(a) The competent authorities shall establish a system of record-keeping that allows adequate traceability of the process to issue, continue, change, suspend or revoke each certificate.
- The record-keeping system should ensure that all records are accessible whenever needed within a reasonable time. These records should be organized in a consistent way throughout the competent authority (chronological, alphabetical order, etc.).
- All records containing sensitive data regarding applicants or organisations should be stored in a secure manner with controlled access to ensure confidentiality of this kind of data.
- All computer hardware used to ensure data backup should be stored in a different location from that containing the working data in an environment that ensures they remain in good condition. When hardware- or software-changes take place special care should be taken that all necessary data continues to be accessible at least through the full period specified in M.B.104(c) and/or (e).
(b) The records for the oversight of organisations approved in accordance with this Annex shall include as a minimum:
1. the application for an organisation approval;
2. the organisation approval certificate including any changes;
3. a copy of the audit programme listing the dates when audits are due and when audits were carried out;the competent authority continued oversight records including all audit records;
4. copies of all relevant correspondence;
5. details of any exemption and enforcement actions;
6. any report from other competent authorities relating to the oversight of the organisation;
7. organisation exposition or manual and amendments;
8. copy of any other document directly approved by the competent authority.
(c) The retention period for the point (b) records shall be at least 5 years.
(d) The minimum records for the oversight of each aircraft shall include, at least, a copy of:
1. the aircraft certificate of airworthiness;
2. airworthiness review certificates;
3. airworthiness review recommendations issued by CAO or CAMO;
4. the reports from the airworthiness reviews carried out directly by the competent authority;
5. all relevant correspondence relating to the aircraft;
6. the details of any exemption and enforcement action(s);
7. any document approved by the competent authority pursuant to this Annex or Annex II to Regulation (EU) No 965/2012 (Part-ARO).
(e) The records specified in point (d) shall be retained until 2 years after the aircraft has been permanently withdrawn from service.
(f) All records shall be made available upon request by another Member State or the Agency.
The cases, when records shall be made available should be limited to:
— incidents or accidents,
— findings through the aircraft continuing monitoring program where organisations approved by another competent authority are involved, to determine the root cause,
— aircraft mainly operated in another Member State,
— an aircraft previously operated in another Member State,
— an organisation having approvals in several Member States.
When records are requested from another Member State, the reason for the request should be clearly stated. The records can be made available by sending a copy or by allowing their consultation.