If you operate under CASR Parts 119, 121, 133, 135, or 138, your December 2026 calendar has a regulatory hard date on it whether you have looked yet or not. The CASA EX73/24 Safety Management System deferrals end on 1 December 2026, which means from 2 December 2026 you are expected to be operating a documented SMS — not preparing one, not drafting one, operating one.
The dates that decide whether you get there comfortably are not the December ones. They are earlier. The CASA documentation submission deadline for affected operators is 1 September 2026, which means the writing and the internal sign-off and the framework integration all have to be finished by late August at the latest. Operators who are pacing toward 2 December are already running three months behind.
This guide breaks down what the mandate actually requires, what CASA reviewers actually want to see, the realistic cost and timeline ranges I have lived through and seen across the industry, and the 30-60-90 day plan if you have not started yet. It is written for accountable managers, chief pilots, safety managers, and operations directors who need a credible read on the scope of work — not another generic compliance article.
I have carried Safety Management System documentation work by hand at a Part 141 operator. The detail in this post is the detail I would have wanted on a single page when I was starting.
What Actually Ends on 2 December 2026
The technical regulatory hook is the expiry of the SMS provisions inside the Flight Operations Regulations — SMS, HFP&NTS and T&C Systems — Supplementary Exemptions and Directions Instrument 2024 (CASA EX73/24). This instrument was a transitional bridge: it deferred several Safety Management System obligations under the new flight operations regulations so operators had implementation runway after the 2 December 2021 regulation commencement.
The SMS provisions in Parts 2 and 4 of EX73/24 cease to have effect on 1 December 2026. From 2 December 2026, affected operators must have an SMS in place that complies with the framework requirements inside their operator-class Part of the Civil Aviation Safety Regulations.
Affected operator classes:
- CASR Part 119 — the umbrella certification and management framework for Australian air transport operators
- CASR Part 121 — scheduled and non-scheduled aeroplane air transport above 8,618 kg MTOW or above 10 passenger seats
- CASR Part 133 — rotorcraft air transport (helicopters operating under an Air Operator's Certificate)
- CASR Part 135 — smaller aeroplane air transport (including most charter operations)
- CASR Part 138 — aerial work (survey, agricultural, sling-load, photography, similar operations)
"Having an SMS" in CASA's regulatory framing does not mean having a document called SMS Manual. It means operating an integrated system that produces evidence of safety management — hazard log entries, risk assessments, internal audit reports, management review minutes, change management records, training records for SMS roles. The document is the wrapper; the operating system is the substance. CASA reviewers look for both.
Part 91 (general operating and flight rules) and Part 141 / 142 (flight training) sit outside the EX73/24 SMS mandate. Part 145 (approved maintenance organisations) and Part 42 (continuing airworthiness) have their own SMS pathways under separate regulatory frameworks — if you hold a Part 145 certificate alongside an air transport AOC, you have two SMS streams to coordinate.
The 1 September 2026 Submission Deadline (The One That Actually Matters)
CASA expects affected operators to submit their SMS documentation by 1 September 2026 so it can be assessed and acknowledged before the 2 December hard date.
Operators who submit complete documentation by 1 September receive a written acknowledgment by email to commence operating under their submitted procedures with their nominated safety manager. CASA has explicitly removed the up-front formal assessment and approval process in favour of this acknowledgment model — the shift is from paperwork-as-permission to operational-systems-as-substance.
Practically, this changes how you plan the work backwards:
- By 1 September 2026 — complete documentation submitted to CASA
- By mid-August 2026 — internal sign-off from accountable manager, last-pass review by safety manager, MAAT entry complete
- By end-July 2026 — framework operating long enough to have produced hazard register entries, audit reports, and at least one management review cycle
- By April 2026 — framework architecture decided, safety policy signed, hazard identification process running
- By February 2026 — accountable manager and safety manager identified in writing, MAAT account opened, operator-class template downloaded
Operators starting the work in May 2026 are not late — they have a tight but credible 16-week runway. Operators starting in July 2026 are running the deadline and will likely have to rush MAAT entry and submit incomplete documentation, with the risk that CASA's acknowledgment does not come back before 2 December.
