How Airlines Are Regulated

National Aviation Authorities: The Regulatory Foundation

Every commercial airline in the world operates under the authority of a national aviation authority (NAA) — the government body responsible for implementing civil aviation regulations, certifying aircraft and operators, licensing personnel, and overseeing safety compliance. The names and structures of these bodies vary by country, but their fundamental role — translating international ICAO standards into domestic law and enforcing compliance — is universal.

The United States Federal Aviation Administration (FAA) is the world's largest and most influential aviation authority. Established in 1958 following a series of mid-air collisions that exposed gaps in airspace management, the FAA employs approximately 45,000 people, including thousands of safety inspectors and engineers. Its regulations — Federal Aviation Regulations (FARs) in Title 14 of the Code of Federal Regulations — are among the most detailed aviation regulatory frameworks in existence and serve as a reference model for many other countries.

The European Union Aviation Safety Agency (EASA) is the centralised aviation authority for the 27 EU member states plus several associated countries including Norway, Iceland, Switzerland, and Albania. Established in 2002 and headquartered in Cologne, Germany, EASA took over from national authorities the certification of aircraft designs (Type Certificates) and approval of maintenance organisations, while national authorities retained responsibility for airline oversight under EASA's oversight and rulemaking framework. The result is a coherent regulatory space across 30+ countries that is generally regarded as equivalent in rigour to the FAA's.

Other significant authorities include the UK Civil Aviation Authority (UK CAA, which separated from EASA following Brexit and maintains substantial regulatory equivalence), Australia's Civil Aviation Safety Authority (CASA), Transport Canada Civil Aviation (TCCA), Brazil's Agência Nacional de Aviação Civil (ANAC), Japan's Civil Aviation Bureau (JCAB), Singapore's Civil Aviation Authority (CAAS), and China's Civil Aviation Administration (CAAC). CAAC has grown dramatically in importance as Chinese aviation has expanded and is increasingly regarded as a peer regulatory authority to FAA and EASA by the international community.

Air Operator Certificates: The Core Operating Permission

No airline can legally operate a commercial air service without an Air Operator Certificate (AOC) — the primary regulatory document that authorises a specific company to conduct commercial air transport operations. The AOC is issued by the airline's home state aviation authority after a comprehensive process of documentation review, system inspection, and operational demonstration.

The AOC application process typically takes 12 to 24 months for a new entrant and involves multiple phases. First, the airline must demonstrate that it has adequate management structure: a qualified Accountable Manager with executive authority, and nominated post-holders for Flight Operations, Airworthiness (called the Continuing Airworthiness Manager or CAM), Ground Operations, and Safety (in safety management system frameworks). Each post-holder must demonstrate relevant experience and pass authority assessments.

Second, the airline submits its Operations Manual — a multi-volume document specifying exactly how every aspect of operation will be conducted, from how pilots compute performance calculations before takeoff to how the airline responds to in-flight emergencies. Authorities review these manuals in detail and require revisions before approving them. The Operations Manual is a living document that must be kept current and is subject to ongoing regulatory review.

Third, the airline must demonstrate that its aircraft are maintained under an approved Continuing Airworthiness Management Organisation (CAMO) system, that maintenance is performed by Part-145 (EASA) or Part 145 (FAA equivalent) approved maintenance organisations, and that its maintenance programme meets the aircraft manufacturer's requirements. Only then is an initial AOC issued, typically with conditions and a heightened level of inspection during the first 12 months of operation.

AOC holders are subject to ongoing surveillance — routine inspections, unannounced ramp inspections (similar to the EU's SAFA programme), and periodic major audits. Authorities can impose conditions, restrictions, or suspensions on the AOC if serious safety concerns are identified. The ultimate sanction — revocation of the AOC — effectively grounds the airline permanently.

Aircraft Airworthiness: How Planes Are Certified Safe

Aircraft airworthiness is maintained through a two-part system: the initial type certification of a new aircraft design, and the continuing airworthiness of each individual aircraft throughout its operational life. Both are regulated processes with defined regulatory authority over each step.

