1. When the State of operator or the State of registry have notified differences to ICAO standards that have been identified by the Agency in accordance with ART.200(d) in Part-ART, the third country operator may propose mitigating measures to establish compliance with Part-TCO.
2. The third country operator shall demonstrate to the Agency that these measures ensure an equivalent level of safety to that achieved by the standard to which differences have been notified.

TCO.115 Access

1. The third country operator shall ensure that any person authorised by the Agency or the Member State in whose territory one of its aircraft has landed will be permitted to board such aircraft, at any time, with or without prior notice to:
   
   (1)    inspect the documents and manuals to be carried on board and to perform inspections to ensure compliance with Part-TCO; or
   
   (2)    carry out a ramp inspection as referred to in Annex II to Commission Regulation (EU) No 965/2012.

2. The third country operator shall ensure that any person authorised by the Agency is granted access to any of its facilities or documents related to its activities, including any subcontracted activities, to determine compliance with Part-TCO.

SECTION II

Air operations

TCO.200 General requirements

1. The third country operator shall comply with:
   
   (1)    the applicable standards contained in the Annexes to the Convention on International Civil Aviation, in particular Annexes 1 (Personnel licensing), 2 (Rules of the Air), 6 (Operation of Aircraft, Part I (International Commercial Air Transport — Aeroplanes) or Part III (International Operations- Helicopters)), as applicable, 8 (Airworthiness of Aircraft), 18 (Dangerous Goods), and 19 (Safety Management);
   
   (2)    the mitigating measures accepted by the Agency in accordance with ART.200(d);
   
   (3)    the relevant requirements of Part-TCO; and
   
   (4)    the applicable Union rules of the air.

2. The third country operator shall ensure that an aircraft operated into, within or out of the territory subject to the provisions of the Treaty is operated in accordance with:
   
   (1)    its air operator certificate (AOC) and associated operations specifications; and
   
   (2)    the authorisation issued in accordance with this Regulation and the scope and privileges defined in the specifications attached to it.

3. The third country operator shall ensure that an aircraft operated into, within or out of the Union has a certificate of airworthiness of the aircraft (CofA) issued or validated by:
   
   (1)    the State of registry; or
   
   (2)    the State of the operator, provided that the State of the operator and the State of registry have entered into an agreement under Article 83bis of the Convention on International Civil Aviation that transfers the responsibility for the issue of the CofA.

4. The third country operator shall, upon request, provide the Agency with any information relevant for verifying compliance with Part-TCO.

5. Without prejudice to Regulation (EU) No 996/2010 of the European Parliament and of the Council, the third country operator shall without undue delay report to the Agency any accident as defined in ICAO Annex 13, involving aircraft used under its AOC.

TCO.205 Navigation, communication and surveillance equipment

When undertaking operations within the airspace above the territory to which the Treaty applies the third country operator shall equip its aircraft with and operate such navigation, communication and surveillance equipment as required in that airspace

TCO.210 Documents, manuals and records to be carried

The third country operator shall ensure that all documents, manuals and records that are required to be carried on board are valid and-up-to-date.

TCO.215 Production of documentation, manuals and records

Within a reasonable time of being requested to do so by a person authorised by the Agency or the competent authority of the Member State where the aircraft has landed, the pilot-in-command shall produce to that person the documentation, manuals and records required to be carried on board.

SECTION III

Authorisation of third country operators

TCO.300 Application for an authorisation

1. Prior to engaging in commercial air transport operations under Part-TCO the third country operator shall apply for and obtain an authorisation issued by the Agency.

2. An application for an authorisation shall be:
   
   (1)    submitted at least 30 days before the intended starting date of operation; and
   
   (2)    made in a form and manner established by the Agency.

3. Without prejudice to applicable bilateral agreements, the applicant shall provide the Agency with any information needed to assess whether the intended operation will be conducted in accordance with the applicable requirements of TCO.200(a). Such information shall include:
   
   (1)    the duly completed application;
   
   (2)    the official name, business name, address, and mailing address of the applicant;
   
   (3)    a copy of the applicant's AOC and associated operations specifications, or equivalent document, that attests the capability of the holder to conduct the intended operations, issued by the State of the operator;
   
   (4)    the applicant's current certificate of incorporation or business registration or similar document issued by the Registrar of Companies in the country of the principal place of business;
   
   (5)    the proposed start date, type and geographic areas of operation.

