Suppose you want to build an airliner. In the United States you file an application for a type certificate and the Federal Aviation Administration begins work. Your company needs no prior approval to exist as a designer; the FAA will, over the following years, delegate a great many of the compliance findings to individuals inside your organisation, but the application itself asks nothing of the organisation.

In Europe you cannot file the application at all.

Point 21.A.14(a) of Annex I to Regulation (EU) No 748/2012 is one sentence long: “Any organisation applying for a type-certificate or restricted type-certificate shall demonstrate its capability by holding a design organisation approval, issued by the Agency in accordance with Subpart J.” Before the aeroplane is assessed, the company is. That single difference in sequencing is the clearest expression of how differently the two certification systems are built, and it explains a great deal about why an American approval does not simply appear in Europe.

Approve the Designer, Then the Design

Subpart J is short. It runs from 21.A.231, which does nothing but state the Subpart’s scope, to 21.A.265, which lists the holder’s obligations, and the whole thing would fit comfortably in a long magazine article. What it describes is an approval of competence.

The centre of it is 21.A.239, the design assurance system. An applicant must show it has established, and can maintain, a system for the control and supervision of the design and of design changes of everything covered by the application. That system has to do three things: ensure the designs comply with the applicable type-certification basis and environmental protection requirements, ensure the organisation’s responsibilities under Part 21 and under its own terms of approval are properly discharged, and independently monitor compliance with and adequacy of its own documented procedures, with a feedback route to people who can make corrective action happen.

The third of those is the one that matters in practice. The organisation is required to audit itself, through a function that does not report to the engineers it is auditing. Europe does not station an inspector in the building. It requires the building to contain its own inspector.

The Handbook Is the Approval

If the design assurance system is the substance, point 21.A.243 is the artefact. The design organisation must furnish a handbook to the Agency describing, directly or by cross-reference, the organisation, the relevant procedures, and the products or changes to products to be designed. Where partners or subcontractors do design work, the handbook has to state how the organisation can give the assurance of compliance for all of it, and describe their activities and organisation in enough detail to support that statement. It must be kept amended so that it remains an up-to-date description, with copies of amendments going to EASA.

The handbook is not a filing-cabinet document. Point 21.A.265 obliges the holder not only to maintain it in conformity with the design assurance system but to “ensure that this handbook is used as a basic working document within the organisation”. The approval is, in a real sense, an approval of that book.

Around it sits 21.A.245, which is the human-resources half: staff in all technical departments in sufficient numbers and with sufficient experience, given appropriate authority to discharge their responsibilities, with adequate accommodation, facilities and equipment, and “full and efficient coordination between departments and within departments” on airworthiness and environmental protection. The terms of approval issued under 21.A.251 then fix the boundaries: the types of design work, the categories of products, and the functions and duties the organisation may perform.

The Privileges, Which Are Considerable

Point 21.A.263 is where the approval pays for itself, and it has two halves.

The first is passive. Subject to the Agency’s right of investigation, EASA “shall accept without further verification” the compliance documents a DOA holder submits when seeking approval of flight conditions for a permit to fly, a type certificate or approval of a major change to a type design, a supplemental type certificate, an ETSO authorisation, or a major repair design approval. The documents are not re-checked. That is the commercial value of the approval, and it is why every serious European design house holds one.

The second half is active, and it is the part that has no neat American equivalent. Within its terms of approval and under its own procedures, a DOA holder may classify changes to type design and repairs as major or minor; approve minor changes and minor repairs itself; approve minor revisions to the aircraft flight manual; approve the design of major repairs to products for which it holds the type certificate, supplemental type certificate or ETSO authorisation; approve the conditions under which a permit to fly may be issued; and in defined circumstances issue the permit to fly.

When it uses those privileges it marks the document with a specific sentence, laid down word for word in the regulation: “The technical content of this document is approved under the authority of DOA ref. EASA. 21J. [XXXX].” A European engineering order carries the organisation’s own approval number, not a regulator’s signature.

And point 21.A.265(d) closes the loop: the holder must provide EASA with statements and documentation confirming compliance for everything except the minor changes and repairs it approved under the privilege. Those simply never reach the Agency.

It Is Not an ODA, and the Difference Is the Verb

The American system delegates. Title 14 CFR Part 183 creates representatives of the Administrator, and the grammar gives the game away. A designated engineering representative “may approve” information in his field “within limits prescribed by and under the general supervision of the Administrator, whenever the representative determines” that it complies. A Designated Airworthiness Representative may perform examinations and inspections and issue certificates, again under the Administrator’s general supervision. These are individuals wearing the regulator’s hat for a defined purpose.

The Organization Designation Authorization moved that into companies without changing its nature. Point 183.41(a) describes an ODA as an authorisation “which allows an organization to perform specified functions on behalf of the Administrator”, and 183.41(b) defines an ODA Unit as “an identifiable group of two or more individuals within the ODA Holder’s organization that performs the authorized functions”. On behalf of the Administrator. The FAA’s authority is lent out and remains the FAA’s.

