Sarto Training & Consulting
EU Regulations require that air carriers transporting cargo or mail into the EU from a non-EU airport shall ensure that cargo and mail come from a secure supply chain and they are screened according to EU standards. (...)
Air carriers are required to be designated as an 'Air Cargo or Mail Carrier operating (...)
Third country entities being, or intending to be, part of the supply chain of an air carrier holding (...)
EU Regulations foresee the carrying-out of some "validations for the purposes of EU civil aviation security, intended as standardised, documented, impartial and objective processes for obtaining and evaluating evidence to determine (...)
EU legislation requires that "any entity that ensures the security controls and delivers (...)
EU legislation requires that "any entity that ensures the security controls and delivers (...)
Pre-validation advice can help to facilitate the validation process by avoiding that some of the requirements of the European legislation are not met. (...)
Pre-validation advice can help to facilitate the validation process by avoiding that some of (...)
Sarto Training & Consulting Services
EU Regulations require that air carriers transporting cargo or mail into the EU from a non-EU airport shall ensure that cargo and mail come from a secure supply chain and they are screened according to EU standards. As a confirmation of what above, air carriers must be designated as ACC3 (“Air Cargo or Mail Carrier operating into the Union from a Third Country Airport”).
This designation is based on the validation of their cargo operations at the relevant non-EU airports and it can be made on-site or desktop, depending on each specific case. The validations for ACC3 must be carried out by an EU Aviation Security Validator, approved as such by an EU Member State Aviation Appropriate Authority. The designations as ACC3 that follow the validation are then carried out by the Appropriate Authority and are valid for 5 years for on-site validations.
Also other business entities that are part of the cargo and mail supply chain (Ground Handling Agents or other service providers or consignors who originate cargo or mail for their own account) need to go through the same process and be designated respectively as Third Country Regulated Agents (RA3) or Third Country Known Consignors (KC3). Also the validations for RA3 and KC3 must be carried out by an EU Aviation Security Validator. The designations as RA3 and KC3 that follow the validation are then carried out by the Appropriate Authority and are valid for 3 years.
An ACC3/RA3/KC3 Validation can only be performed by accredited EU Aviation Security Independent Validators, approved by a Member State Appropriate Authority and inserted as such in the Union database on supply chain security.
Air carriers are required to be designated as an 'Air Cargo or Mail Carrier operating into the Union from a Third Country Airport' (ACC3) for each non-EU airport from which they fly cargo or mail into the EU. ACC3s must ensure that all cargo and mail carried to the EU (and to Iceland, Norway and Switzerland) is physically screened to EU standards or comes from a “secure supply chain”, which is EU aviation security validated.
To obtain the ACC3 status an air carrier needs to have subjected its relevant air cargo or mail operations in non-EU countries to an EU aviation security validation.
This exercise is carried out by an EU aviation security validator who will assess the air carrier's security programme to ensure its relevance and completeness and will assess the implementation of aviation security measures during an 1) on-site verification of the cargo and mail operations of that air carrier in non-EU countries. 2) The EU aviation security validator will draft a report based on his findings and provide this report to the appropriate authority of the EU Member State that is responsible for the designation of that air carrier as ACC3. 3) Based on this report, the Appropriate Authority will decide whether the air carrier can be designated as ACC3 for a specific operation.
Air carriers are also required to nominate a person with responsibility for the implementation of cargo and mail requirements and to deliver a 'Declaration of Commitments' concerning the fulfillment of its aviation security responsibilities.
The ACC3 designation is valid for a maximum of 5 years.
Actions to take
In order for air carriers to be able to subject their relevant air cargo and mail operations to EU aviation security validation, they are recommended to take the following actions.
1. Contact the appropriate authority of the Member State that is responsible for their designation
EU air carriers should contact the Appropriate Authority of the Member State that issued their Air Operator's Certificate (AOC).
Non-EU carriers can locate the responsible Appropriate Authority by making use of the Annex to Regulation (EC) No 748/2009, as currently amended by Commission Regulation (EU) 2019/225, in which air carriers are assigned to one specific Member State.
Non-EU carriers which are not included in this list are advised to contact the Appropriate Authority of the Member State where they have their major base of operations.
2. Familiarize themselves with the EU requirements
The Appropriate Authority of the Member State that is responsible for the Carriers’s designation is required to provide the same with all necessary EU aviation security requirements, including non-public information. The Appropriate Authority will also inform the Carriers whether additional security measures are needed for certain non-EU locations it flies from or whether the ACC3 requirements are waived for certain non-EU locations it flies from.
The basic security requirements for cargo and mail from non-EU countries may be found in the Commission Implementing Regulation (EU) 2015/1998 and its subsequent amendments and changes. Attachment 6C-3 contains the checklist which EU aviation security validators will need to fill in during their on-site verification.
