Managing evolving ATM regulations while maintaining service continuity
With almost 10 million passengers flying around the world in 2025 alone, regulation is essential for ensuring the safety, efficiency and reliability of our skies, and is the main reason why aviation remains the safest mode of transport.
Keeping up to date involves significant organisational and technical complexity for Air Navigation Service Providers (ANSPs), system manufacturers and suppliers. While the aviation sector has made significant progress towards harmonised operations and common standards in the last twenty years, the regulatory landscape continues to evolve rapidly. What’s driving this change? Key factors include: more air traffic, increased automation, digital transformation, the integration of drones, defence activities and new airspace users. Add to this, new requirements linked to SESAR deployment, cybersecurity, SWIM, U-space, equipment certification and software assurance. These developments are transforming how ATM systems and services are designed, operated and maintained, and therefore, the regulatory landscape.
A complex regulatory framework
Through regulatory compliance assignments with more than 15 aviation organisations, Egis has a strong understanding of the strategic, operational and technical challenges our clients face. We have supported clients in relation to all of the following initiatives, regulations and frameworks.
- SES2+ (Single European Sky 2)
Affects: ANSPs, airports, aircraft operators, Network Manager, regulators
Why it matters: Modernises and harmonises European ATM governance and performance
- CP1 (Common Project 1)
Affects: ANSPs, airports, airspace users
Why it matters: Mandates deployment of key SESAR ATM functionalities by 2027
- Part-IS
Affects: ANSPs, ATM/ANS service providers, aerodromes, airlines, maintenance organisations, training organisations, and other approved/certified aviation organisations subject to EASA Part-IS
Why it matters: Integrates cybersecurity into ATM safety and compliance frameworks.
- EU Regulation 2017/373
Affects: ANSPs and competent authorities
Why it matters: Defines certification and oversight requirements for ATM/ANS service providers.
- EU Regulation 2023/1769 (DPO)
Affects: ATM/CNS system manufacturers and developers
Establishes approval requirements for Design and Production Organisations.
- EU Regulation 2023/1768 (CAGE)
Affects: ATM/ANS equipment manufacturers and suppliers
Introduces certification requirements for ATM/ANS ground and space-based equipment.
- EU U-space regulatory framework (Regulations 2021/664, 2021/665 & 2021/666)
Affects: U-space service providers, ANSPs, drone operators and aviation authorities
Establishes the European framework for integrating drones safely into U-space airspace and ATM.
- EUROCAE ED-109A
Affects: ATM/CNS system suppliers, software developers, ANSPs
Defines software assurance requirements for safety-critical ATM systems
A dynamic regulatory environment and continuous change management
For ANSPs and system manufacturers, maintaining compliance means continuously managing change while ensuring operational continuity, safety and regulatory alignment throughout the system lifecycle.
The challenges are wide-ranging:
- A heavy operational workload: Maintaining compliance requires dedicated resources for regulatory monitoring, technical adaptations, documentation and record-keeping, safety reporting, audits, and implementing corrective actions. For many organisations, compliance activities span multiple departments and continue long after systems have entered service.
- Cost and resources: Regulatory compliance also represents a significant long-term investment. Organisations must allocate skilled personnel, specialised tools, training, and engineering effort to maintain compliance over decades of system operation.
- Demonstrating compliance: Aviation organisations must produce objective evidence that compliance has been achieved. For example, during a DPO and CAGE compliance review for the Belgian ANSP skeyes, Egis assessed documentation and processes to evaluate audit readiness. The exercise demonstrated the importance of robust traceability and efficient evidence retrieval in supporting regulatory oversight, identifying improvement opportunities and facilitating ongoing certification activities.
- Coordinating multiple stakeholders: Misalignment between stakeholders can introduce delays, additional costs, and increase compliance risks. Through projects such as ESSP's IRIS certification programme and InnovATM's USSP approval process, Egis has acted as a bridge between technology providers and regulatory authorities, facilitating technical exchanges, aligning compliance approaches and supporting efficient certification outcomes.
- Integrating compliance into system engineering: For manufacturers and suppliers, regulatory requirements must be embedded into the system engineering process from the earliest design stages. Compliance considerations influence requirements engineering, software development, verification and validation, configuration management, and lifecycle support. Addressing compliance late in a project often leads to costly redesigns and schedule impacts.
- Governance and compliance management: Organisations must remain prepared for internal audits, customer assessments, and regulatory inspections by ensuring documentation, processes, and evidence remain current. Sustaining this level of readiness requires disciplined governance and continuous compliance management.
