A safety management system (SMS) is the structure that lets an aviation organisation manage its safety risks systematically: it identifies hazards, assesses risks, monitors whether the controls in place actually work, and sustains all this through policy, accountabilities and training. The US Federal Aviation Administration (FAA) defines SMS as a formal, top-down, organisation-wide approach to managing safety risk and assuring the effectiveness of risk controls.
The international framework is Annex 19 of the International Civil Aviation Organization (ICAO). According to ICAO, Amendment 2 to Annex 19 was adopted on 23 June 2025 and becomes applicable on 26 November 2026; it extends SMS to certified remotely piloted aircraft system (RPAS) operators and to certified heliports.
In short:
- An SMS has four components: safety policy and objectives, safety risk management, safety assurance and safety promotion (ICAO Doc 9859).
- In Türkiye, the SHY-SMS regulation of the Directorate General of Civil Aviation (SHGM) makes the same four components mandatory.
- An SMS is not a set of documents but a management cycle whose data is collected continuously.
Why did safety management systems emerge?
As ICAO puts it, the safety management provisions support a proactive strategy to improve safety performance in an increasingly complex air transport system. The approach has two pillars: the State Safety Programme (SSP) run by states and the SMS set up by service providers. In short, the state builds its own oversight system, while the airline, maintenance organisation, airport operator or manufacturer builds its own safety management.
The history of Annex 19 shows this shift. The ICAO Council adopted the first edition of Annex 19 on 25 February 2013; it consolidated safety management provisions scattered across six Annexes into a single one and became applicable on 14 November 2013. Amendment 1, adopted in 2016, was published as the second edition and became applicable on 7 November 2019; it extended SMS to organisations responsible for the type design and manufacture of engines and propellers.
What are the four components of an SMS?
The fourth edition of ICAO's Safety Management Manual (Doc 9859) builds the SMS framework on four components. SHGM's SHY-SMS regulation lists the same four components with reference to Doc 9859 and specifies their content as follows:
- Safety policy and objectives: management commitment and accountability, safety responsibilities of managers, appointment of a safety manager, the SMS implementation plan, coordination of the emergency response plan, and documentation.
- Safety risk management: hazard and risk identification processes, and risk assessment, control and mitigation processes.
- Safety assurance: defining safety standards, monitoring and measuring safety performance, management of change, and continuous improvement of the SMS.
- Safety promotion: training and education, and safety communication.
The FAA's 14 CFR Part 5 rule also lists the same four components as a minimum and requires the SMS to be appropriate to the size, scope and complexity of the organisation. This common ground matters: even where authorities' rules differ in detail, the skeleton is the same.
The distinction most often blurred is the one between risk management and assurance. Under the FAA's definitions, safety risk management consists of describing the system, identifying hazards, and analysing and controlling risk; safety assurance is the set of processes that verify the performance and effectiveness of those risk controls by collecting and assessing data. Put simply, one designs the control, the other asks whether it actually works in the field.
Who must have an SMS in Türkiye?
Under SHGM's SHY-SMS regulation, published in the Official Gazette on 13 January 2012 and amended in 2015 and 2016, the scope is broad: air navigation service providers, airport and terminal operators, certain ground handling organisations, fuel suppliers, commercial air transport operators, training organisations, approved maintenance organisations, aviation medical centres, and design and production organisations must establish an SMS.
The regulation also includes a proportionality principle. The SMS is set up in line with the complexity and size of the activities and the hazards they may face; small organisations with twenty or fewer staff establish a system that fits their activities and organisational structure. For definitions, the regulation refers to the latest revision of ICAO Doc 9859. SHGM's legislation in force should be checked for current obligations; this article is not legal advice.
Is SMS used beyond aviation?
The four-component logic of SMS (policy, risk management, assurance and promotion) is not an aviation-only technique but a general safety management framework. In the US the scope is widening within aviation too: under FAA Part 5, organisations that hold both a type certificate and a production certificate for the same product must implement an SMS no later than 28 May 2027. SMS is thus spreading from operators to the design and production side.
In Orient Global's view, organisations in other high-risk sectors such as rail, energy or defence can use these four components as a checklist when building the system their own regulations require. For the functional safety side, see our articles on RAMS on the railway and ISO 13849-1 for machinery.
What does Annex 19 Amendment 2 change?
According to ICAO, Amendment 2, applicable from 26 November 2026, brings changes in three areas: enhanced State Safety Programme and SMS provisions; extension of SMS to certified RPAS operators conducting international operations, to the approved maintenance organisations serving them, and to certified heliports; and provisions on developing safety intelligence to support aviation decision-making. For the last of these, ICAO has published the first edition of the Safety Intelligence Manual (Doc 10159).
Conclusion: where to start with an SMS?
A safety management system is a four-component management cycle defined in ICAO Annex 19 and Doc 9859 and made mandatory in Türkiye by SHGM regulation; from 26 November 2026 its international scope widens again. A practical start is to clarify the accountable manager and safety manager roles, make the hazard reporting channel genuinely work, and begin tracking a few measurable safety performance indicators.
"Safety Management" is part of Orient Global's corporate training catalogue; details are on the trainings page.
This article is for general information only and is not legal advice; current SHGM and ICAO texts prevail.
#interimmanagement #forwarddeployedengineering #safetymanagementsystem #sms #aviation