From Recommendation to Mandate: What the FAA's 2024 SMS Final Rule Really Demands of Small Operators

In April 2024, the FAA published its long-awaited Safety Management Systems final rule, extending 14 CFR Part 5 beyond Part 121 airlines to Part 135 on-demand and commuter operators, §91.147 commercial air tour operators, and certain Part 21 design and manufacturing organizations. Effective May 28, 2024, the rule gives Part 135 operators until May 28, 2027 to file a Declaration of Compliance. It is the fulfillment of a call the NTSB has made since 2007 — and the moment U.S. commercial aviation moved from recommending SMS to requiring it.

The framework itself is familiar: Safety Policy, Safety Risk Management, Safety Assurance, and Safety Promotion — the four pillars ICAO Annex 19 established over a decade ago. What changed is the audience. Thousands of small Part 135 operators, many of which have never operated a formal SMS, must now build one.

With more than a decade on the front lines of airline safety and operational control — including organizing the development of an airline SMS and leading its continuous improvement, as well as directing unsafe-event investigations and operational safety monitoring — I see the real challenge of this rule not on paper, but in implementation.

First, the deadline is tighter than it looks. A Declaration of Compliance due in May 2027 means a functioning system must exist by then — not a project plan. From gap analysis to manual writing, from standing up a risk-management process to training the workforce, a small-to-mid-size operator needs at least 12 to 18 months — and that assumes management already understands the difference between a system and a binder of documents. With the May 28, 2027 deadline now months away, operators that have not started are already behind — a functioning system, not a project plan, is what the date demands.

Second, Safety Assurance is where SMS most often becomes theater. Many operators can produce a manual; far fewer can sustain operational safety monitoring — where the data comes from, who analyzes it, and who acts when it reveals drift. Those three questions unanswered, and the SMS is paper. Years of running safety monitoring and investigation programs taught me this: without a stable event-reporting culture and real analytical capability, risk management has no source to draw from. The FAA's alignment of the voluntary SMSVP with Part 5 reads as recognition of exactly this problem — systems that existed on paper but never operated.

Third, the single-pilot exceptions in §5.9(e) show pragmatic rulemaking. The FAA acknowledged that imposing a full organizational apparatus on a one-person operation is neither realistic nor meaningful, and tailored the requirements accordingly. Scalability is the key insight for small operators: SMS was never meant to be a big-airline luxury. What matters is proportionality to the scale of the operation.

Fourth, the rule creates genuine demand for advisory services. Thousands of operators must build SMS from nothing within 36 months, and most lack both the methodology and the bench depth in-house. Consultants who understand operations, understand the system, and can turn a manual into daily practice will be among the scarcest resources in this compliance wave.

In the end, the significance of this rule is not a new concept. It is the extension — by regulation — of proven safety management methods across the whole of commercial aviation. For practitioners, the question is no longer whether to build an SMS. It is whether you can build one that actually works before May 2027.