SGS Aerospace: What Must a Production Site Demonstrate?

As the quality manager of a Part 21G-approved facility, you have been implementing the safety management system since March 2023, and the deadline for correcting your nonconformities expired on March 7, 2025. Since then, the auditor has been verifying a system that operates on a daily basis, and approved sites are asking their subcontractors the same questions.

The aviation SGS, or safety management system, is the safety component of the system that manages your production. It is evaluated on the job, regarding the current skill level of each of your operators.

What is an aviation SGS?

Under Part 21, the European regulation governing aircraft production, SGS provides training a part of the system that already manages your production, in addition to quality. He reports directly to the executive in charge.

It addresses safety—specifically, defects and errors that can make a product dangerous. ICAO bases it on four pillars, which apply equally to large corporations and small workshops.

• The security policy outlines management's commitments and designates those responsible.
• Risk management identifies hazards, assesses them, and determines what safeguards to put in place.
• Monitoring results measures whether these barriers are effective and supports each change.
• Training and communication ensure that everyone understands their role, and in our view, this is the pillar that supports the other three.

Security, which protects against malicious acts, is governed by other laws. As for the inspection company SGS, the only thing it has in common with this system is its acronym.

A manual and an SGS manager are not enough, because EASA guidelines stipulate that safety cannot rest on a single person. Only the operator implements the safeguards at the workstation; without up-to-date skills, they are ineffective.

Is your site affected, and since when?

If your facility holds a Part 21G production approval, SGS certification has been required since March 7, 2023, effective date of European Regulations 2022/201 and 2022/203.

Sites that were already certified had an additional two years to bring themselves into compliance. That deadline has passed. In France, OSAC monitors your certification on behalf of the DGAC and will come to inspect this system.

SGS Deadlines for a Production Site

Tap a date to see what changes on that date.

Today

EASA · March 7, 2023SGS certification is now requiredView details

Application of Regulations (EU) 2022/201 and 2022/203 to Part 21G-Approved Production Organizations.

EASA · March 7, 2025End of the correction periodView details

Sites that had already been certified were required to have corrected their nonconformities. Any remaining nonconformity may result in the certificate being restricted, suspended, or revoked.

FAA · May 28, 2027Deadline for U.S. holdersView details

U.S. holders of type and production certificates must have established their SGS (Part 5). These requirements are passed down to their suppliers.

Europe (EASA, Part 21G)United States (FAA, Part 5)

Sources: EASA FAQ on Regulations 2022/201 and 2022/203 ; 14 CFR Part 5.

An ordinary deviation, known as a Level 2 deviation, results in No more than 3 months to correct the issue, which can be extended under an approved action plan. If not corrected, it becomes a Level 1 deviation, and approval is then at risk.

We recommend that you identify and address any nonconformities before the OSAC visit, so that the auditor finds a system that is up and running and an action plan already underway.

What if you're a subcontractor for an approved site?

Part 21 does not require No full SGS to an unapproved subcontractor. However, your certified client is responsible for your risks, and they can audit your site and request proof of your operators' qualifications.

Are you supplying a U.S. holder of type and production certificates? That holder must have established its SGS. no later than May 28, 2027, and it already imposes quality requirements on its suppliers.

Training and Human Factors: What Part 21 Requires

Part 21 requires that the competence of each person involved be established through a procedure, assessed, maintained through ongoing training, and documented.

In production, the danger that really matters is the one that results in the delivery of a nonconforming part. The maintenance department has identified twelve human factors—conditions that set the stage for errors—and three of them occur on the shop floor.

• A lack of knowledge occurs when an operator takes a position without having been trained for it, or with an expired certification.
• The pressure comes from the production pace, from your customer who is waiting for their parts, or from the operator himself.
• Standards are the unwritten rules of the workshop—the ones that go, «That’s just how we’ve always done it here.».

Provide on-the-job training through short sessions that you evaluate and track, including for temporary employees and contractors before they start their first assignment, since that is when mistakes tend to occur.

