FAA Part 135 SMS Mandate: The 2027 Compliance Guide

In 2024 the FAA finalized a rule that expands Safety Management System (SMS) requirements under 14 CFR Part 5 to every Part 135 air carrier and on-demand operator, along with certain air tour and Part 91.147 operators. For the first time, a structured, documented SMS is not a best practice or a competitive differentiator for charter operators. It is a regulatory requirement with a hard federal deadline.

An SMS is a formal, organization-wide approach to managing safety risk. It is the same framework that Part 121 airlines have operated under for years, now scaled down to the charter and commuter world. The mandate reaches operators of every size, including single-aircraft and single-pilot certificate holders. There is no small-operator exemption.

If you are new to the framework itself, start with what an aviation SMS is for the fundamentals, then use this guide as your roadmap to the 2027 compliance deadline.

The mandate runs on a two-step timeline. The first milestone, an SMS implementation plan submitted to the FAA, came due on November 28, 2024. That plan describes how and when your operation will build out each required element of the system.

The second milestone is the one that defines the program: every affected certificate holder must have a functioning, documented SMS and submit a Declaration of Compliance by May 28, 2027. The Declaration is your formal attestation that the system is not just designed but implemented, operating, and producing evidence in day-to-day operations.

That gap between a plan on paper and a system that demonstrably works is where the real effort lives. A program you stand up in the final weeks will not have the operational record an inspector expects. For a deeper view of the phased build, see our Part 135 SMS implementation timeline.

Part 5 is built on four components, and your program must implement all four. They are not modules you can pick from; they reinforce each other.

Safety Policy is the foundation: leadership commitment, defined safety accountabilities, and a non-punitive reporting policy that makes hazard reporting safe. Safety Risk Management (SRM) is the process for identifying hazards, assessing risk, and putting controls in place before operations are affected. Safety Assurance (SA) is the feedback loop, monitoring whether those controls actually work through audits, reporting, and performance data. Safety Promotion ties it together with training and communication so the whole organization understands and uses the system.

Each component has to be demonstrated through real operational evidence, not just described in a manual. SRM, in particular, connects directly to the day-to-day compliance work you already do, including fatigue risk management and voluntary safety reporting through an ASAP program.

The FAA has been explicit that SMS is scalable to the size and complexity of the operation. A two-aircraft on-demand operator will not run the same program as a large commuter carrier. But scalable means right-sized, not reduced. All four components still apply, and each still has to function and produce evidence.

For very small and single-pilot operations, the hardest part is often not the paperwork but the culture. Safety Assurance depends on people reporting hazards honestly, and that is difficult when the person reporting and the person receiving the report are the same one or two individuals. The FAA still requires a genuine, non-punitive reporting mechanism and evidence that hazards are captured and acted on.

If you run a lean operation, the practical answer is a lightweight but real system: simple reporting that someone reviews, a basic risk register, and a documented review cadence. The goal is a working loop, not a binder.

A non-punitive reporting policy is a mandatory element of the Safety Policy component, and it is the part operators most often underestimate. The system only works if crews and staff will report hazards, errors, and close calls without fear of automatic discipline.

That policy has to be written, communicated, and visibly honored. The first time a good-faith report leads to punishment, reporting stops, your Safety Assurance data dries up, and the system fails its core purpose. Build the policy early and let leadership model it; the reporting record it generates becomes the operational evidence your Declaration of Compliance depends on.

Advisory Circular AC 120-92B is the FAA's detailed implementation guidance, and it is the document to work from. Your implementation plan should map each of the four components to concrete deliverables, owners, and dates, and show how you will move from design to a fully operating system before May 28, 2027.

The FAA reviews the plan for completeness and realism: does it address all four components, does it fit your operation, and is the timeline credible. Then, as you implement, the focus shifts to evidence. Inspectors want to see that hazards are being reported, risks are being assessed and controlled, and the system is being monitored and improved over time.

This is the same evidence-first posture you already manage for the rest of your certificate. If you keep a strong audit trail elsewhere, extend it to SMS; if you do not, SMS is the forcing function to build one. Our Part 135 compliance checklist is a useful companion for keeping the wider operation inspection-ready alongside the SMS work.

The single biggest reason SMS programs struggle is not policy design; it is sustaining the evidence. A Declaration of Compliance rests on a living record: reports filed, risk assessments completed, corrective actions tracked to closure, and safety performance reviewed on a schedule.

Spreadsheets and shared drives can get a small operation started, but they make it hard to prove the system is operating continuously, which is exactly what the mandate requires. Hazard reports get lost in inboxes, risk registers go stale, and corrective actions stall with no owner or deadline. Operators increasingly manage SMS evidence the way they manage the rest of compliance, with every item mapped to an owner, a due date, and a closed-loop record inside a purpose-built tool such as Navlyt Compliance.

The operators who will be ready in 2027 are the ones treating SMS as an operating system, not a document. Stand up the four components now, get the non-punitive reporting policy live early so it accumulates a real reporting history, and keep an auditable record of every hazard, risk assessment, and corrective action from day one.

Navlyt is built to carry that load: map each SMS requirement to evidence, ownership, and deadlines, keep your reporting and corrective-action loop closed, and walk into your FAA review with the record already organized. When you are ready to build the system instead of assembling it from spreadsheets, start with a 14-day free trial on the pricing page or book a demo to see SMS evidence management on your own operation.