4. When necessary, the Agency may request any other additional relevant documentation, manuals, or specific approvals issued or approved by the State of the operator or State of registry.

5. For those aircraft not registered in the State of the operator the Agency may request:
   
   (1)    details of the lease agreement for each aircraft so operated; and
   
   (2)    if applicable, a copy of the agreement between the State of the operator and the State of registry pursuant to Article 83bis of the Convention on International Civil Aviation that covers the aircraft.

TCO.305 Non-scheduled Flights — one-off notification

1. By way of derogation of TCO.300(a) a third country operator may perform air ambulance flights or a non-scheduled flight or a series of non-scheduled flights to overcome an unforeseen, immediate and urgent operational need without first obtaining an authorisation, provided that the operator:
   
   (1)    notifies the Agency prior to intended date of the first flight in a form and manner established by the Agency;
   
   (2)    is not being subject to an operating ban pursuant to Regulation (EC) No 2111/2005 of the European Parliament and of the Council; and
   
   (3)    applies for an authorisation within 10 working days after the date of notification to the Agency pursuant to TCO.300.

2. The flight(s) specified in the notification prescribed in (a)(1) may be performed for a maximum period of six consecutive weeks after the date of notification or until the Agency has taken a decision on the application in accordance with Part-ART, whichever comes sooner.

3. A notification may be filed only once every 24 months by an operator.

TCO.310 Privileges of an authorisation holder

The privileges of the operator shall be listed in the specifications to the authorisation and not exceed the privileges granted by the State of the operator.

TCO.315 Changes

1. Any change, other than those agreed under ART.210(c), affecting the terms of an authorisation or associated specifications shall require prior authorisation by the Agency.

2. The application for prior authorisation by the Agency shall be submitted by the third country operator at least 30 days before the date of implementation of the intended change.
   
   The third country operator shall provide the Agency with the information referred to in TCO.300, restricted to the extent of the change.
   
   After submission of an application for a change, the third country operator shall operate under the conditions prescribed by the Agency pursuant to ART.225(b).

3. All changes not requiring prior authorisation, as agreed in accordance with ART.210(c), shall be notified to the Agency before the change takes place.

TCO.320 Continued validity

1. The authorisation shall remain valid subject to:
   
   (1)    the third country operator remaining in compliance with the relevant requirements of Part-TCO. The provisions related to the handling of findings, as specified under TCO.325, shall also be taken into account;
   
   (2)    the validity of the AOC or equivalent document issued by the State of the operator and the related operations specifications, if applicable;
   
   (3)    the Agency being granted access to the third country operator as specified in TCO.115;
   
   (4)    the third country operator not being subject to an operating ban pursuant to Regulation (EC) No 2111/2005;
   
   (5)   the authorisation not being surrendered, suspended or revoked;
   
   (6)  the third country operator having carried out at least one flight every 24 calendar months, into, within or out of Gibraltar under the authorisation.

2. Upon surrender or revocation, the authorisation shall be returned to the Agency.

TCO.325 Findings

After receipt of a notification of findings pursuant to ART.230 raised by the Agency, the third country operator shall:

ANNEX 2

PART-ART

AUTHORITY REQUIREMENTS REGARDING THE AUTHORISATION OF THIRD COUNTRY OPERATORS

SECTION I

General

ART.100 Scope

This Annex (‘Part-ART’) establishes administrative requirements to be followed by Member States and the Agency, specifically regarding:

ART.105 Alternative means of compliance

The Agency shall evaluate all alternative means of compliance proposed by third country operators in accordance with TCO.105(b) by analysing the documentation provided and, if considered necessary, conducting an inspection of the third country operator.

When the Agency finds that the alternative means of compliance are in accordance with Part-TCO it shall without undue delay notify the applicant that the alternative means of compliance may be implemented and, if applicable, amend the authorisation of the applicant accordingly.

ART.110 Exchange of information

1. The Agency shall inform the Commission and the Member States when it:
   
   (1)    rejects an application for an authorisation;
   
   (2)    imposes a limitation due to safety concerns, suspends or revokes an authorisation.