The process can be short. LISI Aerospace, a manufacturer of aerospace parts, has reduced its training time by a factor of four thanks to a customized training workflow, as shown in his client case.

What does the OSAC auditor check?

During the first surveillance cycle, the EASA assessment method requires the auditor to verify that Your system operates on a daily basis, and he can ask questions of both your operators and your manager.

He compares your training records to your program, then asks an operator what safety expects of him. Training that is signed off on and then forgotten fails this second test.

«Mercateam allows us to ensure the traceability of skills—which is essential for meeting the strict requirements of our industry—while simplifying audits.»

Dina Haggag, Digital Transformation Leader for France at Collins Aerospace, in his testimony.

In your template, prepare the three items the listener hopes to find there : the competency framework, each person’s dated evaluation, and the action taken when a discrepancy arises.

What puts you at risk of receiving a notice is a written process that no one uses. A process that is in place but not yet effective generally results in a notice.

What You Keep	Minimum duration	Text
Competency and Authorization File for Each Individual	3 years after leaving the position, changing positions, or having authorization revoked	Part 21, EASA Acceptable Means
Production data demonstrating compliance	3 years after the certificate of conformity was issued	Part 21, EASA Guidelines
Training for Each Individual	As long as she is employed	Part 5 of the FAA
Safety Messages Issued to Staff	24 months	Part 5 of the FAA

Since these files are kept for years, gather them all in one place. After more than 15 years using Excel, LISI Aerospace reduced its audit preparation time by 75 % thanks to the authorization tracking.

SGS and EN 9100: Building on What Already Exists

You can integrate the SGS into your EN 9100 quality system, which already covers part of it. Start with a gap analysis, which compares what you have with what the text asks for.

For the skills section, add "security" to your skills matrix existing one, because a separate table will eventually become out of sync. Add three columns to it.

• The safety criticality of the workstation shows you where an error could result in a nonconforming part.
• The skill level observed on the job—which you evaluate and date—complements the training you have completed.
• The expiration date of each authorization—which EASA considers part of the minimum record for each authorized person—is included in your authorization matrix.

A competency matrix that drives SGS

The three columns added to a standard versatility grid.

Operator	DrillingReview	Surface TreatmentReview	Visual inspection	Packaging
A.B.	trainerValid through June 2027	autonomousexpires 12/2026	autonomous	under control
C.D.	autonomousValid through March 2027	untrained	trainer	autonomous
E.F.temporary	in training	untrained	under control	autonomous
G.H.	under controlexpires in September 2026	autonomousValid through May 2027	untrained	trainer

Job CriticalityWhere an error can result in a nonconforming part being shipped.

Level observed at the stationOnce evaluated and dated, it serves as a record of the training completed.

Expiration DateEach authorization has an expiration date, which is visible before it expires.

Your EN 9100 certification already covers product safety and improvement. What it lacks is Comprehensive security risk management and a chronological account of events, to be added as appropriate, as the text specifies.

For your special processes, the same matrix row is used for both customer audits and OSAC oversight, specifying who is qualified, for which process, and until when.

How can we keep the SGS system active between audits?

Next the percentage of critical positions filled by individuals with valid security clearances, you'll know between audits whether your safeguards are holding up.

This indicator is preventive. It identifies deviations before an incident occurs, whereas an incident count identifies them after the fact, and the authority relies on indicators related to the effectiveness of safety barriers.

The indicator is reliable only if the schedule assigns only authorized operators to critical workstations. This is the standard practice at LISI Aerospace for its high-risk machines, where managers are alerted before each deadline expires.

Do you really need software for that? A small, low-risk website can do without it. A authorization management This equipment comes in handy when outsourcing and production schedules become tight.

What You Can Do Before Your Next Follow-up Visit

Open your matrix and Start with the expiration dates, which are the least expensive to update. Then ask two operators—just as the auditor would—what security expects of them.

We equip more than 300 industrial sites to track Qualifications and Authorizations for Your Aviation Audits. Request a demo to see how pre-expiration alerts work.