Section 139.401 - General requirements(a) Each certificate holder or applicant for an Airport Operating Certificate meeting at least one of the following criteria must develop, implement, maintain, and adhere to an Airport Safety Management System pursuant to the requirements established in this subpart. If the certificate holder: (1) Is classified as a large, medium, or small hub based on passenger data extracted from the Air Carrier Activity Information System;(2) Has an average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures, over the previous three calendar years; or(3) Is classified as a port of entry, designated international airport, landing rights airport, or user fee airport.(b) The scope of an Airport Safety Management System must encompass aircraft operation in the movement area, aircraft operation in the non-movement area, and other airport operations addressed in this part.(c) The Airport Safety Management System should correspond in size, nature, and complexity to the operations, activities, hazards, and risks associated with the certificate holder's operations.(d) If a certificate holder qualifies exclusively under paragraph (a)(3) of this section and has no tenants that are required to comply with SMS requirements of any jurisdiction, the certificate holder is eligible for a waiver from the requirements of paragraph (a) of this section.(1) To obtain the waiver, the certificate holder must submit a written request to the Regional Airports Division Manager justifying its request.(2) If FAA grants a certificate holder's request for a waiver, the certificate holder must validate its waiver eligibility to the Regional Airports Division Manager every two years.(e) If an airport has a tenant required to maintain a SMS subject to the requirements of part 5 of this title, then the certificate holder may develop a data sharing and reporting plan to address the reporting and sharing of hazard and safety data with the tenant.(1) Any data sharing and reporting plan must include, at a minimum:(i) The types of information the certificate holder expects the tenant to share;(ii) The timeliness of sharing relevant safety data and reports;(iii) Processes for analyzing joint safety issues or hazards;(iv) Other processes, procedures, and policies to aid the certificate holder's compliance with its obligations under the Airport Safety Management System; and(v) Identification of the mechanisms through which the certificate holder will ensure compliance with the plan to achieve the full implementation of the requirements.(2) With a data sharing and reporting plan, the requirement for the certificate holder to provide safety awareness orientation to the tenants or their employees under § 139.402(d)(1) is waived.(3) The certificate holder remains the ultimate responsible party for compliance with its Airport Safety Management System.(f) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must describe its compliance with the requirements identified in § 139.402 , either: (1) Within a separate section of the certificate holder's Airport Certification Manual titled Airport Safety Management System; or(2) Within a separate Airport Safety Management System Manual. If the certificate holder chooses to use a separate Airport Safety Management System Manual, the Airport Certification Manual must incorporate by reference the Airport Safety Management System Manual.(g) On an annual basis or upon FAA request, the certificate holder shall provide the FAA copies of any changes to the Airport Safety Management System Manual.(h) A certificate holder that starts implementation of an Airport Safety Management System but no longer qualifies under paragraph (a) of this section must continue to develop, implement, maintain, and adhere to its Airport Safety Management System for the longest of the following periods:(1) Twenty-four consecutive calendar months after full implementation; or(2) Twenty-four consecutive calendar months from the date it no longer qualifies under paragraph (a) of this section.