Type certification is the process by which a regulatory authority approves a new aircraft design for commercial operation. For a modern commercial transport aircraft, this process takes five to ten years and involves thousands of test flights, structural fatigue testing, systems redundancy verification, and flight crew certification. The FAA and EASA each issue their own Type Certificates; other authorities (CAAC, Transport Canada, CASA) typically validate foreign type certificates rather than conducting independent full certification reviews, though this is changing as major aviation countries develop more independent certification capability.

The Boeing 737 MAX recertification process following the 2018 and 2019 fatal accidents fundamentally changed type certification norms. The accidents, attributed to the MCAS (Maneuvering Characteristics Augmentation System) software interacting with novel flight characteristics in ways crews were not trained to counter, prompted the FAA to reform how it delegates certification authority to manufacturers, require independent review of safety-critical systems changes, and strengthen the communication of differences between aircraft variants to crews. EASA conducted a largely independent review and returned the MAX to service under conditions that differed in some respects from the FAA's.

Continuing airworthiness is maintained through mandatory maintenance programmes, Airworthiness Directives (ADs), and regular inspections. ADs are legally binding safety requirements issued by an authority when a safety deficiency is identified in a certificated product. If a manufacturer discovers a fatigue crack in a specific structural component after a certain number of flight cycles, the relevant authority issues an AD requiring all operators to inspect and rectify the deficiency by a specified deadline. ADs are published in a public register and can be searched by aircraft type or component.

Crew Licensing: How Pilots Are Qualified

Pilots flying commercial aircraft must hold specific licences and ratings issued by a national aviation authority after meeting defined training, experience, and medical standards. The core framework is established in ICAO Annex 1 (Personnel Licensing), with national authorities adding their own detailed requirements.

The basic progression for an airline pilot in most countries runs: Private Pilot Licence (PPL) — Multi-Engine Instrument Rating — Commercial Pilot Licence (CPL) — Airline Transport Pilot Licence (ATPL). The ATPL is the highest level of pilot certification and is required to serve as Pilot in Command on aircraft above a certain weight threshold (5,700 kg under EASA regulations, or aircraft certificated for more than nine passengers under FAA rules for Part 121 operations).

Beyond the basic licence, pilots must hold Type Ratings for each specific aircraft category they fly commercially. A type rating requires a specific training course — typically several weeks of ground school followed by full-flight simulator sessions and then actual flight checks under an examiner. Type ratings must be renewed through periodic simulator checks and proficiency demonstrations, typically every six months under EASA regulations and annually under FAA rules for the Proficiency Check requirement.

Medical standards for commercial pilots are defined in ICAO Annex 1 and implemented with national variations. Airline pilots require a Class 1 medical certificate, which demands higher standards than the Class 2 certificate for private pilots. Medical examinations assess cardiovascular health, vision (correctable to standard is permitted under most authorities), hearing, neurological function, and psychiatric health. Medical certificates must be renewed annually (biannually for pilots over 40 in many authorities).

Cabin crew are separately licensed and certificated. Cabin crew members on EASA-regulated aircraft must hold a Cabin Crew Attestation issued by the authority, requiring them to complete approved initial training on safety equipment, emergency evacuation, first aid, and security awareness. Recurrent training occurs annually. The FAA has equivalent requirements for Flight Attendant Certificates (required since 2003 for part 121 operators).

Flight Time Limitations: Protecting Against Fatigue

Fatigue is one of aviation's most persistently studied human factors hazards. Tired pilots have degraded reaction times, reduced situational awareness, impaired decision-making, and increased error rates. Regulatory frameworks globally impose limits on how many hours crews can fly, how much rest they must receive between duties, and how long cumulative fatigue can accumulate before mandatory rest periods reset the counters.

EASA's Flight Time Limitations (FTL) rules, enacted in Regulation (EU) No 83/2014 (EU-OPS), establish maximum flight duty periods (the time from when a crew member reports for duty to when they are released), maximum flight times, and minimum rest requirements. Key limits include: a maximum flight duty period of 13 hours for an early-start duty beginning after a full night's rest (shorter for night duties or disrupted rest); a maximum of 100 flight hours in 28 consecutive days; a maximum of 900 hours in a calendar year; and minimum rest of 11 consecutive hours between duties (extended in specific circumstances).

