Explainer
What Goes in an SMS Manual?
The Short Answer
Part 5 Requires Documentation, Not a Manual
Section 5.95 of 14 CFR part 5 says a person required to have a Safety Management System (SMS) must develop and maintain two things: the safety policy, and the SMS processes and procedures. FAA Advisory Circular 120-92D (21 May 2024) is explicit that part 5 does not require an SMS manual. A large organization is likely to have one; a small one might use a compliance statement or a spreadsheet that lists each requirement and how it is met.
So the useful question is not what the manual must be called but what the documentation must say, and where it sits among the operator's other manuals. The rest of this page works through both. It describes the rule and the FAA's guidance, and it is not legal advice: read the text of part 5 and your own certificate before relying on any summary.
What to Document
Four Components, One Policy
Section 5.5 requires an SMS appropriate to the size, scope, and complexity of the organization, with four components at a minimum. Each one produces text that the documentation has to carry.
- Safety policy (subpart B)
- Section 5.21 sets the floor: safety objectives, a commitment to meet them, a statement that resources will be provided, a reporting policy for hazards, a policy defining unacceptable behavior and when discipline applies, an emergency response plan, and a code of ethics that puts safety first. The accountable executive signs it, and it must be documented, communicated, and reviewed regularly. Sections 5.23 to 5.27 add who is accountable for what, who may accept risk, and what the emergency plan must cover.
- Safety risk management (subpart C)
- The process for describing a system, identifying hazards, assessing risk, and choosing controls (5.53 and 5.55), applied to new systems, changed systems, new operational procedures, and problems found by safety assurance (5.51). It also covers passing a hazard to an outside party who could address it (5.57). This is procedure text: how the organization does the work, not the result of any one assessment.
- Safety assurance (subpart D)
- The monitoring and measurement processes in 5.71: monitoring and auditing operations, investigating incidents and reports of non-compliance, and a confidential employee reporting system without reprisal. Then the assessment of safety performance against objectives (5.73) and the process for correcting what the assessment finds (5.75).
- Safety promotion (subpart E)
- Training for the people named in the accountability section (5.91), and the means of communicating safety information (5.93): that employees know the SMS policies and tools that touch their jobs, that hazard information reaches them, and that they are told why safety actions and procedure changes were made.
Part 21 holders and applicants also owe an organizational system description (5.17): a summary of the aviation-related processes, the function and purpose of the products or services, the operating environment, and the people, equipment, and facilities involved. Their implementation plan (5.19) is built on it. The AC advises measurable safety objectives rather than slogans, so the documentation should point to where each objective is tracked.
Documentation and Records
The Manual Is Not the Evidence
Part 5 keeps two things apart. Section 5.95 is the documentation: the policy and the procedures that say how the SMS works. Section 5.97 is the records: the outputs of the system actually running. A manual can hold the first. It cannot replace the second, and the rule requires both.
- Outputs of safety risk management: kept as long as the control remains relevant to the operation.
- Outputs of safety assurance: kept at least 5 years.
- Training records for each individual: kept as long as the person is employed.
- Safety communications and hazard notifications: kept at least 24 consecutive calendar months.
Because retention runs by record type, it helps if the procedures name where each kind of output is stored and who owns it, instead of describing risk assessment in general terms only.
Among the Other Manuals
Where the SMS Documentation Lives
AC 120-92D says SMS documentation may be contained in a General Operations Manual or a Repair Station Manual, or in any other combination of documentation and manuals that suits the organization. It also says to point to the right place when a duty is documented elsewhere: for example, employee safety duties may sit in the safety manual or in another organizational document, as long as the SMS documentation says where to find them.
That makes the relationship a cross-reference problem. An operator's flight operations library and its maintenance documents (the aircraft maintenance program, and where it applies the operator maintenance manual) already describe procedures that safety risk management has to cover. For repair stations that adopt an SMS voluntarily, the repair station manual and quality control manual are the natural neighbors. For the European approach to organization manuals, see EASA MOE and CAME.
