FDM & FOQA Regulatory Requirements

With several aspects handled in appropriate way the aircraft operator can rely on respectable flight safety:

• ICAO Annex 6 Part I (International Commercial Air Transport – Aeroplanes) contains a Standard requiring an operator of an aeroplane of a maximum certificated take-off mass (MCTOM) in excess of 27 000 kg to establish and maintain a flight data analysis programme as part of its safety management system (this concept is encompassed by the Management System described in ORO.GEN.200).
• Amendment 49, applicable 28 November 2024, lowered the corresponding Recommended Practice to aeroplanes of a certificated take-off mass exceeding 15 000 kg, and added a Standard extending the programme requirement to aeroplanes above 15 000 kg with a passenger seating capacity greater than 19 whose certificate of airworthiness is first issued on or after 1 January 2027.
• ICAO Annex 6 Part III (International Operations - Helicopters) contains a Recommended Practice recommending a FDM programme for operators of helicopters of an MCTOM exceeding 7 000 kg or a passenger seating configuration of more than 9.
• ICAO Annex 19 (Safety Management) contains provisions on the implementation of a Management System and of a State safety oversight system.

Air operation rules

• Paragraph ORO.AOC.130 of Commission Regulation (EU) 965/2012, Annex III (Part ORO) contains the implementing rule requiring an FDM programme for aeroplanes with an MCTOM of over 27 000 kg and operated for commercial air transport.
• Commission Regulation (EU) 965/2012 is applicable in all EASA Member States since 29 October 2014.
• AMC1 ORO.AOC.130 of EASA Executive Director (ED) Decision 2012/017/R contains acceptable means of compliance for the implementation of paragraph ORO.AOC.130 of the implementing rules.

Flight Data Monitoring for Alternative Training and Qualification Programmes

• Operational requirements applicable to an Alternative Training and Qualification Programme (ATQP) are laid down in Commission Regulation (EU) 965/2012, Annex III (Part ORO), paragraph ORO.FC.A.245.
• An acceptable means of compliance is provided by EASA ED Decision 2012/017/R, AMC1 ORO.FC.A.245.
• Under the AMC applicable until 31 December 2027, FDM data collection should reach a minimum of 60% of all relevant flights conducted by the operator before ATQP approval is granted. Both this figure and the 80% figure for an advanced FDM programme are removed from 1 January 2028, when AMC1 ORO.FC.A.245 instead points to the FDM programme specified in AMC1 ORO.AOC.130.
• An advanced FDM programme is required when an extension to the ATQP is requested.

Flight Data Monitoring for the serviceability of a flight data recorder

• Commission Regulation (EU) 965/2012, Annex IV (Part CAT) contains in paragraph CAT.GEN.MPA.195 a requirement that the aircraft operator maintains the serviceability of the flight recorders through operational checks.
• Acceptable means of compliance are provided by EASA ED Decision 2012/018/R paragraph AMC1 CAT.GEN.MPA.195. This paragraph recommends an annual inspection of the FDR recording, however in the case where the aircraft is subject to an FDM programme this could be relaxed. For this alleviation to be acceptable, the data source of FDR mandatory flight parameters and of FDM data should be the same, the FDR should be fitted with reliable built-in-test equipment (most solid-state FDRs are, but magnetic tape FDRs are not) and the integrity of the FDR mandatory flight parameters should be monitored by the FDM programme.
• Hence, under certain conditions, an FDM programme can be an acceptable substitute for the annual inspection of the FDR recording.

EASA ED Decision 2025/020/R of 2 December 2025, “Enhanced implementation of flight data monitoring (FDM) programmes”, rewrites the acceptable means of compliance for ORO.AOC.130. The binding rule itself is unchanged, but from 1 January 2028 the AMC sets out in far more detail what an FDM programme is expected to do. The current AMC remains applicable until 31 December 2027, so every affected paragraph is published twice — once for each period.

Operators have until the end of 2027 to adapt, and EASA's own rationale for the two-year lead time is that implementation typically requires procedural changes, software updates and, where crew data is involved, revised agreements with flight crew representatives.

