14 CFR Part 5 · Declaration of Compliance due 28 May 2027
FAA Part 5 SMS software for Part 135 and air tour operators
Confidential hazard reporting, risk management on the FAA 5×5 matrix, and an evidence trail you can hand an inspector — without a $15,000 consultant.
No card required. We’ll ask what certificate you hold and where your implementation plan stands, then show you the parts that matter to you.
Built for the operators the rule covers
7 months until the Declaration of Compliance is due.
14 CFR Part 5
Every module maps to a subpart of the rule
AC 120-92D
Standard FAA 5×5 risk matrix, seeded ready to use
4 pillars, 12 elements
Policy, risk management, assurance, promotion
Built for small operators
Single-pilot operations are in scope, not an afterthought
Your implementation plan is approved. Now you have to run the SMS.
Implementation plans went to the FAA in November 2024. A plan describes the system you intend to operate. The Declaration of Compliance asks you to prove you have been operating it — and that is where most small operators are stuck.
Where operations get caught
Hazards live in email and hallway conversations
Nothing is timestamped, nothing is assessed, and none of it survives a records request.
Risk decisions were never written down
You mitigated the hazard. But without an initial and a residual score you cannot show what the control achieved.
Crew won't report if their name is attached
Without a confidential channel, the reports that matter most never get filed.
A consultant built the manual and left
A $15,000–$50,000 engagement produces documents. It does not produce the operating record Part 5 asks for.
What this platform does about it
Every hazard gets a record and a clock
Reports carry tail number, ICAO code, aircraft type and a UTC timestamp from the moment they are filed.
Initial and residual risk, both recorded
Score on the FAA 5×5, apply controls, set a validation window, and get reminded when it closes without a residual assessment.
Anonymous reporting, and redaction on export
Crew can file without a name. Exports strip reporter names and tail numbers in one click.
A system you operate, not a binder you own
$99–$599 a month, and the record builds itself as you use it.
What you actually get
Four things a Part 5 inspector will ask you to produce
Reports you can trust, risk decisions you can defend, evidence you can hand over, and access you can grant without handing over the keys.
Safety risk management · § 5.51–5.55
Confidential hazard and incident reporting
Accidents, incidents, hazards, near misses, voluntary reports and QA findings — each with the aviation fields you actually need: tail number, ICAO airport code, aircraft type, and an occurrence time captured in both local and UTC.
- Anonymous submission for crew who will not file under their own name
- A dedicated reporter portal, separate from the safety manager's view
- Contributing-factor tagging across human, technical, environmental, organisational, procedural and communication factors
- A defined lifecycle from draft through submitted, claimed, under review, monitoring and closed
Safety risk management · AC 120-92D
Risk assessment on the standard FAA 5×5 matrix
The matrix from AC 120-92D is seeded and ready. Likelihood times severity, banded into acceptable, acceptable with controls, and unacceptable — the language your inspector already uses.
- Initial and residual risk recorded separately, so a control's effect is visible
- Control validation periods with a defined start date and review window
- Automated reminders when a validation window closes without a residual assessment
- Three honest hazard outcomes: resolved, controlled with monitoring, or uncontrollable
Safety assurance · § 5.71–5.75
Audit-ready exports with one-click redaction
Export safety reports and their assessments to PDF over any date range — with reporter names and tail numbers redacted by default. Just culture and audit evidence stop being in tension.
- Redaction of reporter identity is on by default, not an option you have to remember
- Tail-number redaction as a separate toggle for de-identified trend sharing
- Delivered through short-lived presigned links, scoped to your organisation
Oversight & access control
A read-only portal you can give the FAA
Four separate portals — reporter, safety manager, administrator, and a regulator view that can read safety reports and a compliance snapshot but cannot change or delete anything.
- Passwordless sign-in via WorkOS: six-digit email codes, no passwords to leak
- Role-based access across seven roles, every record scoped to your organisation
- The FAA oversight portal is available on the Enterprise tier
14 CFR Part 5, subpart by subpart
Where each requirement is satisfied
Four pillars, twelve elements. Below is what carries each one, and what is still being built — because you will be asked this in an evaluation, and a vague answer costs more than an honest one.