3. If necessary, update their business operations at non-EU locations to comply with the requirements
Depending on the Carrier’s business and current security measures, it may need to update its security programme in respect of the cargo and mail operations from each individual non-EU airport, implement the necessary security requirements, establish a secure supply chain or provide for the necessary screening equipment.
4. Investigate which of the provided designation options suits their business operations best
The EU regulations provide two different ACC3 designation options for air carriers. The system provides flexibility to the entities involved to choose the option which suits their business operations best.
In option 1, an on-site verification at a non-EU airport is necessary before designation is granted for that specific airport.
In option 2, air carriers which operate several relevant cargo or mail operations and which apply an internal security quality assurance programme that is equivalent to EU aviation security validation, may request on-site validations at a representative number of airports. If an air carrier operates from more than three third country airports, then the carrier can propose a roadmap, indentifying a selection of these airports and giving a reason for this choice, while defining a timeline for their validation. The Aviation Appropriate Authority will then study the roadmap proposal and, if satisfied with its contents, approve it.
Entities from which the Carrier receives cargo or mail may either be validated as part of the Carrier’s on-site verification or may submit their relevant cargo handling entities to validation by an EU aviation security validator themselves. In both cases, these entities must be designated by the relevant appropriate authority. The details of these entities will be entered in the Union database on supply chain security and they must also be entered in the Carrier’s database with all relevant information, in order to establish a secure supply chain link.
5. Contact Sarto Training & Consulting to carry out the necessary validations
EU aviation security validations can only be carried out by EU aviation security validators approved by EU Member States. Sarto Training & Consulting validators have been approved by their relevant Aviation Authority and are part of the IATA Center of Excellence for Independent Validators.
Third country entities being, or intending to be, part of the supply chain of an air carrier holding the status of ACC3, may be designated as either “Third country regulated agent” (RA3) or “Third country known consignor” (KC3).
According to the changes in EU Regulations registered in 2017, the responsibility for the designation of RA3 and KC3 is of the Appropriate Authority of an EU Member State, similarly to the process in place for the designation of air carriers as ACC3. To obtain the RA3 or KC3 status an entity needs to have subjected its relevant air cargo or mail operations in non-EU countries to an EU aviation security validation and comply with the following steps.
Entities applying to obtain RA3 or KC3 designation are also required to nominate a person with overall responsibility on the entity’s behalf for the implementation of cargo or mail security provisions in respect of the relevant cargo operations and to deliver a 'Declaration of Commitments' concerning the fulfillment of their aviation security responsibilities.
The designation of an RA3 or KC3 is valid for a maximum of 3 years.
Actions to take
Third country entities (RA3 and/or KC3) interested to subject their relevant air cargo and mail operations to EU aviation security validation should take the following actions.
1. Contact the relevant EU Appropriate Authority to assess eligibility to obtain designation
Third country entities seeking to obtain the RA3/KC3 status shall address their request to the Appropriate Authority of an EU Member State that shall then assess wether the applicant is eligible to obtain the requested status. The main eligibility condition for an entity is to have a role within the secure supply chain of cargo/mail bound to the European Union. On its request to the Appropriate Authority, the entity should therefore clearly specify and state the reasons for which it is applying for designation. i.e. highlight its activity within the supply chain.
In order to identify the Member State that will be responsible for their designation process, entities should proceed as follows:
a) approach the Appropriate Authority of the EU Member State that is responsible for the ACC3 designation of an air carrier operating at the third country airport where the applicant handles EU bound cargo and with which it has, or intends to start, a business relation; or
b) where there is no ACC3 designated air carrier in that country, approach the Appropriate Authority of the Member State responsible for the approval of the EU aviation security validator performing, or having performed, the validation.
The Appropriate Authority receiving the request shall start the designation process, or agree with the Appropriate Authority of another Member State on the delegation of the responsibility of the validation/designation process. In this case the applicant entity will be duly informed on the allocation of the final responsibility.
2. If necessary, update the business operations at non-EU locations to comply with the requirements
Depending on their business and on their current security measures, entities seeking designation as RA3 or KC3 may need to:
➢ update their security programme in respect of the cargo and mail operations from each individual non-EU airport;
➢ implement the necessary security requirements;
➢ establish a secure supply chain or provide for the necessary screening equipment.
3. Investigate which of the provided designation options suits their business operations best
EU regulations provide two different RA3/KC3 designation options for entities operating in third countries:
a) the Carrier’s ACC3 security programme shall set out details of security controls implememented on its behalf by third country entities from which it accepts cargo or mail directly for carriage into the Union. The EU aviation security validation of the ACC3 shall validate the security controls applied by those entities; or
b) the third country entities shall submit the relevant cargo handling activities to an EU aviation security validation at intervals not exceeding three years.
In option b) the EU aviation security validation shall consist of:
➢ an examination of the entity’s security programme ensuring its relevance and completeness in respect of the operations performed; and
➢ an on-site verification of the implementation of aviation security measures in respect of the relevant cargo operations.
