding to it.

The single most expensive misreading of the Part 135 deadline is to treat it as a documentation deadline. It is not. The 2027-05-28 milestone set by the FAA Part 5 SMS final rule is a full-implementation deadline. The distinction decides how much runway you actually have.

A written SMS can be produced in weeks: adopt a manual template, fill in the operator name, get it approved. A working SMS cannot be produced in weeks, because “working” means the system has been turning long enough to leave a trail. When an inspector looks at a fully implemented SMS, the question is not “does a policy exist,” it is “show me the hazards you identified last quarter, the risk assessments they triggered, the controls you put in place, and the assurance that tells you those controls are holding.” None of that can be back-dated.

So the honest way to read 2027-05-28 is to subtract the operating history you will need to demonstrate from the deadline, and start there. A system that goes live the month before the deadline has nothing to show. A system that has been live for a year has a year of reports, trends, and closed actions to point at. The rule rewards the operator who started early with something small and real over the operator who produced a large document late.

Read each of the four components as a question about evidence, not about paperwork.

• Safety Policy. Evidence is a signed policy, a named accountable executive who can describe the system in their own words, and defined safety responsibilities that people in the operation actually recognise as theirs.
• Safety Risk Management. Evidence is a live hazard register with real entries, risk assessments tied to them, and controls that trace back to a specific hazard. For many Part 135 operators a flight risk assessment tool (FRAT) provides a daily, inspectable slice of this: pre-flight numeric risk scoring that shows risk being assessed before every trip, not once a year.
• Safety Assurance. Evidence is monitoring that catches when a control stops working: audit findings that get raised and closed, safety performance indicators trending over time, and corrective actions that run to completion rather than lingering open.
• Safety Promotion. Evidence is training records, safety communications that went out and were read, and a workforce that can say what the reporting channel is and what happened to the last thing they reported.

Notice that every one of those is a record with a date on it, not a section in a binder. That is the whole point of a full-implementation deadline: the four components have to have produced artifacts, and the artifacts have to connect. A hazard that never led to a risk assessment, or a finding that never produced a corrective action, is a loop that did not close, and a loop that did not close is the gap an inspector is trained to find.

Plan from 2027-05-28 backward, not from today forward. The target is not “an SMS by the deadline,” it is “enough operating history by the deadline to prove the SMS runs.” A sensible backward plan looks like this.

• By 2027-05-28. SMS fully implemented, declaration of compliance submitted, several quarters of evidence in hand across all four components.
• Roughly a year before. The whole system is live and producing records, so that by the deadline you have real trend data, closed actions, and audit history rather than a system that only just switched on.
• Before that. The confidential reporting channel is open and trusted, hazards are flowing, and the risk process is turning. Reporting needs the longest lead time, because trust is built slowly and cannot be rushed at the end.
• Now. Run a gap analysis against the four components to convert the deadline into a concrete backlog. The Part 5 gap analysis guide is a structured way to score what exists and what does not.

The uncomfortable implication is that the useful deadline is not 2027, it is well before it. If the system is not producing records with a year to spare, the operator is planning to hand an inspector a manual and hope. Backward-planning turns a distant date into pressure that lands now, which is exactly where you want it.

Small Part 135 operators fall into a predictable set of traps. Naming them is half the defense.

• Assuming size buys an exemption. It does not. The rule applies to single-aircraft and single-pilot certificate holders on the same 2027-05-28 timeline as anyone else. A small operation runs a proportionate SMS, not no SMS.
• Treating the manual as the deliverable. An approved manual with no operating history is the most common way to arrive at a full-implementation deadline with nothing to show. The manual is the description of the system, not the system.
• Assuming a prior voluntary program is enough. Operators move from the earlier voluntary program to the codified rule; they do not skip it. The SMSVP to Part 5 transition is a mapping exercise plus gap-closing, with the same 2027-05-28 date for Part 135 SMSVP letter holders.
• Under-building confidential reporting. In a small operation the reporter is easy to identify, so a confidential employee reporting system needs real de-identification and a trusted handling process, or people simply will not report and the risk process starves.
• Buying tools that add admin. A blank-library tool that hands a two-person safety office an empty hazard list, an empty indicator library, and a pile of configuration is a second job, not a solution. The point of tooling for a small charter is to remove administrative weight, not relocate it.

For a small charter the deciding question about any SMS software is simple: does it reduce the administrative burden or add to it? The answer turns on how much arrives pre-built and how much the loop enforces itself.

eAviora ships with a pre-built aviation risk model, 101 bow-tie models, 804 named barriers, 210 scenarios, and a 610-indicator safety performance indicator library, so a small operator starts from a working risk picture instead of a blank page. Occurrences, hazards, investigations, corrective actions, audits, findings, documents, training, and indicators live in one operational graph in the SMS module, so the four components are one linked record set rather than four binders that drift apart.

Two design choices matter most for evidence. First, enforced closure gates: a record cannot close over open risk, so a degraded barrier holds its corrective action open until it is proven effective. That is the mechanism that keeps the loop from quietly leaving a gap, which is precisely what a full-implementation inspection probes. Second, a computed Safety Risk Profile fuses eight components into one ICAO Doc 9859 aligned four-level score, and indicators run through real statistical process control rather than coloured trend arrows, so the trend evidence is genuine rather than decorative.

The confidential channel runs a closed just-culture loop by default, with de-identified bulletins and reporter feedback, and the specialist AI agents that draft classifications and assessments are always human-gated (accept, modify, or reject) and audit-logged, with AI consumption metered in plain credits under hard caps. For a two-person safety office, that is the difference between an SMS that is a full-time administrative job and one that mostly runs itself between reviews.