Regulated agents and known consignors must now report cybersecurity incidents to the director of Civil Aviation within 48 hours of becoming aware of them.
The requirement forms part of the Thirty-third Amendment of the Civil Aviation Regulations, 2026, published in the Government Gazette on August 21.
The amendment introduces regulation 108.02.3 under Part 108, which governs the duties and functions of regulated agents and known consignors.
Under the new regulation, these organisations must identify and secure critical information and communication technology systems and data used for aviation purposes.
The Gazette states that their cybersecurity measures must be aligned with applicable risk assessments and threat levels, while measures prescribed in SA-CATS 108 must also be implemented.
The scope of reportable cybersecurity incidents is not defined in the regulation itself. Instead, organisations are referred to the requirements prescribed in SA-CATS 108.
The requirements reflect wider international efforts to protect increasingly interconnected aviation systems. The International Civil Aviation Organization’s Annex 17 requires aviation entities to identify critical ICT systems and data and implement risk-based measures to protect them against unlawful interference.
Similar 48-hour reporting requirements have been introduced for other aviation security stakeholders, including aviation security training organisations, screening organisations, designated airports, air carriers and other aviation service providers.
The amended Part 110 also applies aviation security screening provisions to regulated agent facilities, along with aerodromes with scheduled operations, air-carrier facilities, air traffic control facilities and catering facilities serving civil aviation.
The amendments came into operation when they were published in the Government Gazette on August 21.
The South African Civil Aviation Authority has been approached for clarity on which incidents must be reported, the reporting process and the consequences of failing to meet the deadline.
