Compliance with Part-SPA.EFB is no longer a “nice-to-have” for European operators; it is a critical regulatory hurdle that determines the safety and efficiency of a modern flight deck. Since the transition of EFB guidance from AMC 20-25 to the legally binding framework of Annex V (Part-SPA) to Regulation (EU) No 965/2012, the requirements for obtaining operational approval have become significantly more rigorous.

This guide provides a comprehensive deep-dive into the technical and procedural demands of SPA.EFB.100, offering a roadmap for operators to move from paper-heavy cockpits to a fully approved, paperless environment.

Where the EFB rules actually live: two provisions, not one

Before going further, it is worth being precise about something the industry routinely muddles. EFB requirements do not sit in one place. Commission Implementing Regulation (EU) 2018/1975 — “amending Regulation (EU) No 965/2012 as regards air operations requirements for sailplanes and electronic flight bags” — inserted them into two different annexes at once:

• Use — point CAT.GEN.MPA.141, “Use of electronic flight bags (EFBs)”, inserted into Annex IV (Part-CAT) of Regulation (EU) No 965/2012. This is the day-to-day obligation that applies to every commercial air transport operator using an EFB.
• Approval — a new Subpart M “Electronic Flight Bags (EFBs)” inserted into Annex V (Part-SPA), containing point SPA.EFB.100, “Use of electronic flight bags (EFBs) — operational approval”. This is the specific approval that type B applications bring with them, and it is the subject of this guide.
• The same regulation inserted equivalent provisions for other operation types — NCC.GEN.131 into Annex VI and SPO.GEN.131 into Annex VIII — so non-commercial complex and specialised operators are not outside the framework.

The practical consequence: you can be fully compliant with the use requirements in Part-CAT and still not hold the approval you need under Part-SPA. Operators who read only one of the two provisions tend to discover the gap during an audit rather than before one.

For the benefit of the reader, Raven offers the industry-leading EFB Administrator Course.

1. Understanding the Regulatory Scope of Part-SPA.EFB

The “SPA” in Part-SPA.EFB stands for “Specific Approvals”. Unlike general operating rules, specific approvals require an operator to demonstrate to their National Aviation Authority (NAA) that they have the specific equipment, training, and procedures in place to manage high-risk digital functions.

Type A vs. Type B Applications: The Legal Threshold

The foundation of Part-SPA.EFB compliance is the classification of software.

• Type A Applications: These are generally non-interactive document viewers (e.g., PDF manuals, catering menus). Malfunctions have a minor safety effect, and they do not require prior Authority approval.
• Type B Applications: These are the focus of SPA.EFB.100. They include performance calculators (Takeoff/Landing speeds), mass and balance tools, and interactive navigation charts. Because a failure here can have a significant safety impact, they mandate a formal operational approval.

2. The Three Pillars of SPA.EFB.100 Approval

To satisfy a Part-SPA.EFB audit, an operator must provide documented evidence across three distinct areas of concern.

I. Risk Assessment (AMC1 SPA.EFB.100(b)(1))

The regulator requires a formal “Safety Risk Assessment” (SRA) for the hardware and all Type B applications. You must identify the “worst credible” failure scenarios, such as the presentation of undetected erroneous output during a performance calculation.

• Mitigation Strategies: Your assessment must link every hazard to a specific mitigation, such as independent calculations by both pilots to cross-check V-speeds.

II. Human-Machine Interface (HMI) Assessment

Under AMC1 SPA.EFB.100(b)(2), the HMI assessment is key to identifying workload-related risks.

• Visual Integrity: Screens must be legible in direct sunlight and dimmable for night flight without affecting night vision.
• Cognitive Ergonomics: The “look and feel” should be consistent with aircraft avionics to prevent confusion during high-workload phases.

III. The Administration System (AMC1 SPA.EFB.100(b)(3))

The law mandates the appointment of a designated EFB Administrator. This individual serves as the “Primary Link” between the operator, the software suppliers, and the Authority. They are legally accountable for Configuration Control, ensuring no unauthorized software (like personal apps) is installed on the operational device.

3. The Operational Evaluation Test (OET)

The Operational Evaluation Test (OET) is the “real-world” proving period required by AMC3 SPA.EFB.100(b).

• Duration: The standard duration is six months. During this time, crews fly with the EFB while maintaining paper backups to prove the system’s reliability.
• Success Criteria: The OET must demonstrate that the EFB provides at least the same level of accessibility and reliability as the paper it replaces.
• Final Operational Report: The culmination of the OET is a comprehensive report summarizing pilot feedback, hardware failures, and procedural updates. This report is the final piece of evidence submitted to the NAA for the grant of approval.

