Rwanda’s new oversight strategy will use operational risk, safety performance, compliance history and occurrence data to determine where regulatory attention is concentrated.
Rwanda has adopted a five-year strategy that will change how its civil aviation regulator determines surveillance priorities, allocates inspectors and responds to non-compliance.
Announced by the Rwanda Civil Aviation Authority (RCAA) on 22 July 2026, the Risk-Based Oversight Strategy 2026–2030 moves the country away from an oversight system centred primarily on compliance checks and fixed inspection cycles. Regulatory attention will instead be directed according to operational risk, the complexity of an organisation’s activities, its compliance record, Safety Management System performance and reported occurrences.
Compliance requirements remain in place, but surveillance will no longer be applied uniformly. Operators presenting greater safety exposure may receive more frequent and targeted attention, while those with stronger Safety Management Systems and clean audit histories could be subject to reduced routine surveillance.
RCAA has aligned the strategy with ICAO Annex 19 on Safety Management, the ICAO Safety Oversight Manual, the Safety Management Manual, the Global Aviation Safety Plan and Rwanda’s State Safety Programme. The regulator has also linked its implementation to Rwanda Vision 2050, the National Strategy for Transformation and the country’s ambition to develop as a regional aviation and logistics hub.
From Fixed Inspection Cycles to Risk Profiles
A proposed operator-scoring framework lies at the centre of the new approach. Operational complexity will account for 30% of an operator’s risk assessment, followed by compliance history and SMS effectiveness at 25% each, and occurrence rate at 20%.
Fleet size, route structure, international and specialised operations, organisational growth, audit findings, repeat findings, enforcement action and the time taken to complete corrective measures will all influence the assessment. The regulator will also examine hazard-reporting culture, safety-assurance processes, accidents, incidents and severity trends.
Under the model described in the strategy, organisations scoring above 80 will be classified as high risk and subjected to continuous and targeted surveillance. Scores from 50 to 80 will fall into the medium-risk category, with scheduled and thematic surveillance. Operators scoring below 50 will be classified as low risk and receive reduced routine surveillance.
Risk classifications will not be permanent. RCAA plans to review scores quarterly, conduct a comprehensive reassessment each year and initiate an immediate review following a significant occurrence or organisational change.
Initial assessments will be conducted by the responsible technical inspectorate before being reviewed by a multidisciplinary Safety Risk Review Committee. The director responsible for the relevant oversight function will approve the classification, while significant changes affecting surveillance priorities or resource allocation will require endorsement from the Deputy Director General.
Building the Safety Intelligence System
The effectiveness of the model will depend heavily on the quality, consistency and availability of safety data. RCAA plans to establish a centralised repository combining mandatory occurrence reports, inspection and audit findings, Flight Data Monitoring information, Air Traffic Services reports, aerodrome occurrences, wildlife strikes and enforcement records. Regional and international safety information will also feed into the system.
A digital oversight platform will support operator risk profiles, trend monitoring, surveillance planning and predictive analysis. Before procuring new software, RCAA intends to assess its existing ICT capability, integration requirements, cybersecurity arrangements, data-protection needs and long-term system support.
The Directorate of Flight Safety Standards will manage the Safety Intelligence System in collaboration with the Aviation Infrastructure and Security Standards function. Data ownership, quality controls, confidentiality safeguards, retention requirements and information-security responsibilities will be formalised as part of the system.
By June 2028, RCAA aims to have integrated at least 90% of identified safety-data sources and placed its Safety Intelligence Dashboard into full operation. The dashboard carries a target of 95% annual system availability, while 95% of mandatory safety reports should be uploaded within 10 working days of receipt.
Moving SMS Oversight Beyond Documentation
Safety Management System oversight will examine whether an organisation’s safety processes work in practice, rather than concentrating mainly on whether the required manuals and procedures exist.
Assessments will cover safety policy and objectives, risk management, safety assurance, safety promotion and organisational culture. The resulting SMS maturity score will form part of the operator’s wider risk classification.
For operators, the change places greater emphasis on demonstrable hazard identification, internal reporting, risk mitigation and continuous improvement. A technically compliant SMS that produces limited safety intelligence or fails to address recurring findings could affect an organisation’s risk profile and the intensity of subsequent oversight.
RCAA wants hazard reporting to increase by at least 20% annually against the 2026 baseline. All applicable service providers are expected to undergo an SMS maturity assessment at least once every two years, while systemic safety findings are targeted for a reduction of at least 10% annually.
The strategy also calls for a State Safety Risk Register, supported by measurable Safety Performance Indicators and Safety Performance Targets. Information from that register will be used to connect national safety priorities with inspections and other surveillance activity.
Matching Enforcement to Safety Consequences
Enforcement decisions will consider the severity of the risk, repeated non-compliance, intentional conduct, systemic weaknesses and potential safety consequences.
Depending on the circumstances, regulatory action may include corrective action plans, increased surveillance or operational limitations. Cases involving intentional or systemic non-compliance may be escalated, while the stated aim is to apply regulatory intervention consistently and in proportion to the underlying safety exposure.
RCAA has set a target for at least 90% of corrective actions to be closed within agreed timeframes. Repeat regulatory violations are expected to fall by at least 15% by 2030, and every enforcement decision should be supported by a documented risk assessment.
Turning the Strategy into Regulatory Practice
Implementation begins with the development of an RBO policy manual and a detailed risk-scoring methodology. The first phase also covers the establishment of the Safety Risk Review Committee, inspector training, stakeholder awareness, pilot implementation and the creation of baseline performance indicators.
Between 2027 and 2028, RCAA plans to introduce the Safety Intelligence Dashboard, integrate the State Safety Risk Register and move to full risk-based oversight implementation. Predictive analytics, a review of the risk algorithm, international benchmarking, an effectiveness assessment and preparation for ICAO validation are scheduled for 2029 and 2030.
Inspectorate capability is one of the strategy’s six pillars. All inspectors are expected to complete risk-based oversight training by June 2028 and obtain certification against the RCAA competency framework by December 2029. Each inspector will also be required to complete at least 40 hours of continuing professional development annually.
Implementing the system will require dedicated funding for inspector training, ICT infrastructure, data-analysis tools, technical assistance, Flight Data Monitoring equipment and software, specialised services and international benchmarking. These requirements are intended to be incorporated into RCAA’s annual planning and budgeting processes.
For certificate holders and aviation service providers, engagement will extend beyond responding to inspections. RCAA plans to hold awareness workshops, publish risk-scoring guidance, provide inspector manuals and frequently asked questions, convene stakeholder consultations and share safety information periodically.
The regulator has asked the industry to strengthen safety reporting, improve the practical effectiveness of Safety Management Systems and participate in the management of shared safety risks. Its performance targets include annual risk assessments for every certificated operator, completion of at least 90% of planned surveillance activity and documented risk assessments supporting every enforcement decision.
Get the full plan here: https://www.caa.gov.rw/service-details/default-a5b3cd579cc60caf4770b658c4dba3aa
