SMS software for helicopter operators,
sized to the rotorcraft risk.

The block above is the short version. The rest of this article breaks down the rotorcraft risk profile, the four capabilities to demand from SMS software, the FAA Part 5 deadline that now applies to Part 135 rotorcraft, and how a small operation runs a full system without a safety department.

Most safety software was designed for scheduled fixed-wing operations: long sectors, two or more crew, paved runways, a dispatch function, and a safety office with staff. A helicopter operation inverts almost every one of those assumptions, and the risk profile follows.

Rotorcraft spend their working lives in the most demanding part of the envelope. Flight is low and slow, often inside the height-velocity avoid region, with far less time and altitude to recover from a power loss than a jet at cruise. Sectors are short and numerous, so a single crew may complete many takeoff and landing cycles in a shift, and each cycle is where the exposure concentrates. The landing site is frequently confined, unprepared or unfamiliar: a hospital helipad, a ridge line, a ship deck, a road, a field. Wires, terrain, tail-rotor obstructions and a degraded visual environment (dust, snow, low light) are routine hazards rather than exceptions.

The mission sharpens the profile further. External-load and long-line work puts a load below the aircraft and a second set of failure modes in play. Helicopter air ambulance flying adds self-induced time pressure, because the patient in the back pulls against a clean go, no-go decision, often at night or in marginal weather. Utility, survey, firefighting and offshore work each add hazards close to the ground.

Two structural facts make this harder to manage than in an airline. First, many rotorcraft operations are single-pilot, so the person flying is also the one who would report the hazard, run the risk assessment and file the occurrence, between sectors, not at a desk. Second, exposure per flight hour is high and the margins are thin, so a weak signal an airline might catch over thousands of hours has far fewer hours to show itself before it becomes an event. So a helicopter SMS cannot be a filing cabinet you visit after something goes wrong: it has to be quick to feed in the field, and it has to turn what crews report into a risk picture the operator can act on early.

Sized to that profile, four capabilities matter more for a helicopter operator than almost anything on a generic feature list.

• Fast, mobile-friendly hazard reporting. If filing a report means opening a laptop back at base, the report that matters most, about a marginal landing zone or a near miss with a wire, never gets written. Reporting has to work from a phone, in a minute, from the field, or it does not capture the field.
• A flight risk assessment tool (FRAT) scored per mission. A FRAT is a pre-flight numeric risk score: the crew answers a short set of weighted questions (weather, site, crew duty and experience, aircraft, mission type) and the tool returns a score that either clears the flight or routes it for a second signature. FRAT scoring is standard practice across Part 135 and helicopter operations because it moves the risk decision to before the wheels leave the ground and makes the go, no-go call visible and consistent.
• Occurrence capture built for short sectors. An operation that flies many short legs generates many small events. The tool has to make logging one trivial, then connect those events so a pattern across sites, crews or mission types becomes visible rather than drowning.
• Risk assessment scoped to what you actually fly. A hazard log is only useful if each hazard maps to the barriers meant to control it and to the corrective actions raised when a barrier is weak. Building that risk model from a blank page is the work most small operators never finish, which is why arriving with the model already built matters so much.

Underneath those four sit the essentials any SMS needs: document control for the operations and SMS manuals, corrective-action tracking that actually closes, and safety performance indicators that show whether the operation is trending safer. For rotorcraft, all of it has to be light enough to run without a back office, and connected enough that a single-pilot report in the morning can move a risk indicator by the afternoon.

For US operators, this stopped being optional. The FAA published its expanded SMS final rule on 2024-04-26, effective 2024-05-28, revising 14 CFR Part 5. The rule extends SMS beyond the Part 121 airlines to all Part 135 certificate holders, to commercial air tour operators flying under 91.147 letters of authorization, and to certain Part 21 certificate holders. Most helicopter charter, air-taxi and helicopter air ambulance operations hold a Part 135 certificate, and many helicopter tour operators hold a 91.147 authorization, so the rule reaches straight into the rotorcraft world.