Two consequences follow. First, the AC says a change to a manual is a change to the organization's system and starts safety risk management, scaled to the change. Second, the AC says that when an operator needs a manual change as it implements an SMS, the change is submitted under the existing regulations and procedures, so SMS text in a controlled manual is revised like the rest of it. Good revision control matters more, not less.
Who Needs One
Who Must Comply, and By When
Section 5.1 lists the persons part 5 applies to. As of the eCFR text current to 3 November 2026, the dates are these.
- Part 121 air carriers
- Carriers with an SMS acceptable to the FAA on or before 28 May 2024 had to revise it to meet part 5 by 28 May 2025. Applicants on or after 28 May 2024 must have a compliant SMS (5.7).
- Part 135 operators and § 91.147 air tour operators
- Existing holders must develop and implement an SMS and submit a declaration of compliance to the FAA no later than 28 May 2027. Applicants on or after 28 May 2024 must meet part 5 as part of getting the certificate or Letter of Authorization (5.9). Organizations with a single pilot who does every safety function are excused from a listed set of provisions (5.9(e)).
- Certain part 21 holders
- Holders of both a type certificate and a production certificate for the same product, production certificate holders who are licensees of that type certificate, and type certificate holders who license others to build the product (5.1(d) to (g)). Existing holders owed an organizational system description and an implementation plan for FAA approval by 28 November 2024, with the SMS implemented by 28 May 2027 (5.11 and 5.15). Applicants have 36 months from submitting their plan (5.13).
For part 135 operators and air tour operators with a Letter of Authorization, the deadline is the first half of 2027. The declaration of compliance is signed by the accountable executive or another senior manager and states that the SMS has been developed and implemented. Confirm every date against the current rule and your own certificate management office.
FAQ
Questions We Hear
Does 14 CFR part 5 require an SMS manual?
No. Section 5.95 requires two things to be developed and maintained: the safety policy, and the SMS processes and procedures. AC 120-92D (paragraph 3.7.1.3.1) says part 5 does not require an SMS manual, and that larger organizations are likely to have one while smaller ones might use a compliance statement or a spreadsheet listing the part 5 requirements and how the organization meets them. Read the rule text and your certificate management office's expectations before choosing a format.
Can the SMS documentation sit inside another manual?
Yes. AC 120-92D says SMS documentation may be in hard copy or electronic form and may be contained in a General Operations Manual or a Repair Station Manual, or any other combination of documentation and manuals appropriate to the organization. The AC's test is that, however it is kept, it stays up to date, and that a distribution system gets changes to the people who use them. The AC is guidance, an acceptable means and not the only one.
Does a part 145 repair station need an SMS under part 5?
Part 5 applies to the certificate holders and applicants listed in section 5.1, and part 145 repair stations are not on that list. AC 120-92D says a voluntary SMS can be used by other organizations that want FAA acknowledgement of one meeting part 5. If a repair station works for an operator that must comply, the operator's requirements may reach it through the contract, so read the text of yours.
Does updating a manual trigger safety risk management?
AC 120-92D says yes in principle: the manual is part of the organization's system, so a change to it starts the process. How much of the process is needed depends on the change. Its own example is an organizational chart update, which may only need the system described and a record that no hazards were found. Section 5.51 applies risk management to new systems, revised systems, and the development of operational procedures.
What records does an SMS have to keep?
Section 5.97 sets retention by type. Safety risk management outputs are kept as long as the control stays relevant. Safety assurance outputs are kept at least 5 years. Training records are kept while the individual is employed. Communications under 5.93 and hazard notifications under 5.57 are kept at least 24 consecutive calendar months. These are records of the system running, and they are separate from the documentation in 5.95.
Get In Touch
Questions About Your Manuals?
If you are mapping your operations and maintenance documents, send us a description of what you have. We will tell you whether we can help.