How prepared are we to keep the world moving when a disruptive event occurs? This two-part series explores how Air Traffic Management (ATM) and airports as an industry1 can enhance business continuity, and also considers the balance between investments made and the costs associated with disruptive events. This first part examines the status of business continuity provision within the industry and reflects on the wider socio-economic costs of disruption.
The current state of business continuity
Air travel is becoming increasingly accessible worldwide, placing greater pressure on existing systems (comprised of people, processes and technology) designed for a different era. With the industry already operating near capacity, even small disruptions can trigger domino effects leading to widespread delays and cancellations. Rising risks, including cyber threats and geopolitical tensions, as well as extreme weather, make such disruptions more likely. To keep pace with evolving demands, systems must be not only safe but also resilient.
The industry stands at a technological crossroads. A new generation of systems is on the horizon, promising increased capacity and a more standardised, globally interoperable future. This forthcoming shift brings both exciting opportunities and new risks. A key advantage is the move away from legacy system architectures, towards contemporary IT-style systems. This has many benefits, such as containerisation bringing flexibility and resilience, and exception handling enabling graceful degradation in the event of errors.
Modern systems also support the separation of data from the applications that use it. From a business continuity perspective, this is critical. If an application server fails, no data is lost, enabling redundant application servers to support a rapid return to normal or even seamless continuity of operations. This matters more than in most industries because dynamic safety-critical information, like flight data, must remain current to ensure safe operations. In business continuity terms, this means a very low duration Recovery Point Objective2 (RPO) to minimise disruption.
So, the good news is that the new generation of systems will make it easier to preserve, recover and transfer up-to-date data, strengthening system resilience and the ability to continue the operation as normal when a system disruption occurs.
With modernisation comes new risks
While these modern systems bring major benefits, they also introduce new risks due to the multiple, distinct technological layers that they rely upon. Without holistic coordination across the industry, the underpinning technologies adopted across the sector could inadvertently become single points of failure, ‘hiding’ within the design of multiple different systems. This could make global disruptions to the industry, such as the July 2024 CrowdStrike outage, more likely and widespread. What’s more, the increased standardisation in modern systems could mean the industry becomes more susceptible to wider IT supply chain vulnerabilities, such as the current under-supply of RAM and GPUs in the face of demands from the AI boom.
Business continuity is a strategic goal across many industries. For example, social media platforms have pioneered modern IT architecture specifically to support their continuity requirements. However, our industry has subtly different needs: predictability takes precedence over flexibility. If a social media platform experiences a brief spike in latency as its systems automatically adjust to changing demand, the impact is minimal. In contrast, a spike in latency for surveillance data within our field could present a significant safety issue. Additionally, the volume of data we process is generally stable, eliminating the necessity for automatic scaling. Given the safety-critical nature of our operations, we require absolute confidence not only in the technology itself, but also in the competence of the people operating it, and the rigour of the processes they follow. Therefore, our industry requires a bespoke approach to business continuity planning, which carefully considers the adoption of new IT architectures within the context of the users and engineers who interface with them.
Building on the industry’s approach to safety
The industry’s safety-related procedures, processes and technical capabilities are relatively mature, shaped by decades of lessons learned. Business continuity has not benefited from the same top-down momentum. There is no coordinated regulatory approach or institutional framework to drive progress on business continuity, and industry benchmarks and best practices remain limited. As a result, stakeholders make largely individual decisions and provision varies widely.
Through our work supporting industry players small and large, we have seen this at close hand. Some ANSPs/airports have minimal business continuity capability, relying mainly on contingency arrangements that maintain safe operations but with limited ability to quickly recover to normal operations. Others place more emphasis on business continuity, investing in fully independent redundant facilities and systems, supported by detailed procedures and extensive scenario-based training. This is often driven at the state level, depending on the importance placed on the aviation sector.
The cost of disruption
Because disruption costs ripple far beyond any single ANSP or airport, the value of business continuity investment is often underestimated when decisions are made in isolation. Without coordinated, top-down institutional support and regulatory incentivisation, investment in business continuity is fragmented across the industry. This ultimately magnifies disruption costs for passengers and the wider economy.
As described above, a disruptive event may not remain a localised challenge impacting an individual industry stakeholder; it can easily become a newsworthy crisis with far-reaching consequences. The examples below illustrate the costs of recent disruptive events and the ripple effects that they can have:
- In 2023, NATS’ flight planning system failed. The issue impacted both the primary and backup systems, which resulted in over 700,000 passengers being affected. The estimated cost to airlines was approximately £65m, whilst the wider economic costs incurred by passengers, airports, tour operators, insurers, and others were estimated to be in the region of £75m-£100m.
- In March 2025, the power supply to Heathrow Airport was compromised due to an electrical sub-station fire in the vicinity of the airport. The airport was closed for a day, which resulted in 1,300 cancelled flights and ~200,000 affected passengers. Over 120 aircraft that were en route to the airport were forced to either divert to other European airports or return to their point of origin. At the time, Heathrow’s CEO Thomas Woldbye estimated it would cost the airport “low tens of millions” of pounds. However, the wider economic impact was much more significant, for instance, IAG, the parent company of British airways estimated the disruption had cost it around £40m. Meanwhile, the indirect contribution of Heathrow to the UK’s wider economy is estimated to be approximately £13m per day, with approximately £540m of cargo handled each day.
- In October 2025, Sumburgh Airport in the Shetland Isles was forced to close after experiencing a total loss of surveillance due to cabling damage caused by ‘Storm Amy’. This had a significant impact on the local population, as the storm also halted ferry services, leaving the island completely cut off.
In the first month of 2026 there were a further three high-profile system failures across Europe.
- On 4th January, air travel across Greece was stopped after radio frequency systems collapsed which affected air traffic communications, forcing authorities to shut down the country’s airspace for safety reasons for most of the day.
- On 11th January, a radar outage caused by a power failure at a NATS radar site, caused Birmingham Airport to suspend arriving flights, causing 20 inbound flights to be delayed or diverted to other UK airports. Flights from Paris Charles De Gaulle and Amsterdam Schiphol were in the vicinity of the UK when they were turned back to their origin airports. Despite the power outage being resolved, there were also knock-on effects for the following day’s schedule, with crew and aircraft needing to re-position to the correct locations.
- On 27th January, a technical issue affected Geneva Airport, resulting in several delays and diversions to alternative airports. Some flights returned to their starting points, including a SAS flight from Copenhagen and a Lufthansa flight from Frankfurt.
These examples highlight the interdependent nature of the industry and the need for a holistic approach to business continuity provision that not only explores internal systems and procedures, but also relationships with external suppliers and providers of other critical national infrastructure. They also demonstrate the breadth of the business continuity issue and the scale of the costs already being incurred. As traffic levels continue to grow after rebounding quickly from the Covid-19 pandemic, disruption becomes increasingly difficult to absorb, leading to significant socio-economic costs. Effective business continuity provision is becoming a key issue for the industry to resolve to address the costs of disruption.
This concludes the first part of our two-part blog series. Ahead of the second instalment, Egis will be presenting on the topic at Airspace World in Lisbon this May, where our colleague Mark Green will explore how the ATM industry can strengthen business continuity, and the costs and benefits of doing so. We look forward to meeting you in Lisbon.
-----------------------------
1 Hereafter referred to as ‘the industry’
2 The RPO reflects the maximum tolerable age of data required to resume normal operations after a disruption