The timeline is fixed. Implementation plans were due 2024-11-28. The SMS must be fully implemented, and a declaration of compliance submitted to the FAA, no later than 2027-05-28. The requirement applies regardless of operator size, including single-aircraft and single-pilot certificate holders. There is no small-operator carve-out: a two-helicopter air-taxi company faces the same Part 5 structure as a large operator. Operators that took part in the FAA's earlier Safety Management System Voluntary Program (SMSVP) transition into the new Part 5 requirements, and Part 135 SMSVP letter holders likewise have until 2027-05-28. See the Part 135 SMS requirements and 2027 deadline for the full breakdown.

Part 5 is built on four components: Safety Policy, Safety Risk Management, Safety Assurance and Safety Promotion. The 2024 revisions also require a confidential employee reporting system, so crews can raise a concern without fear, and submission of the declaration of compliance. In practice, meeting the four components means showing a live process, not a binder: hazards reported and assessed, risks controlled by named barriers, corrective actions tracked to closure, and indicators that show the whole thing is working. For exact scope and current guidance for your certificate, check the FAA's Part 5 material directly.

The mistake to avoid is treating 2027-05-28 as a documentation deadline. A manual written the month before is not an implemented SMS. The components have to run long enough to produce evidence that they run, which is why the reporting, FRAT and risk-assessment habits above should be in daily use well ahead of the date.

eAviora is built to make a full SMS runnable by a small operation, the exact problem a helicopter operator has. A few design choices matter most here.

The aviation risk model arrives already built. Instead of a blank hazard library, eAviora ships 101 bow-tie models, 804 named barriers, 210 scenarios and a 610-indicator safety performance indicator library, and you scope that model to the operation you actually fly. For a two-aircraft company with no risk analyst, that is the difference between having a risk register and never finishing one: the risk model in the box, not an empty canvas.

Everything lives on one operational graph. Occurrences, hazards, investigations, corrective actions, audits, findings, documents, training, compliance, indicators and the Safety Risk Profile are the same connected records, not separate tools. So a hazard a pilot files from a landing zone links to the barrier meant to control it, to the corrective action raised when that barrier is weak, and to the indicator that tells you whether the fix held. An elevated FRAT score has somewhere to go: it opens a record in the same system where the risk model lives, rather than dying in a spreadsheet.

Closure is enforced, not optional. A record cannot be closed over open risk: a degraded barrier requires a linked corrective action proven effective before the record will close, proven by a 13 of 13 live scenario suite. For a single-pilot operator wearing every hat, that closure gate is a safety net: the system will not let a risk quietly disappear because everyone was busy flying.

The rest is sized to match. The Safety Risk Profile fuses eight components into one Doc 9859 aligned four-level score, so the accountable manager reads one answer instead of ten dashboards. Indicators run real statistical process control (Western Electric rules), so a shift is a genuine signal rather than a coloured arrow. More than 36 specialist AI agents can draft the next step, but every proposal is human-gated and audit-logged, AI is metered in plain credits with hard caps, and operator data never trains any model. Reporting is confidential with a closed just-culture loop, and tenant isolation is enforced by the database, not just application code.

If you are evaluating tools, weigh them against the rotorcraft reality rather than a feature grid:

• Can a pilot file a hazard or occurrence from a phone, in the field, in under a minute?
• Does a flight risk score route an elevated flight for a second signature before departure, and does that score connect to the rest of the system?
• Does the risk model arrive built, or must you populate a blank library first?
• When a barrier is weak, does the tool force a corrective action to closure, or is closing a record just a status change?
• Can it run without a dedicated safety office and still produce the evidence a Part 5 declaration needs?

A tool that answers yes to those five is sized for a helicopter operator; one that answers no is sized for someone else and handed to you. The Part 5 clock is the forcing function, but the reason to move is operational: rotorcraft exposure is concentrated and the margins thin, so the earlier a weak signal is caught, the more room there is to act. See the Part 135 SMS software guide or contact us to walk it through on your own operation.