2. The Agency shall inform the Member States of the notifications it has received in accordance with TCO.305 within one working day after receipt of the notification.

3. The Agency shall regularly make available to the Member States an updated list containing the authorisations it has issued, limited, changed, suspended or revoked.

4. Member States shall inform the Agency when they intend to take a measure pursuant to Article 6(1) of Regulation (EC) No 2111/2005.

ART.115 Record-keeping

1. The Agency shall establish a system of record-keeping providing for adequate storage, accessibility and reliable traceability of:
   
   (1)    training, qualification and authorisation of its personnel;
   
   (2)    third country operator authorisations issued or notifications received;
   
   (3)    authorisation processes and continuing monitoring of authorised third country operators;
   
   (4)    findings, agreed corrective actions and date of action closure;
   
   (5)    enforcement measures taken, including fines requested by the Agency in accordance with Regulation (EC) No 216/2008;
   
   (6)    the implementation of corrective actions mandated by the Agency in accordance with Article 22(1) of Regulation (EC) No 216/2008; and
   
   (7)    the use of flexibility provisions in accordance with Article 18(d) of Regulation (EC) No 216/2008.

2. All records shall be kept for a minimum period of 5 years, subject to applicable data protection law.

SECTION II

Authorisation, monitoring and enforcement

ART.200 Initial evaluation procedure — general

1. Upon receiving an application for an authorisation in accordance with TCO.300, the Agency shall assess the third country operator's compliance with applicable requirements in Part-TCO.

2. The initial assessment shall be completed within 30 days after receipt of the application or 30 days before the intended starting date of operation, whichever is the later.
   
   When the initial assessment requires a further assessment or an audit, the assessment period shall be extended for the duration of the further assessment or the audit, as appropriate.

3. The initial assessment shall be based on:
   
   (1)    documentation and data provided by the third country operator;
   
   (2)   relevant information on the safety performance of the third country operator, including ramp inspection reports, information reported in accordance with ARO.RAMP.145(c), recognised industry standards, accidents records and enforcement measures taken by a third country;
   
   (3)   relevant information on the oversight capabilities of the State of the operator or State of registry, as applicable, including the outcome of audits carried out under international conventions or State safety assessment programmes; and
   
   (4)    decisions, investigations pursuant to Regulation (EC) No 2111/2005 or joint consultations pursuant to Regulation (EC) No 473/2006.

4. The Agency shall, in consultation with the Member States, identify those ICAO standards for which it may accept mitigating measures in case the State of the operator or the State of registry has notified a difference to ICAO. The Agency shall accept the mitigating measure when it is satisfied that these measures ensure an equivalent level of safety to that achieved by the standard to which differences have been notified.

5. When the Agency cannot establish a sufficient level of confidence in the third country operator and/or the State of the operator during the initial assessment, it shall:
   
   (1)    refuse the application when the outcome of the assessment indicates that further assessment will not result in the issue of an authorisation; or
   
   (2)    conduct further assessments to the extent necessary to establish that the intended operation will be conducted in compliance with the applicable requirements of Part-TCO.

ART.205 Initial evaluation procedure — third country operators subject to an operating ban

1. Upon receiving an application for an authorisation from an operator subject to an operating ban or an operational restriction pursuant to Regulation (EC) No 2111/2005 the Agency shall apply the relevant assessment procedure as described in ART.200.
2. When the operator is subject to an operating ban due to the State of the operator not performing adequate oversight, the Agency shall inform the Commission for further assessment of the operator and the State of Operator under Regulation (EC) No 2111/2005.

3. The Agency shall perform an audit when:
   
   (1)    the third country operator agrees to be audited;
   
   (2)    the outcome of the assessments referred to in (a) and (b) indicates that there is a possibility that the audit will have a positive result; and
   
   (3)    the audit can be performed at the third country operator's facilities without the risk of compromising the security of the Agency's personnel.

4. The audit of the third country operator may include an assessment of the oversight conducted by the State of the operator when there is evidence of major deficiencies in the oversight of the applicant.