Once the EU aviation security validation of option b) has been completed, the EU aviation security validator shall submit the validation report to the appropriate authority and provide the validated entity with a copy.
4. Contact Sarto Training & Consulting to carry out the necessary validations
EU aviation security validations may only be carried out by EU aviation security validators approved by EU Member States. Sarto Training & Consulting validators have been approved by their relevant Authority and are part of the IATA Center of Excellence for Independent Validators.
The designation of entities as RA3/KC3 is granted by the responsible Member State on the basis of the positive assessment of the EU aviation security validation report it has received. The designation is valid only from the moment the Appropriate Authority has entered the details of the entity into the Union Database on Supply Chain Security.
EU Regulations foresee the carrying-out of some "validations for the purposes of EU civil aviation security, intended as standardised, documented, impartial and objective processes for obtaining and evaluating evidence to determine the level of compliance of the validated entity with requirements set out in Regulation (EC) No. 300/2008 and its implementing acts".
The Italian National Civil Aviation Security Programme requires, for example, that the validations of the security programmes of the known suppliers of in-flight supplies and known suppliers of airport supplies are carried out by an EU Air Security Validator.
Andrea Sarto, Owner of Sarto Training & Consulting, has been recognised by ENAC as a National Validator (https://www.enac.gov.it/sicurezza-aerea/security/validatori-nazionali-macro-area-b) for the performance of all security quality control activities, in the name and on behalf of ENAC and/or the Operators.
In his previous experience as Airport Security Manager, Andrea Sarto had conducted and finalised the validation processes of a number of well-known suppliers of airport supplies and in-flight supplies.
EU legislation requires that "any entity that ensures the security controls and delivers in-flight supplies, but not directly to the aircraft, shall be designated as a known supplier by the operator or the entity to whom it delivers, the "designating entity" (the air carrier or the regulated supplier).
In order to be designated as a known supplier, the supplier is required to submit to the designating entity:
Validation for EU aviation safety purposes is a standardised, documented, impartial and objective procedure, intended to acquire and assess information in order to determine the level of compliance of an entity subject to validation with the requirements of Regulation (EC) No 300/2008 and its implementing acts.
ENAC, in the Italian Civil Aviation Security Programme, has established that the validations of the security programme and its implementation must be carried out by an EU aviation security validator, or an entity acting on behalf of the self-handling air carrier or the regulated supplier, appointed and trained for this purpose according to Cat. A12 or A12bis of the ENAC Security Training Manual.
Validations shall be recorded and, unless otherwise specified in the regulation, shall be made prior to designation and repeated every two years thereafter.
The validation of the implementation of the safety programme confirming the absence of deficiencies shall consist of:
Such checks shall be unannounced and shall take place at least once every three months or on 20 % of the deliveries made by the known supplier to the designating entity.
Option (b) may only be applied if the appropriate authority has established in its national civil aviation security programme that validation is to be carried out by a person acting on behalf of the designating entity.
The modalities applied and the procedures to be followed during and after designation shall be set out in the designating entity's security programme.
In his previous experience as Airport Security Manager, Andrea Sarto had conducted and finalised the validation processes of a number of well-known suppliers of airport supplies and in-flight supplies.
EU legislation requires that "any entity that ensures the security controls and delivers airport supplies shall be designated as a known supplier by the airport.
In order to be designated as a known supplier, the supplier must provide the airport operator with:
Validation for EU aviation safety purposes is a standardised, documented, impartial and objective procedure, intended to acquire and assess information in order to determine the level of compliance of an entity subject to validation with the requirements of Regulation (EC) No 300/2008 and its implementing acts.
ENAC, in the Italian Civil Aviation Security Programme, has established that the validations of the security programme and its implementation must be carried out by an EU aviation security validator, or an entity acting on behalf of the self-handling air carrier or the regulated supplier, appointed and trained for this purpose according to Cat. A12 or A12bis of the ENAC Security Training Manual.
Validations shall be recorded and, unless otherwise specified in the regulation, shall be made prior to designation and repeated every two years thereafter.
The validation of the implementation of the safety programme confirming the absence of deficiencies shall consist of:
Such checks shall be unannounced and shall take place at least once every three months or on 20 % of the deliveries made by the known supplier to the designating entity.
Option (b) may only be applied if the appropriate authority has established in its national civil aviation security programme that validation is to be carried out by a person acting on behalf of the designating entity.
The modalities applied and the procedures to be followed during and after designation shall be set out in the designating entity's security programme.
Pre-validation advice can help to facilitate the validation process by avoiding that some of the requirements of the European legislation are not met.
Sarto Training and Consulting experts can make a preliminary assessment of the security programme and of the other company manuals and procedures, to check if there is the need of any change before the on-site visit takes place.
In order to guarantee the independence of the validation process, these consultancy services will not be carried out by the same Validator that will carry out the EU validation, but by another qualified consultant.