4. Hardware Suitability & Battery Safety

Part-SPA.EFB compliance extends to the physical hardware.

• Rapid Decompression Testing: For pressurized aircraft, the EFB model must have evidence of passing DO-160 decompression standards.
• Lithium Battery Protocols: Procedures must exist for the immediate isolation of devices showing signs of swelling or heat degradation.
• Environmental Suitability: The hardware must be assessed for EMI (Electromagnetic Interference) and its ability to withstand turbulence without becoming a projectile.

5. The Part-IS Convergence and Data Integrity

The most significant evolution in Part-SPA.EFB compliance is its recent convergence with EASA Part-IS (Regulation (EU) 2023/203). Annex II to that regulation, Part-IS.I.OR, applies from 22 February 2026 under Article 16, and requires organisations in scope — air operators among them — to establish an Information Security Management System (ISMS).

Cybersecurity as a Flight Safety Mandate

Historically, EFB security was managed as a localized IT concern. Under the new Part-IS framework, however, the EFB is recognized as a primary vector for cyber threats that can directly impact flight safety. The EFB Administrator‘s duty to prevent “unauthorized intervention” (AMC3 SPA.EFB.100(f)) now feeds directly into the organizational ISMS.

• IS.I.OR.205 (Information security risk assessment): the organisation must identify all its elements which could be exposed to information security risks — including the equipment, systems, data and information that support its activities and services. EFB hardware and Type B data such as take-off performance databases sit squarely inside that set, so corruption of this data is not just a technical glitch.
• IS.I.OR.220 (Information security incidents — detection, response, and recovery): if a pilot’s device is compromised by malware or a “spoofed” database update, the organisation needs a route to detect it, contain it and recover — with the internal reporting scheme under IS.I.OR.215 carrying it to the people who can act.

Bridging the Awareness Gap

A compliant Part-SPA.EFB operation requires more than just technical locks; it requires a culture of security. Part-IS mandates that all personnel with access to safety-critical systems must have a high level of security awareness to act as a “human firewall” against phishing and unauthorized media (e.g., infected USB drives).

To meet this legal requirement, many operators are integrating formal awareness training into their compliance roadmap. For a deep dive into these mandatory organizational requirements, we recommend our EASA Part-IS Awareness Training, which provides the necessary foundation for both flight crew and ground staff to operate within an approved ISMS.

Securing the Data Lifecycle

Beyond the Part-IS framework, the EFB Administrator must maintain the Chain of Trust through the “Download → Test → Release” cycle. This ensures that every update for a Type B application is validated for integrity before it reaches the cockpit, protecting the operation from the “undetected erroneous output” that Part-SPA.EFB is specifically designed to prevent.

6. Flight Crew Training and Competency

Finally, AMC4 SPA.EFB.100(b)(3) mandates a specific training syllabus for all crew members. This training is not about basic airmanship; it focuses on the Standard Operating Procedures (SOPs) of the EFB system itself.

• Syllabus Requirements: Training must cover system architecture, limitations, cross-checking protocols, and emergency procedures (e.g., battery fire).
• Map Fixation: A key human factors check involves ensuring pilots do not fixate on moving map displays during critical phases like taxiing.

The EFB use requirements in detail

This guide covers the approval side of the framework. The use obligations under CAT.GEN.MPA.141 are a separate body of work, and one that reaches far more people — every crew member touching an EFB, not just the administrator preparing a submission. We have covered them in detail:

• What EASA Actually Requires of an Electronic Flight Bag — how CAT.GEN.MPA.141 frames the obligation, and where the Acceptable Means of Compliance fit.
• Type A vs Type B: How EASA Classifies EFB Applications — the classification that decides whether you need an approval at all.
• Using an EFB in the Flight Deck: Mounting, Stowage and Critical Phases — the physical conditions on which lawful use depends.
• The Gross-Error Check: Why Pilots Still Verify EFB Performance Figures — the cross-check that catches the failure mode this whole framework exists to prevent.
• When the EFB Fails: Redundancy, Security and Staying Compliant — what happens when the device does not cooperate.

Conclusion: Implementing Part-SPA.EFB

Achieving Part-SPA.EFB approval is a multi-layered project that requires a deep understanding of EASA’s Acceptable Means of Compliance. For organizations looking to streamline this process, having a qualified EFB Administrator is essential.

To bridge the gap between regulatory theory and operational practice, Raven offers the industry-leading EFB Administrator Course. This course is specifically designed to provide the knowledge, skill and competence needed to satisfy an NAA inspector and achieve a successful Part-SPA.EFB operational approval.

FAQ