Safety Policy
§ 5.21 – 5.27
Safety policy & management commitment
Versioned safety policy documents with a draft, review, approval and publication workflow, and a recorded approval trail carrying the approver, role and timestamp.
Accountable executive & safety accountabilities
A designated accountable executive with a recorded designation date, and seven distinct roles across four portals.
Emergency preparedness & response
Versioned emergency response plans with the same approval workflow, and a current-version endpoint that always serves the live document.
SMS documentation & recordkeeping
Document library, per-record status history, and dated PDF export of reports and assessments.
Safety Risk Management
§ 5.51 – 5.55
Hazard identification
Six report types with aviation-native fields, anonymous submission, attachments, and a dedicated reporter portal.
Safety risk assessment
Standard FAA 5×5 matrix from AC 120-92D, scoring likelihood × severity into three defined acceptance bands.
Safety risk control
Existing controls, planned actions and mitigation steps recorded per hazard, with a named responsible party and a residual risk score.
Management of change
Not yet implemented. Currently handled by raising a hazard against the proposed change.
Safety Assurance
§ 5.71 – 5.75
Safety performance monitoring & measurement
Live dashboards for open, unclaimed and overdue reports, hazards pending assessment, and high initial versus residual risk counts.
Control validation
Validation periods per control, with automated reminders when a window closes without a residual assessment being recorded.
Trend analysis
AI trend-tagging classifies free-text reports against a fixed aviation taxonomy, and tags become dashboard filters. A weekly digest summarises patterns each Friday.
Continuous improvement & internal evaluation
In development. The Audit Center is currently a preview and its readiness score is not yet live.
Safety Promotion
§ 5.91 – 5.97
Safety communication
Safety, alert and training bulletins across four priority levels, delivered to the dashboard and by email, with expiry and automatic archiving.
Evidence of receipt
Per-user acknowledgment tracking with a timestamp, and a notification when an organisation reaches full acknowledgment.
Competency & training records
Not implemented. Training material can be distributed as bulletins and documents, but there is no training record or competency matrix yet.
Items marked with a clock are on the roadmap and are not billed as available today. Ask us for current timelines.
From first call to a defensible record
We set the system up with you. You run it. The evidence accumulates as a by-product of doing the work.
Tell us where you stand
Certificate type, fleet and headcount, and whether your implementation plan is drafted, submitted or FAA-approved. We configure your organisation and safety profile around that, rather than handing you a blank system.
Stand up the framework
Your safety policy and emergency response plan go in with an approval trail. The FAA 5×5 matrix is already seeded. Crew get reporter accounts; your safety manager gets the assessment queue.
Operate it, and keep the record
Hazards come in and get assessed. Controls get validation windows and the system chases them. Bulletins go out and acknowledgments come back. When you prepare your Declaration, the evidence is already there to export.
Security, described plainly
Safety reports are among the most sensitive records an operator holds. Here is exactly how they are protected — no certifications claimed that we do not hold, and no adjectives standing in for detail.
Reviewing us for a security questionnaire? Ask for our security overview and we will answer specifics in writing.
Passwordless authentication
Sign-in is handled by WorkOS using six-digit codes sent to a verified email address. No passwords are stored, so there are none to leak or reuse.
Role-based access control
Seven roles across four separate portals. The FAA oversight portal is read-only by construction and cannot edit or delete any record.
Per-organisation data scoping
Every tenant record carries an organisation identifier, enforced in policies and in every query that reads them.
Encrypted in transit and at rest
TLS for all traffic; cloud-provider managed encryption for stored data and documents.
Short-lived document links
Uploaded documents and generated exports are served through presigned URLs that expire in five minutes and are checked against the requesting organisation.
Recorded status history
Safety reports, bulletins and approvals keep a status history with the actor and timestamp behind each transition.
Priced for the operators the rule actually covers
A two-aircraft Part 135 operator is under the same mandate as a fleet of forty. The pricing reflects that.
Consultant-led implementation: $15K–$50K · Clear Approach: from $99/mo
Sole Operator
Single-pilot and single-aircraft Part 135 or § 91.147 operations.
- Full SMS framework, FAA Part 5 compliant
- Onboarding Assistance
- Standard FAA 5x5 risk matrix and hazard reporting
- 5GB document storage
- Streamlined interface catered to sole-operators
Essential
Small Part 135 flight departments and air tour operators.