5. The Agency shall inform the Commission of the results of the audit.

ART.210 Issue of an authorisation

1. The Agency shall issue the authorisation, including the associated specifications, when:
   
   (1)    it is satisfied that the third country operator holds a valid AOC or equivalent document and associated operations specifications issued by the State of the operator;
   
   (2)    it is satisfied that the third country operator is authorised by the State of the operator to conduct operations into the EU;
   
   (3)    it is satisfied that the third country operator has established:
   
          (i)    compliance with the applicable requirements of Part-TCO;
   
         (ii)    transparent, adequate and timely communication in response to a further assessment and/or an audit of the Agency, if applicable; and
   
        (iii)    a timely and successful corrective action submitted in response to an identified non-compliance, if any;
   
   (4)    there is no evidence of major deficiencies in the ability of the State of the operator or the State of registry, as applicable, to certify and oversee the operator and/or aircraft in accordance with the applicable ICAO standards; and
   
   (5)    the applicant not being subject to an operating ban pursuant to Regulation (EC) No 2111/2005.

2. The authorisation shall be issued for an unlimited duration.
   
   The privileges and the scope of the activities that the third country operator is authorised to conduct shall be specified in the specifications attached to the authorisation.

3. The Agency shall agree with the third country operator the scope of changes to the third country operator not requiring prior authorisation.

ART.215 Monitoring

1. The Agency shall assess:
   
   (1)    continued compliance of third country operators it has authorised with the applicable requirements of Part-TCO;
   
   (2)    if applicable, the implementation of corrective actions mandated by the Agency in accordance with Article 22(1) of Regulation (EC) No 216/2008.

2. This assessment shall:
   
   (1)    take into account safety relevant documentation and data provided by the third country operator;
   
   (2)    take into account relevant information on the safety performance of the third country operator, including ramp inspection reports, information reported in accordance with ARO.RAMP.145(c), recognised industry standards, accidents records and enforcement measures taken by a third country;
   
   (3)   take into account relevant information on the oversight capabilities of the State of the operator or State of registry, as applicable, including the outcome of audits carried out under international conventions or State safety assessment programmes;
   
   (4)    take into account decisions and investigations pursuant to Regulation (EC) No 2111/2005 or joint consultations pursuant Regulation (EC) No 473/2006;
   
   (5)    take into account previous assessments or audits, if carried out; and
   
   (6)    provide the Agency with the evidence needed in case further action is required, including the measures foreseen by ART.235.

3. The scope of monitoring defined in (a) and (b) shall be determined on the basis of the results of past authorisation and/or monitoring activities.

4. Where, based on available information, the safety performance of the third country operator and/or the oversight capabilities of the State of the operator are suspected to have decreased below the applicable standards contained in the Annexes to the Convention on International Civil Aviation, the Agency shall conduct further assessments to the extent necessary to establish that the intended operation will be conducted in compliance with the applicable requirements of Part-TCO.

5. The Agency shall collect and process any safety information deemed relevant for monitoring.

ART.220 Monitoring programme

1. The Agency shall establish and maintain a monitoring programme covering the activities required by ART.215 and, if applicable, by Subpart ARO.RAMP.
2. The monitoring programme shall be developed taking into account the results of past authorisation and/or monitoring activities.

3. The Agency shall perform a review of third country operators at intervals not exceeding 24 months.
   
   The interval may be reduced if there are indications that the safety performance of the third country operator and/or the oversight capabilities of the State of the operator may have decreased below the applicable standards contained in the Annexes to the Convention on International Civil Aviation.
   
   The Agency may extend the interval to a maximum of 48 months if it has established that, during the previous monitoring period:
   
   (1)    there are no indications that the overseeing authority of the State of the operator fails to perform effective oversight on operators under its oversight responsibility;
   
   (2)    the third country operator has continuously and timely reported changes referred to in TCO.315;
   
   (3)    no level 1 findings, referred to in ART.230(b), have been issued; and
   
   (4)    all corrective actions have been implemented within the time period accepted or extended by the Agency as defined in ART.230(e)(1).

4. The monitoring programme shall include records of the dates of monitoring activities, including meetings.

ART.225 Changes

1. Upon receiving an application for a change that requires prior authorisation, the Agency shall apply the relevant procedure as described in ART.200, restricted to the extent of the change.
2. The Agency shall prescribe the conditions under which the third country operator may operate within the scope of its authorisation during the change, unless the Agency determines that the authorisation needs to be suspended.