The Four-Pillar Framework (What CASA Actually Wants to See)
CASA's SMS framework aligns to the ICAO Annex 19 architecture, expanded in the CASA advisory circular AC 119-01. Four pillars, with the operational elements inside each:
Pillar 1 — Safety Policy and Objectives
The accountable manager signs a written safety policy that states the operation's commitment to safety, encourages safety reporting, defines accountabilities and authorities across the organisation, and sets measurable safety objectives.
What CASA reviewers look for: the policy is current (within revision cycle), signed by the named accountable manager, posted visibly to staff, references the safety reporting system, and identifies the safety manager by role.
Common gap: the policy exists, but the accountabilities and authorities are vague — "everyone is responsible for safety" rather than naming specific accountabilities per role. CASA wants role-specific accountabilities.
Pillar 2 — Safety Risk Management
A documented process for identifying hazards, assessing risk (probability × severity), assigning mitigation, and tracking residual risk over time. The artefacts CASA reviews are the hazard register, the risk assessment matrix, the mitigation plans for high-risk hazards, and the change management process for managing risk introduced by operational change.
What CASA reviewers look for: an active hazard register (not a one-off document) with entries from the last 90 days, evidence the risk assessment process is applied consistently, mitigation plans that are actually tracked rather than just listed, and change management records for any significant operational change in the last 12 months.
Common gap: a hazard register that was populated once and never touched. Reviewers can tell from the entry dates and the absence of update cycles. The hazard register has to live.
Pillar 3 — Safety Assurance
The internal verification system — internal audits against the SMS framework, management review cadence, safety performance indicators, and the corrective action loop that closes findings.
What CASA reviewers look for: an internal audit programme with a schedule, completed audit reports from the last 12 months, management review minutes that demonstrate the accountable manager engages with SMS performance at least quarterly, defined safety performance indicators, and a corrective action register that tracks findings through to closure.
Common gap: internal audits exist on paper but are not actually conducted, or the management review meetings happen but no minutes are kept. Without the artefacts, the assurance loop is not visible to CASA.
Pillar 4 — Safety Promotion
Training and communication that makes sure everyone in the operation understands the SMS, their role in it, and how to report safety concerns.
What CASA reviewers look for: an induction process for new staff that covers the SMS, recurrent SMS training records, evidence of safety communication (safety meetings, bulletins, just-culture statements), and the just-culture or reporting culture statement that makes safety reporting actually safe to do.
Common gap: training exists for the safety manager but not for the rest of the operation. The SMS is not a safety manager's project — it is the whole operation's framework, and the whole operation needs to know what it is.
What MAAT Is and Why It Matters
The Manual Authoring and Assessment Tool (MAAT) is the CASA-published online environment at maat.casa.gov.au for authoring, revising, submitting, and updating operator manuals against CASA's regulatory templates. It is free to use, and CASA publishes operator-class templates inside MAAT for Part 119, 133, 135, and 138 operators.
If you have not heard of MAAT, you are not alone — a significant share of the Australian operator base is still working in Word or Google Docs and converting to PDF for submission. That path works, but it adds friction at the CASA end (the manual has to be mapped back to the regulatory template structure) and at your end (revision control becomes manual).
MAAT does three things well for the SMS submission:
- Template alignment — the structure CASA expects is built in, so you cannot accidentally miss a required section
- Revision control — every change is tracked against the operator's account, and the submission to CASA carries the full audit trail
- Submission workflow — the path from drafted manual to submitted-to-CASA is a workflow inside MAAT, not an email attachment
For most operators starting SMS work in 2026, the recommendation is to use MAAT unless you already have a non-MAAT manual structure that a CASA case officer has previously accepted. The cost of switching to MAAT once the framework is in place is usually worth the structural alignment savings on the assessment side.
