What is Part-IS (EU 2023/203) and who is affected?
Last updated: 2026-08-19 · Complyx Systems AB
Part-IS is the EU framework for managing information security risks with a potential impact on aviation safety, set out in Implementing Regulation (EU) 2023/203 and Delegated Regulation (EU) 2022/1645. Affected organisations must implement an information security management system (ISMS) covering risk assessment, incident handling, roles, training and continuous improvement.
Who is in scope
- Aerodrome operators and apron management service providers
- ATM/ANS providers and their design organisations
- Air operators, training and maintenance organisations as specified in the regulations
- Competent authorities, which oversee compliance
Core ISMS requirements
- Information security policy and assigned responsibility
- Identification of assets and interfaces with safety relevance
- Risk assessment and treatment with defined acceptance criteria
- Supplier and subcontractor management
- Detection, reporting and handling of information security incidents
- Competence and training
- Internal audit, management review and continuous improvement
Demonstrating compliance
Each IR requirement, with its applicable AMC, must be traceable to concrete evidence: a chapter in a manual, a documented procedure, a risk assessment or an audit record. The common failure is not the absence of controls but the absence of a documented link between requirement and evidence.
Frequently asked questions
Is Part-IS the same as NIS2?
No. NIS2 is a general EU cybersecurity directive; Part-IS is aviation-specific and focuses on information security risks affecting aviation safety.
Do we need ISO 27001?
No. An existing ISMS can be reused, but Part-IS requirements must be demonstrated against the IR and AMC.
Sources
- Kommissionens delegerade förordning (EU) 2022/1645 och genomförandeförordning (EU) 2023/203
- EASA – Information Security (Part-IS)
About ComplyxIQ
ComplyxIQ is an AI-supported compliance system from Complyx Systems AB for the aviation industry: requirement breakdown against EASA and ICAO, pedagogical requirement explanations, risk-based audit planning and traceable findings management. All data is stored within the EU and decisions always remain with your experts.