• The new AMC1 ORO.AOC.130 replaces the current text and is accompanied by a new AMC2 ORO.AOC.130 covering the scope of what should be monitored.
• AMC1 ORO.FC.A.245 (ATQP) stops naming its own data-collection percentages and instead refers to the FDM programme specified in AMC1 ORO.AOC.130.
• The requirement that crew identity be protected through a documented, signed procedure agreed with flight crew representatives is retained.
• Offshore helicopter operations under SPA.HOFO.145 continue to follow the same FDM means of compliance.

Where to read the source

• EASA ED Decision 2025/020/R — the decision and its annexes.
• EASA Easy Access Rules for Air Operations — the consolidated text, showing both the until-2027 and from-2028 versions of each paragraph.
• Commission Regulation (EU) No 965/2012 on EUR-Lex — the binding rule, including ORO.AOC.130.

• UK CAA CAP 739 “Flight Data Monitoring” (Second Edition, June 2013, still listed as current) remains the most detailed practical guidance published by any authority on planning, introducing and running an FDM programme, including the organisation and control of FDM information.

Federal Aviation Administration (FAA)

• The United States does not mandate FOQA for commercial operators. 14 CFR § 13.401 is a protection rather than a requirement: titled “Flight Operational Quality Assurance Program: Prohibition against use of data for enforcement purposes”, it shields data from an approved FOQA programme from being used in enforcement action.
• FAA Advisory Circular 120-82 “Flight Operational Quality Assurance” (12 April 2004, still active) describes how to establish and operate a voluntary FOQA programme.
• The FAA approach is quite prescriptive, and some operators may wish to implement FOQA in a way that better suits their organization without adopting the I&O plan required by the FAA, in which case they can operate their voluntary process without adopting all these regulations.

Part 119 Air Operator Certification

• 119.61 Flight data analysis
• (a) An operator shall establish and maintain a flight data monitoring system, which shall be integrated in the management system:
• (1) for aeroplanes with a MTOM of more than 20,000 kg; and
• (2) for helicopters with a MTOM of more than 7,000kg or having a MAPSC of more than 9.
• (b) The flight data monitoring system shall be non punitive and contain adequate safeguards to protect the source(s) of the data.

IOSA is not a regulation. It is IATA's audit standard for airline operational management, a condition of IATA membership, and the accepted standard for codeshare, wet-lease and charter due diligence. According to IATA, 449 airlines were on the registry in May 2026, 94 of them not IATA members, and the FAA uses IOSA when approving non-US codeshare partners, EASA in its third-country operator authorisation. Registration runs for 24 months.

The IOSA Standards Manual covers flight data analysis in section ORG 3.3. A Standard says “shall”: nonconformity is a Finding that blocks registration.

• ORG 3.3.1 (Standard) — an operator flying aircraft above 27,000 kg maximum certificated take-off mass shall have a flight data analysis programme with systematic download and analysis of recorded flight data from the applicable aircraft. The programme shall be non-punitive and integrated in the SMS. (Edition 16 wording; Edition 18, 2026, aligned the thresholds with ICAO Annex 6 Amendment 49.)
• ORG 3.3.2 (Recommended Practice) — the same programme should extend to aircraft above the lower ICAO threshold.
• ORG 3.3.3 — the programme shall have processes for data interpretation and analysis; flight crew liaison, including who may hold confidential discussions with crew (the gatekeeper); data collection representative of all operations per fleet type; dissemination of de-identified information; and training.
• ORG 3.3.4 — standards for data management and protection: integrity and validity of downloaded data, de-identification and confidentiality, event and exceedance trending, retention and archiving, and continuous improvement.
• ORG 3.3.5 — findings shall be coordinated within the SMS: hazard identification and risk assessment, event investigation, and continuing airworthiness.
• The guidance allows programme processes to be outsourced to a service provider, with the operator remaining responsible for the programme.

To conform, each specification must be documented in a controlled manual and implemented in practice; an auditor checks both. IOSA applies to operators of multi-engine, two-pilot aircraft above 5,700 kg; business aviation operators use IBAC's IS-BAO, which has its own flight data analysis section (3.6).

Where to read the source

• IATA — IOSA Standards Manual — the current edition and its change notes.
• IATA — Safety audit programmes fact sheet (June 2026) — registry size, who uses IOSA, the risk-based model.