Your SMSVP-era SMS is ahead.
It is not finished.

See the highlighted block above the contents list. The rest of this article covers where the voluntary program leaves you, what the codified rule adds, how to audit an SMSVP-era system against Part 5, why evidence is the new bar, and how to close the delta without throwing away the system you already have.

The Safety Management System Voluntary Program was the FAA's earlier route for operators who wanted to build an accepted safety management system before regulation required one. If you took part, you did the hard cultural work early: you have a safety policy, a hazard and risk process, a reporting habit your people trust, and records that go back years. That is a genuine head start, and most operators newly pulled into the 2024 rule would trade places with you.

The mistake is to read “head start” as “finished.” The 2024 SMS final rule, published 2024-04-26 and effective 2024-05-28, revised 14 CFR Part 5 and extended it across the industry. SMSVP participants do not sit outside that change; they transition into it. The rule is now the codified obligation, and your voluntary program is measured against it rather than the other way round. The full shape of the rule is covered in our Part 5 final rule explainer.

For a Part 135 SMSVP letter holder the deadline is concrete: full implementation under the revised Part 5 and a submitted declaration of compliance no later than 2027-05-28. The distance between where a good voluntary SMS sits and where the rule requires it to be is usually small, but it is rarely zero, and the only way to know its size is to look.

Three shifts separate a codified Part 5 SMS from a voluntary one. None of them requires a new SMS; each is a specific thing to confirm or add.

Legal character.The most fundamental change is not a feature at all. A voluntary, accepted program becomes a binding regulatory obligation. What was an arrangement you opted into is now a rule you comply with and can be inspected against. Nothing on the page may look different, but the standard you are held to has moved from “the FAA accepted our program” to “the rule requires this, and here is the proof.”

The confidential employee reporting system. The 2024 revisions require a confidential channel that protects the reporter's identity while feeding the risk process. Many SMSVP-era systems already run some form of reporting, but the required-confidentiality shape is worth verifying precisely: can a report be filed without exposing who filed it, and is the loop closed back to the workforce? Our guide to the confidential employee reporting system sets out what the channel has to do.

The declaration of compliance. The rule adds a formal, dated statement submitted to the FAA that your SMS meets Part 5. The voluntary program worked through FAA acceptance of your program; the declaration is a distinct, concrete deliverable that certifies a working system. Treat it as the endpoint of an evidence trail, not a form. Our declaration of compliance checklist covers what must be true before you sign it.

The transition is a gap-analysis exercise, not a build. You are comparing a system you already run against the rule as written, and recording exactly where the two diverge. The clean way to do it is component by component, because both your SMSVP system and Part 5 are organized around the same four:

• Safety Policy.Is the accountable executive named and current, are the objectives stated, and does the policy reflect the codified rule rather than the voluntary program's language?
• Safety Risk Management. Is the hazard register live, and can you show risk decisions with the evidence behind them, not just a methodology on paper?
• Safety Assurance. Has the assurance cycle (audit, monitoring, management review, corrective action) actually turned over, with records to prove it?
• Safety Promotion. Are training and communication current, and does the reporting culture reach the whole workforce?

Against each component, mark three states: met (the rule's requirement is satisfied and evidenced), partial (present but not in the form the rule requires, the common case for the confidential channel), and missing (the declaration is the usual entry here). That table is your entire transition plan. Our Part 5 gap analysis guide walks the method in detail, and it is the same exercise a newly covered operator runs, only starting from a much stronger position.

The delta that surprises SMSVP operators most is not a missing component; it is the standard of proof. A voluntary program was reviewed and accepted. A codified rule is inspected. The question shifts from “do you have a process for this?” to “show me it ran, with the records.” Many mature voluntary systems are strong on documentation and thin on demonstrable execution: the manual describes a corrective-action process beautifully, but the evidence that a specific hazard drove a specific action to proven closure is scattered or absent.

This is where the shape of your tooling starts to matter more than the thickness of your manual. When occurrences, hazards, investigations, corrective actions, audits, findings, training and safety performance indicators live in one operational graph, the evidence is a by-product of running the operation, not a separate assembly job before an inspection. The records that do the work are the records that prove the work.

Evidence discipline is also enforceable rather than optional. eAviora builds this in with enforced closure gates: a record cannot close over open risk, so a degraded barrier requires a linked corrective action proven effective before anything reads as closed. That behaviour, described in our note on enforced closure gates, is what turns “we have a process” into “the process cannot be skipped,” which is exactly the posture a regulatory inspection rewards. AI drafting across the workflow is human-gated on every proposal and audit-logged, metered in plain credits with hard caps, and operator data never trains any model.

The whole point of having built early is that you get to keep it. A rebuild throws away years of working culture, trusted reporting and accumulated records for zero regulatory benefit, and it introduces risk the rule never asked you to take. The disciplined path is narrow and specific:

• Run the four-component gap analysis and produce the met, partial, missing table.
• Close the partials first, usually re-shaping the reporting channel to the confidential form the rule requires and tightening evidence on the assurance cycle.
• Add the missing, which is typically the declaration of compliance and the evidence trail that stands behind it.
• Verify against the current FAA guidance for your certificate, then submit the declaration before 2027-05-28.

Handled this way, the transition is measured in confirming and tightening, not in months of new build. A platform helps by making the gap analysis and the evidence trail the same artifact: migrate your existing hazards, actions and audit history into one operational graph, and the compliance module shows the delta and holds the evidence in the same place. You are ahead. The job now is to finish, not to start over.