3. For changes not requiring prior authorisation, the Agency shall assess the information provided in the notification sent by the third country operator in accordance with TCO.315 to verify compliance with the applicable requirements. In case of any non-compliance, the Agency shall:
   
   (1)    notify the third country operator about the non-compliance and request a revised proposal to achieve compliance; and
   
   (2)    in case of level 1 or level 2 findings, act in accordance with ART.230 and ART.235, as appropriate.

ART.230 Findings and corrective actions

1. The Agency shall have a system to analyse findings for their safety significance.

2. A level 1 finding shall be issued by the Agency when any significant non-compliance is detected with the applicable requirements of Regulation (EC) No 216/2008 and Part-TCO, or with the terms of the authorisation that lowers safety or seriously hazards flight safety.
   
   The level 1 findings shall include, but are not limited to:
   
   (1)    failure to give the Agency access to the third country operator's facilities as defined in TCO.115(b) during normal operating hours and after a written request;
   
   (2)    implementing changes requiring prior authorisation without having received an authorisation as defined in ART.210;
   
   (3)    obtaining or maintaining the validity of the authorisation by falsification of documentary evidence;
   
   (4)    evidence of malpractice or fraudulent use of the authorisation.

3. A level 2 finding shall be issued by the Agency when any non-compliance is detected with the applicable requirements of Regulation (EC) No 216/2008 and Part-TCO, or with the terms of the authorisation which could lower safety or hazard flight safety.
4. When a finding is detected during monitoring, the Agency shall, without prejudice to any additional action required by Regulation (EC) No 216/2008 and its Implementing Rules, communicate the finding to the third country operator in writing and request corrective action to eliminate or mitigate the root cause in order to prevent recurrence of the non-compliance(s) identified.

5. In the case of level 2 findings, the Agency shall:
   
   (1)    grant the third country operator a corrective action implementation period appropriate to the nature of the finding. At the end of the period, and subject to the nature of the finding, the Agency may extend the period subject to a second satisfactory corrective action plan agreed by the Agency; and
   
   (2)    assess the corrective action and implementation plan proposed by the third country operator. If the assessment concludes that it contains root cause(s) analysis and course(s) of action to effectively eliminate or mitigate the root cause(s) to prevent recurrence of the non-compliance(s), the corrective action and implementation plan shall be accepted.
   
   Where a third country operator fails to submit an acceptable corrective action plan referred to in ART.230(e)(1), or to perform the corrective action within the time period accepted or extended by the Agency, the finding shall be raised to a level 1 finding and action taken as laid down in ART.235(a).

6. The Agency shall record and notify the State of the operator or the State of registry, as applicable, of all findings it has raised.

ART.235 Limitation, suspension and revocation of authorisations

1. Without prejudice to any additional enforcement measures, the Agency shall take action to limit or suspend the authorisation in case of:
   
   (1)    a level 1 finding;
   
   (2)    verifiable evidence that the State of operator or State of registry, as applicable, is not capable to certify and oversee the operator and/or aircraft in accordance with the applicable ICAO standard; or
   
   (3)    the third country operator being subject to a measure pursuant to paragraphs (1) and (2) of Article 6 of Regulation (EC) No 2111/2005.

2. An authorisation shall be suspended for a maximum period of 6 months. At the end of the 6-month period the Agency may extend the suspension period for an additional 3 months.
3. The limitation or suspension shall be lifted when the Agency is satisfied that successful corrective action has been taken by the third country operator and/or the State of the operator.
4. In considering the lifting of a suspension the Agency shall conduct an audit of the third country operator when the conditions in ART.205(c) are met. In case the suspension is due to major deficiencies in the oversight of the applicant by the State of the operator or State of registry, as applicable, the audit may include an assessment with the aim to verify if these oversight deficiencies have been corrected.

5. The Agency shall revoke the authorisation when:
   
   (1)    the period referred to in (b) has expired; or
   
   (2)    the third country operator becomes subject to an operating ban pursuant to Regulation (EC) No 2111/2005.

6. If following a limitation referred to in (a) an operational restriction is imposed on the third country operator in accordance with Regulation (EC) No 2111/2005, the Agency shall maintain such limitation until the operational restriction has been withdrawn.

Appendix I

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Appendix II