- Full SMS framework, FAA Part 5 compliant
- Onboarding Assistance
- Standard FAA 5x5 risk matrix and hazard reporting
- 25GB document storage
- Employee Bulletin Board
- Customer Support
Enterprise
Multi-base operators who need FAA oversight access and deeper reporting.
- Everything in Essential
- FAA oversight portal with read-only safety report access
- Unlimited users across your organization
- 100GB document storage
- Priority support and custom onboarding
Sole Operator and Enterprise are not open yet — join the waitlist and we will tell you honestly when they are. Essential is available now and is onboarded by hand, which is why we ask for a call first.
Questions operators actually ask
Starting with the one most vendors get wrong.
Which operators does the FAA Part 5 SMS rule actually apply to?
The final rule published on 26 April 2024 extends 14 CFR Part 5 to all Part 135 certificate holders, commercial air tour operators holding a letter of authorization under section 91.147, and certain Part 21 type and production certificate holders. It applies to every Part 135 operator regardless of size, including single-pilot and single-aircraft operations. Part 145 repair stations were considered but excluded from the final rule, and general Part 91 operations were never in scope.
When is the FAA Part 5 deadline?
Part 135 and section 91.147 operators must have a fully implemented SMS and submit a Declaration of Compliance to the FAA no later than 28 May 2027. The earlier milestone, submitting an SMS implementation plan for FAA review, fell on 28 November 2024.
Our implementation plan is already approved. What do we do now?
An approved implementation plan describes the SMS you intend to run. The Declaration of Compliance requires evidence that you are actually running it: hazards reported and assessed, risk decisions recorded with initial and residual scores, controls tracked to validation, policies approved and distributed, and records you can produce on request. That day-to-day execution and evidence trail is what this platform is built to carry.
What does the platform actually do?
Confidential and anonymous hazard, incident, accident and near-miss reporting with aviation-native fields for tail number, ICAO airport code and aircraft type. Risk assessment on the standard FAA 5x5 matrix from AC 120-92D, tracking initial through residual risk with control validation periods and automated reminders. Versioned safety policy and emergency response plan documents with a recorded approval trail. Safety bulletins with per-user acknowledgment tracking. Audit-ready PDF exports with one-click redaction. A read-only FAA oversight portal and separate portals for reporters, safety managers and administrators.
Can crew report something without their name being attached?
Yes. Reports can be submitted anonymously, and reports that are not anonymous can still be exported with the reporter name and tail number redacted in a single click. Confidential reporting is a Part 5 expectation and a prerequisite for the kind of just culture that gets hazards reported in the first place.
How does the risk matrix work?
The standard FAA 5x5 matrix from AC 120-92D, seeded ready to use. Likelihood and severity are each scored one to five and multiplied. A score of 15 to 25 is unacceptable and requires immediate corrective action, 5 to 14 is acceptable with controls and requires a management decision, and 1 to 4 is acceptable as is. Every hazard carries both an initial and a residual risk score, so you can show an inspector what a control actually achieved.
Can we give the FAA access to our safety data?
Yes. There is a dedicated read-only oversight portal that exposes safety reports and a compliance snapshot without granting any ability to edit or delete. It is available on the Enterprise tier.
How is our safety data secured?
Passwordless authentication through WorkOS using six-digit email codes, so there are no passwords to compromise. TLS in transit and cloud-provider managed encryption at rest. Role-based access control across four separate portals, with every record scoped to your organization. Document downloads are served through short-lived presigned URLs.
How much does it cost compared with a consultant?
Consultant-led SMS implementations for small operators typically run from fifteen to fifty thousand dollars, and generally leave you administering the resulting programme by hand. Plans here start at $99 per month for a sole operator and $299 per month for a small flight department.
Can we export our data?
Yes. Safety report and assessment data exports to PDF over any date range, with optional redaction of reporter names and tail numbers, for audit preparation, regulatory submission and your own records.
7 months until your Declaration of Compliance
Twenty minutes is enough to see whether this fits your operation. We will ask what certificate you hold and where your implementation plan stands, and show you the parts that matter to you.