Part-IS and NIS2: why compliance with one isn't enough
EASA has clarified this in its official FAQs: the two regulatory frameworks do not automatically overlap. Here's what this means for organisations operating in the aviation sector.
Many aviation organisations subject to both Part-IS and NIS2 assume that compliance with one automatically means compliance with the other. This is a risky assumption - and EASA has explicitly clarified why.
The technical point, in one sentence. According to the European Commission's guidance on "sector-specific Union legal acts", Part-IS does not qualify as lex specialis under Article 4 of the NIS2 Directive. In other words, since Part-IS is not recognised as a more specific regulatory framework that automatically takes precedence, compliance with Part-IS does not exempt an organisation from its NIS2 obligations, and vice versa.
This represents a significant difference compared with other sectors. For financial entities, for example, the DORA Regulation is recognised as lex specialis, meaning that DORA takes precedence over the corresponding NIS2 requirements in areas covered by its specific provisions. In aviation, no equivalent mechanism currently exists - at least not yet.
What this means in practice today. If your organisation falls within the scope of both Part-IS (e.g. AOC holders, Part-145 maintenance organisations, CAMOs, ATOs) and NIS2 (air transport is among the "highly critical sectors" identified under Italian Legislative Decree No. 138/2024), you must comply with both sets of requirements.
This means separate incident reporting procedures, different competent supervisory authorities (EASA/ENAC on one side and ACN, the Italian National Cybersecurity Agency, on the other), and distinct regulatory oversight and compliance demonstration processes - although controls and supporting evidence may be reused where requirements are genuinely equivalent.
A look ahead - not yet an operational provision. EASA and the European Commission are working on a mechanism that would allow compliance already demonstrated against specific Part-IS requirements to be recognised within the NIS2 framework.
For now, however, no general exemption or automatic equivalence mechanism is in place. This work is still ongoing, and under the current regulatory framework, compliance with one does not imply compliance with the other. Organisations falling within both regulatory scopes must therefore treat them as two parallel compliance obligations, not as interchangeable requirements.
The practical advantage of understanding this early. The two frameworks share common principles - risk management, incident reporting and governance - but their processes are not identical.
A well-designed Information Security Management System (ISMS) can minimise duplicated efforts by identifying where controls genuinely overlap and where separate compliance measures are required. However, this approach only works when organisations recognise from the outset that they are dealing with two distinct regulatory obligations.
There is also a third layer of complexity that is often overlooked in these assessments: both regulatory frameworks, in different ways, extend their focus to the supply chain - including suppliers and subcontractors that access critical systems or handle sensitive data.
This topic deserves a closer look and will be the next step in this series.
Sources: EASA - Part-IS FAQs, "Interaction with NIS2 Directive" section; Italian Legislative Decree No. 138/2024; Directive (EU) 2022/2555, Article 4.
#PartIS #NIS2 #AviationCybersecurity #AviationCompliance #GRC #CyberRisk #EASA #MagisPartners
