Quick answer
The block above is the short version. Below: the seven swaps as a table, what changes depending on the certificate you hold, a first month that is achievable rather than aspirational, and the question most operations forget to ask until late, which is what happens to their history.
The seven swaps
Every row below is something an operation is doing today. The right column is not a feature list; it is the same job with the relationship kept by the system rather than by a person.
| Running by hand today | On a connected system |
|---|---|
| Occurrence reports in a shared mailbox | Structured intake, classified and linked when it arrives |
| A hazard register in a spreadsheet | Bow-tie models with named barriers whose condition is assessed |
| Indicators recalculated by hand each month | Control charts where a statistical rule trips on its own |
| Findings tracked in a second system | One record type on the same graph as everything else |
| Actions closed on a checkbox | Closure gated on verified effectiveness by a second person |
| A board pack assembled the week before | An agenda derived from what the safety data escalated |
| An audit folder assembled from scratch | Evidence attached to the requirement when it is produced |
The row that pays for the project is usually the fifth. An action closed unverified is the most common reason a barrier is still degraded when the next occurrence arrives, and it is invisible in a spreadsheet because the closure and the outcome live in different files. See the closure gate.
What differs by certificate
The ICAO Annex 19 four components are common to all of them. What changes is which records dominate and which rule set the evidence is assembled against.
- Air operators (EASA Part-ORO, FAA Part 121 and Part 135). Occurrences, indicators and governance dominate. IOSA preparation reads the same records if they are connected. See Part 135 requirements and the 2027 deadline.
- Maintenance organisations (EASA Part-145). Findings, corrective actions and competency validity for certifying staff dominate, with document control proving the current revision reached the floor. See SMS software for MRO and Part-145.
- Training organisations (EASA Part-ORA). Competency records with validity windows and the requirement matrix an inspector reads. See SMS software for flight schools.
- Ground handling. Per-station registers and intake that works on a stand, because the person who sees the event is outside and holding a radio.
For the United States timeline specifically, the FAA SMS final rule extended a mandatory SMS well beyond Part 121; see the Part 5 final rule explained.
A realistic first month
Week 0. A walkthrough on your own data rather than a demo tenant. Bring three recent occurrences. Anything that cannot be shown on your records in forty five minutes is unlikely to behave differently on a hundred thousand of them.
Week 1. One module family live, with your taxonomy and your people. Scope the risk library to your operation rather than accepting the whole catalogue, since a register nobody recognises is a register nobody maintains.
Weeks 2 to 4. Migration of historic records with references preserved, and one existing programme moved end to end. Expect the taxonomy conversation to take longer than the import.
What consistently derails a first month is trying to move everything at once. The counter-pattern is to pick the module family where your next audit will look and finish it. For a phased plan against the framework, see Annex 19 in 90 days.
What happens to your history
Ask this before signing, not during implementation. Historic records should import with their original references intact, so a finding raised two years ago can still be followed. An audit trail that appears to begin on go-live day invites the obvious question about what else did not survive the move.
The matching question is how you get out. Full export on demand in open formats, covering records and their links rather than a flat table, is the difference between a system you chose and one you are stuck with. Safety data is operational memory, and an operator that cannot take it with them has handed over more than a subscription.
Frequently asked questions
Can you run an aviation SMS on spreadsheets?
You can run the record keeping on spreadsheets, and many small operations do it lawfully for years. What spreadsheets cannot hold is the relationships: which occurrence belongs to which hazard, which barrier a finding degraded, whether the action that closed last quarter actually worked. Those links are what an audit samples and what turns reports into prevention. The practical limit is usually reached when the person who remembers the links goes on leave, or when an auditor asks a question that requires joining two files.
What does SMS software actually replace?
In most operations it replaces seven things: occurrence reports arriving in a shared mailbox, a hazard register kept as a spreadsheet, indicators recalculated by hand each month, findings tracked in a separate audit tool, corrective actions closed on a checkbox, a board pack assembled the week before the meeting, and an audit folder built from scratch each cycle. It does not replace the safety professionals doing the analysis, and any vendor implying otherwise is describing a product that will fail its first audit.
How long does it take to move an SMS onto a platform?
A scoped first month is realistic for a single module family: intake live, the risk library scoped to your operation, and one existing programme migrated. A full migration across every module, with historic records imported and taxonomy reconciled, is a quarter of work for a mid-size operator, most of it yours rather than the vendor. The step that consistently takes longer than planned is agreeing your own taxonomy, because it surfaces disagreements that the spreadsheets were quietly absorbing.
What happens to historic safety records during a migration?
They should be imported with their original references preserved, so history stays comparable and the audit trail does not appear to start on go-live day. Losing reference continuity is a genuine audit risk: an auditor who cannot follow a finding from the old system into the new one is entitled to ask what else did not survive the move. Confirm before signing that the vendor imports historic records rather than only carrying forward open items, and that you can export everything back out in an open format.
Does the requirement differ between an airline, an MRO and a flight school?
The framework is common and the obligations differ. All follow the ICAO Annex 19 four components, adopted nationally through rules such as EASA Part-ORO for air operators, Part-145 for maintenance organisations, Part-ORA for approved training organisations, and FAA 14 CFR Part 5 in the United States. What changes is which records dominate: an airline lives in occurrences, indicators and governance; a Part-145 organisation lives in findings, corrective actions and competency validity for certifying staff; a training organisation lives in competency records and the requirement matrix an inspector reads.