Realistic Cost and Timeline Ranges
The honest pricing question most operators want answered. Ranges I have seen across the industry for operators starting close to zero existing documentation:
| Operator profile | Timeline | External cost (AU$) | |---|---|---| | Micro Part 135 / 138 (single aircraft, 1-3 staff) | 6-10 weeks | $8,000-$18,000 | | Single-aircraft-type Part 135 charter | 12-16 weeks | $15,000-$35,000 | | Part 141 school adding Part 135 SMS for charter | 16-20 weeks | $20,000-$45,000 | | Multi-aircraft Part 135 / 133 (multiple bases) | 6-9 months | $50,000-$120,000 | | Larger Part 121 regional with multiple AOC scopes | 9-12 months | $100,000-$300,000+ |
These are documentation, framework integration, and internal training costs. They do not include any new safety roles you have to staff, any operational changes the SMS surfaces, or any system tooling (incident reporting platforms, audit management software) you may decide to procure.
Operators with existing partial documentation — an old Safety Manual from a previous AOC, hazard log entries from a previous operational year, audit records — can often cut these ranges by 30-50%. The principle is that you are integrating and updating, not writing from scratch.
The ranges are also lower if you are committed to a productised, fixed-fee pathway and willing to use MAAT-compatible templates rather than insisting on custom-authored manuals. The traditional bespoke aviation consultant model — multi-month engagements without public pricing — tends to come in at the high end of every band.
If you want a productised, transparent-priced reference point, the OTGM CASA Documentation Pack is one such pathway — fixed-fee, MAAT-compatible, instructor-signed, with 7-15 business day delivery on the initial pack and the framework decisions made upfront.
Three Failure Modes I See Routinely
Across operator conversations and audit-prep work, the same three patterns recur.
Failure Mode 1 — The Safety Policy Statement With No Framework Underneath
Operators write a strong safety policy, sign it, file it in the operations manual. Then there is no hazard register, no risk assessment process, no internal audit cadence, no management review minutes. The policy exists; the framework does not.
CASA reviewers can tell within minutes. The policy passes the document check; the operating system fails the substance check. Acknowledgment is unlikely.
The remedy: treat the policy as the wrapper, not the deliverable. The substance is the four-pillar framework operating week-on-week and producing artefacts.
Failure Mode 2 — The SMS That Exists in Theory But Not in a Form CASA Accepts
Operators have most of the elements — there is a hazard log, there are safety meetings, there is some kind of audit work — but it is scattered across email threads, shared drives, individual notebooks, and verbal handoffs. There is no single integrated submission package.
This is the most painful failure mode because the operator has done substantial work that is not visible to CASA. The remedy is assembly, not from-scratch creation — pull the elements into a MAAT-compatible structure, populate the missing pieces, and submit.
Failure Mode 3 — The Operator Who Has Not Started
The smallest segment numerically but the highest-risk segment for the 1 September 2026 deadline. Operators who have been heads-down on operations for the last 18 months and have not yet engaged with the EX73/24 transition.
The remedy is the 30-60-90 day plan in the next section. If you are this operator and the date today is past August 2026, the conversation shifts from compliance to operational continuity — talk to CASA early, document your transition plan, and start the work.
The 30-60-90 Day Starter Plan
If you have not started, here is the plan to be operationally credible by the 1 September 2026 submission deadline. This assumes a single-AOC Part 135 or Part 138 operator with no existing SMS documentation.
Days 0-30 — Foundations
- Identify and document the accountable manager (almost always the CEO or equivalent) and the safety manager in writing. For micro-operators, CASA allows nomination of an existing key person — CEO, Head of Flying Operations, or Head of Operations — as the safety manager without separate CASA approval for that nomination
- Open a MAAT account and download the operator-class template for your Part (119+133 for rotorcraft, 119+135 for smaller aeroplane, 138 for aerial work)
- Run a self-assessment of where you sit against the four pillars — the SMS Readiness Checker gives you a tier and a recommended next step in 7 questions
- Sign the safety policy and post it visibly. This is the simplest pillar-1 deliverable and demonstrates accountable manager commitment
Days 30-60 — Framework Construction
- Build the hazard register — start with the obvious hazards from your operation and capture them in a structured format with probability/severity assessment
- Establish the risk assessment process in writing — how hazards are scored, who reviews, what triggers mitigation
- Define the internal audit programme — annual schedule, who audits, against what checklist
- Define the management review cadence — quarterly minimum, with the accountable manager present
- Set up the safety reporting system — even a simple form and email inbox to start, with a just-culture statement
Days 60-90 — Operating the System
- Run the system. Capture hazard register entries from the last 30 days. Conduct one internal audit. Hold the first management review meeting and document the minutes. Distribute safety communication
- Assemble the documentation into the MAAT structure
- Internal review and sign-off
- Submit to CASA in early September 2026
This 90-day path is feasible from a starting point of zero existing documentation for a small operator with focused effort. It does not produce a polished mature SMS — that takes 18-24 months of operational refinement — but it produces a credible submission that CASA can acknowledge and that gives you a working framework to refine through 2027.