A DOA does not work that way. Nothing in Subpart J says a DOA holder acts on behalf of the Agency. When a DOA holder approves a minor repair, it is exercising a privilege that attaches to its own approval, under its own procedures, and signs it with its own EASA.21J reference. Europe approves a capability and then stands back; America lends an authority and keeps hold of it.

The practical consequences diverge accordingly. An ODA raises questions about who inside the company the delegated individual really answers to — the reason 14 CFR 183.57 exists at all. A DOA raises a different question: whether the organisation’s own independent monitoring function under 21.A.239 is doing its job. EASA’s answer to that is 21.A.257, which obliges the organisation to let the Agency investigate it, its partners and its subcontractors, and to let EASA review any report and perform or witness any flight or ground test needed to check the validity of its compliance statements. Findings are then graded, a level one finding being a non-compliance that could lead to uncontrolled non-compliances and affect safety.

EASA’s own technical presentation on design organisation approval and certification — the regulator explaining the mechanism in its own words.

Why an American Approval Does Not Simply Appear in Europe

None of this means the two sides distrust each other. The FAA and EASA operate under Technical Implementation Procedures, now at Revision 7, and paragraph 1.3.1 of that document rests the whole arrangement on “mutual confidence in the FAA’s and EASA’s technical competence”.

The recognition is of the systems, each side’s designee or design and production organisation arrangements included. What it is not is automatic transfer of a certificate. An applicant wanting an American approval recognised in Europe applies for validation, and the TIP sets out three routes: acceptance, streamlined validation, and technical validation. Where a design change qualifies as basic, the validating authority may simply accept it. Where it is streamlined, the TIP gives the validating authority a fixed window — 15 working days to issue for a design change, 20 for a type certificate.

The sting is in the default. Under paragraph 3.5.3.2(a) an application for validation of a type certificate is classified as non-basic except for certain reciprocating engine and propeller type certificates and their changes. Major design changes, supplemental type certificates among them, become non-basic the moment they touch a listed criterion such as a safety emphasis item or a new special condition. Interesting aeroplanes are, almost by definition, full of those. The quick routes exist; the aircraft most people care about rarely qualify for them.

Where the two systems do lean directly on each other is instructive. The TIP has the FAA accepting EASA repair design data when it is backed by a repair design approval issued under a DOA. The American authority is, in that specific case, relying on the European organisational approval rather than on a European government signature — which is as close as the two philosophies come to touching.

Cologne Does Its Own Arithmetic

The most public demonstration of what organisational independence buys came with the Boeing 737 MAX. Europe did not take the American return-to-service decision as read. EASA ran its own extensive analysis and published its own airworthiness directive, weeks after the FAA had moved.

Mutual recognition of systems and independent assessment of aircraft are not in tension. They are the two halves of the same bargain: each authority trusts the other’s machinery enough to build procedures on it, and neither signs the other’s homework unread.

A useful primer on why certifying a commercial aircraft across several jurisdictions is so much harder than certifying it once.

The Door for Small Organisations

A rule that makes a design organisation approval the price of entry would be brutal for a two-engineer firm modifying light aircraft, and Europe knows it. Point 21.A.14 carries its own derogations. An applicant may instead seek the Agency’s agreement to use procedures setting out the specific design practices, resources and sequence of activities needed to comply — the route generally known as alternative procedures to DOA — where the product is an ELA2 aircraft, an engine or propeller installed in an ELA2 aircraft, a piston engine, or a fixed or adjustable pitch propeller.

The same structure appears for supplemental type certificates at 21.A.112B: a DOA by default, alternative procedures by agreement with the Agency as a derogation, and a third route through Agency approval of a certification programme for the smaller aircraft defined in 21.A.14(c). And under 21.A.233(b) an organisation may apply for a DOA limited to the approval of minor changes and minor repair design, purely to obtain the corresponding privileges. The approval scales down; it does not disappear.

That last route is quietly important to anyone who keeps an old aeroplane airworthy in Europe. A design organisation holding the right privileges can approve the conditions for a permit to fly and, in defined circumstances, issue one — which is the legal basis on which a great many ex-military jets, the L-39 Albatros among them, still fly over European countryside rather than sitting on museum plinths.

A straightforward walk through type certification for anyone who wants the wider process rather than the European variation on it.

Two Answers to One Question

Both systems are solving the same problem. No regulator on earth has enough engineers to check every compliance finding on a modern airliner, so both have to borrow competence from the companies they regulate. America borrows people and keeps the authority. Europe certifies the company and hands over the authority, bounded by terms of approval, a handbook and an audit function the company has to run on itself.

Neither is obviously safer. What is striking is how rarely anyone outside the certification world knows the difference exists — and how much of the friction in getting an aeroplane approved on both sides of the Atlantic comes from the fact that the FAA and EASA are not two versions of the same institution doing the same job, but two institutions that answer a question Europe asks first and America asks last.

Sources: Regulation (EU) No 748/2012, Annex I (Part 21), points 21.A.14, 21.A.112B and 21.A.231 to 21.A.265, via EUR-Lex; 14 CFR 183.29, 183.33 and 183.41 via eCFR; Technical Implementation Procedures for Airworthiness and Environmental Certification between the FAA and EASA, Revision 7; EASA press release, 27 January 2021.