The FAA's Part 117 rules, enacted in 2013 following years of advocacy following the 2009 Colgan Air crash that killed 50 people (partly attributed to pilot fatigue), impose equivalent though not identical limits. Part 117 requires a minimum of 10 hours rest before a flight duty period, with at least eight hours of sleep opportunity. Cumulative limits include a maximum of 100 hours in 672 consecutive hours and 1,000 hours in a calendar year. Part 117 also applies FDP limits that vary based on the time of day operations begin, recognising that night duties are inherently more fatiguing than daytime operations.

Crew scheduling is managed by airline duty scheduling software that tracks legal limits for each crew member in real time. Dispatching a crew that would exceed regulatory limits is a violation subject to significant regulatory sanction. Airlines may apply for regulatory approval to operate enhanced rest programmes using scientific fatigue modelling tools — the FRMS (Fatigue Risk Management System) approach allows more flexibility than prescriptive rules in exchange for demonstrated scientific management of fatigue risk.

The Safety Oversight Ecosystem

Airline regulation extends beyond the AOC and flight time rules to encompass a layered ecosystem of safety oversight mechanisms. These include line operations surveillance (watching actual crew performance in flight), safety audits, ramp inspections, incident reporting systems, and collaborative safety databases.

The EU's SAFA (Safety Assessment of Foreign Aircraft) programme permits EASA member state authorities to conduct ramp inspections of foreign-registered aircraft landing at airports within the EU. Inspectors check airworthiness documentation, crew licences, flight and duty records, aircraft exterior condition, dangerous goods compliance, and safety equipment. If serious findings are made, aircraft can be grounded until rectification. SAFA inspection reports are shared across member states and published in aggregate, making the programme a significant check on airlines from countries with weaker regulatory oversight.

The FAA operates a similar Foreign Air Carrier Safety Assessment (FACSA) programme and can restrict foreign carrier operations to the United States if safety concerns are identified. More significant is the IASA (International Aviation Safety Assessment) programme, which assesses foreign aviation authorities (not individual airlines) against ICAO standards. A Category 2 finding against an authority effectively signals to US regulators that all airlines from that country may be operating below international standards.

Safety Management Systems (SMS), now mandatory for airlines under ICAO Annex 19, formalise the proactive side of airline safety. An SMS requires the airline to identify hazards before they cause accidents, assess and mitigate risks, measure safety performance using Key Performance Indicators, and continuously improve based on data. SMS integrates with voluntary safety reporting systems — including NASA's Aviation Safety Reporting System (ASRS) in the United States, which offers confidentiality protection for pilots who report errors or unsafe conditions in good faith.

EU and US Airline Banned Lists

When regulatory dialogue with a foreign aviation authority fails to achieve compliance with international safety standards, the most direct passenger-protective tool available to regulators is banning an airline's operations entirely. Both the EU and the United States maintain such lists.

The EU Air Safety List, maintained by the European Aviation Safety Agency and updated by the European Commission, lists airlines that are prohibited from operating in EU airspace and airlines that are permitted to operate only with specific operational restrictions. The list is published on the European Commission website and updated several times per year. Airlines are added after the Air Safety Committee (comprising national CAA directors) determines that they fail to meet international safety standards — either due to their own safety record or due to inadequate oversight by their state of registry.

As of 2025, the EU Air Safety List includes all airlines certified in specific countries (Afghanistan, Congo, Equatorial Guinea, Eritrea, Libya, São Tomé and Príncipe, Sierra Leone, Sudan) and numerous individual carriers from other countries. The list was notably updated to add carriers from Russia following the 2022 invasion of Ukraine, based on Russia's refusal to comply with airworthiness directives for Western-built aircraft affected by sanctions. Carriers on the list are legally prohibited from carrying passengers or cargo within EU airspace — not merely discouraged from doing so.

The US DOT and FAA do not maintain an equivalent comprehensive banned list, but the IASA Category 2 designation effectively restricts operations. A carrier from a Category 2 country cannot add new services, new routes, or new aircraft to its US operations until the country's aviation authority is restored to Category 1. This creates significant commercial pressure on both the airline and its government to cooperate with FAA safety improvement recommendations.