Where to Start the Diagnostic
The first decision is honest self-assessment — where is your operation against the four pillars today, and what specific gaps does the September submission deadline force you to close?
The SMS Readiness Checker at OTGM is a 7-question diagnostic calibrated against the four-pillar architecture above. It scores 0-100, assigns a risk tier, and surfaces the specific gaps to attack first. It is a directional check, not a CASA-grade audit — but it is enough to tell you whether you are tracking comfortably toward September 2026 or whether you need to start documentation work in the next 30 days.
If your readiness score comes back in the High Risk or Critical tier, the productised pathway is the CASA Documentation Pack — Operations Manual templates, full SMS framework, MAAT-populated drafts, instructor-signed at the end. Fixed-fee, public pricing, 7-15 business day delivery on the initial pack.
If you are also a Part 141 or 142 flight school and the December 2026 SMS conversation has reopened the question of your Part 61 competency mapping (CBTA), the Audit-Defensible CBTA Pack covers the training side under the same compliance practice.
For the broader practice overview — the marketing-agency-with-a-compliance-practice frame, instructor-signed across every pack — see the Aviation Compliance practice page.
If your operation includes a Part 145 approved maintenance organisation alongside the AOC, the SMS coordination across the two regulatory streams is a separate but related conversation — see the MRO Marketing practice for the maintenance organisation context, and request a scoping conversation through the compliance pack page.
The Honest Read
The 2 December 2026 SMS mandate is not catastrophic for operators who start now. It is catastrophic for operators who wait until October. The framework CASA requires is well-defined, the templates exist, the MAAT submission pathway is published, and the four-pillar architecture has been the international standard since 2013.
The work is not small. A small operator should plan 12-16 weeks of focused effort and AU$15,000-$35,000 of external assistance. A larger operator should plan 6-9 months and an order of magnitude more.
The work is also not optional. The EX73/24 deferral was the runway; the runway ends. Operators who have built the SMS find that the framework surfaces operational improvements worth more than the documentation cost over a 12-24 month horizon — incident rates fall, insurance premiums often improve, customer trust strengthens, and the audit-defensibility becomes a competitive advantage when CASA surveillance visits.
The first move is the diagnostic. Start with the SMS Readiness Checker, get a directional read, then make the call on whether to handle the documentation internally or engage a productised pathway. Either way, the 1 September 2026 submission deadline is the date that decides whether you arrive comfortably.
Related
- Productised compliance pack: CASA Documentation Pack
- Diagnostic tool: SMS Mandate Readiness Checker
- Practice overview: Aviation Compliance practice
- Training-side compliance: Audit-Defensible CBTA Pack
- Maintenance organisation context: MRO Marketing
- Flight school operator context: Flight School Marketing
Sources and further reading
- CASA — Safety management systems for air transport operations
- CASA — Air transport operators: what you must do (flight operations regulations transition)
- CASA — Flight operations requirements for 2026: what's changing and how we're supporting operators
- CASA — Part 119 of CASR: Australian air transport operators
- CASA — Part 138 of CASR: Aerial work operations
- CASA — Manual Authoring and Assessment Tool (MAAT)
- CASA — Advisory Circular AC 119-01 v2.3: Safety management systems for air transport operations
- ICAO Annex 19 — Safety Management (via SKYbrary)
Ready to diagnose where you sit? Run the SMS Mandate Readiness Checker for a 7-question self-assessment, or skip to the CASA Documentation Pack if you already know you need productised documentation help before September 2026.
