Subcontracting in EU air navigation 2026: new obligations for ATM/ANS providers

Key data

Air traffic management and air navigation service providers (ATM/ANS) operating in the European Union have new obligations on the table. The Implementing Regulation (EU) 2026/2031, published on 14 September 2026, amends Regulation 2017/373 —the common framework that regulates the requirements for these providers— to tighten the conditions applicable when activities are outsourced or subcontracted to third parties.

The message is clear: responsibility does not end with the subcontracting contract. The main provider is responsible for ensuring that its entire service delivery chain complies with the same standards that it must itself accredit to national supervisory authorities.

What does this regulation establish?

Regulation 2017/373 established common requirements for ATM/ANS service providers in the EU. The amendment introduced by Regulation 2026/2031 focuses on one specific point: the conditions and guarantees that must be applied when these providers outsource activities to third parties.

The key changes compared to the previous situation are:

In practice, this means that an ATM/ANS provider cannot simply sign a contract with a subcontractor and forget about it. It must actively verify that the third party complies with the technical and organizational requirements that the regulation requires of it.

Economic and operational impact

The impact of this regulation is not primarily financial in terms of published fees or fines, but rather operational and risk management. The real costs for affected organizations materialize in several dimensions:

• Contract review: All existing subcontracting contracts must be analyzed and, presumably, renegotiated to include clauses that guarantee compliance with the new standards.
• Third-party audits: Providers will need to implement verification and monitoring processes on their subcontractors, which involves human resources, technical resources and potentially external audit costs.
• Compliance risk: If a national supervisory authority inspection detects that a subcontractor does not comply with equivalent standards, responsibility falls on the certified main provider.
• Possible provider rotation: Subcontractors unable to demonstrate compliance with the new technical and organizational requirements could be excluded from the supply chain.

National supervisory authorities in each Member State now have an explicit mandate to verify compliance with these obligations in their inspections, which increases regulatory risk for those who do not act with due diligence.

Who does it affect?

• Certified air navigation service providers in the EU (ATM/ANS providers with certification under Regulation 2017/373).
• Air traffic management service providers that fully or partially outsource operational, technical or support activities.
• Subcontractors and third-party companies that provide services to ATM/ANS providers: they will need to demonstrate compliance with standards equivalent to those of the main provider.
• National supervisory authorities for civil aviation in Member States, which must incorporate verification of the subcontracting chain into their inspection protocols.
• Compliance, legal and operations departments of affected organizations, which will need to lead internal adaptation.

Practical example

Imagine a certified air navigation service provider that manages communication and surveillance services in a national airspace. For the maintenance of its radar systems, it has subcontracted a specialized technology company.

Before the amendment introduced by Regulation 2026/2031, the main provider could demonstrate its own compliance to the national supervisory authority without an explicit obligation to ensure that its maintenance subcontractor complied with equivalent organizational and technical standards.

With the new regulation, that provider must:

1. Review the contract with the maintenance company and include clauses requiring compliance with technical and organizational requirements equivalent to its own.
2. Establish a mechanism for periodic verification of the subcontractor's compliance.
3. Be able to demonstrate to the national supervisory authority, in any inspection, that its entire subcontracting chain complies with the required standards.

If the authority detects that the subcontractor does not comply with those standards, responsibility falls on the certified main provider, not just on the third party.

What should companies do now?

1. Inventory all existing subcontracting contracts: Identify what activities are outsourced and with which third parties, to have a complete view of the service delivery chain.
2. Analyze current subcontractor compliance: Assess whether the third parties you work with already comply with the technical and organizational requirements equivalent to those required of the main provider under Regulation 2017/373.
3. Review and update contracts: Incorporate specific clauses that require subcontractors to comply with the new standards and that allow the main provider to verify that compliance.
4. Implement a continuous supervision process: Establish periodic audits or monitoring mechanisms on subcontractors to ensure sustained compliance over time.
5. Coordinate with the national supervisory authority: Anticipate upcoming inspections by finding out how compliance with the subcontracting chain will be verified in each Member State.
6. Train internal teams: Ensure that operations, legal and compliance departments are aware of the new obligations and their practical implications.

Official source

Consult full regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602031