Europe Aviation Compliance 2026: EU ETS, ReFuelEU, Part-IS

On January 1, 2026, European airlines lost the last of their free EU ETS carbon allowances. Free allocation fell 25% in 2024, another 50% in 2025, and hit zero this year: every tonne of intra-EEA aviation CO2 now has to be covered by an allowance bought at auction or on the secondary market. The same week, national authorities across the bloc were finishing their first full year of enforcing a second cost line that did not exist before 2025: the ReFuelEU Aviation sustainable fuel mandate, with non-compliance penalties running as high as 14,000 euros per tonne of shortfall on synthetic fuel.

Neither change happened in isolation. Regulation (EU) 2018/1139, the EASA Basic Regulation, sits underneath a stack of implementing and delegated acts that European aviation, safety regulators, environmental regulators, and now cybersecurity regulators, are all updating on overlapping timetables. February 22, 2026 brought a third deadline into the same compliance calendar: EASA's Part-IS information security rules became applicable to essentially every EU air operator, maintenance organisation, and training organisation still in scope.

For airlines, manufacturers, MROs, and drone operators working across the EU, EEA, UK, and Switzerland, 2026 is not a year with one big rule change. It is a year where three unrelated regimes, carbon, fuel, and cybersecurity, all crossed a threshold within five months of each other, on top of a certification landscape where Europe still has not issued a single type certificate for an electric air taxi despite a seven-year regulatory head start.

Which regulators actually drive aviation compliance in Europe?

The European Union Aviation Safety Agency administers the technical rulebook under Regulation (EU) 2018/1139, but EASA does not act alone. National Aviation Authorities, France's DGAC, Germany's Luftfahrt-Bundesamt, Spain's AESA, remain the certificate-issuing and enforcement bodies for most day-to-day oversight, while the European Commission adopts the implementing and delegated acts EASA drafts, and the UK Civil Aviation Authority and Switzerland's FOCA run parallel regimes that mirror EU rules closely but not identically post-Brexit.

All of it traces back to the ICAO Chicago Convention and its 19 Annexes: a change agreed at ICAO's Assembly in Montreal, such as the CORSIA baseline or a Standard in Annex 16, eventually shows up as an EASA implementing rule, then as a national transposition. A compliance team tracking only the EU regulation misses the ICAO-level trigger that explains why the rule changed and the national-level detail, DGAC circulars, LBA guidance, that determines how it is actually enforced. Obsidian's regulatory monitoring is built around exactly that layering: the ICAO instrument, the EASA implementing act, and the national transposition tracked as one thread instead of three disconnected alerts.

How much does the end of free EU ETS allowances actually cost airlines in 2026?

Under Directive (EU) 2023/958, which amended the EU ETS Directive for aviation, free allocation to aircraft operators was cut 25% in 2024 and 50% in 2025, based on each operator's share of verified 2023 emissions, before dropping to zero from January 1, 2026. EASA's own modelling projects aviation ETS emissions growing to roughly 59.5 million tonnes of CO2 in 2026, with purchased allowances rising from 30.2 million tonnes in 2024 to 34.5 million tonnes in 2026 as the free pool disappears entirely.

The scope split matters operationally: the EU ETS covers flights within the EEA plus departing flights to Switzerland and the UK, while ICAO's CORSIA offsetting scheme applies to flights to and from third countries under the same 2023/958 directive. An airline running both intra-European and long-haul routes now reconciles two separate carbon-cost mechanisms on two separate reporting cycles, and the Commission is due to reassess CORSIA's environmental performance during 2026 with legislative proposals to follow if the global scheme is found insufficient, which could reopen the EU ETS scope question again.

What does the ReFuelEU Aviation SAF mandate require, and what happens if a supplier misses it?

Regulation (EU) 2023/2405 requires aviation fuel suppliers to blend a minimum 2% sustainable aviation fuel into conventional jet fuel at EU and EEA airports starting January 1, 2025, rising to 6% in 2030, including a 1.2% synthetic e-fuel sub-mandate, then 20% in 2035 and 70% by 2050. Separately, Article 5 requires aircraft operators to uplift at least 90% of their annual fuel needs at Union airports, an anti-tankering rule aimed at operators who carry extra fuel to avoid buying it at higher-cost airports.

Member States had to notify the Commission of their penalty regimes by the end of 2024, and the regulation itself sets a floor: non-compliance fines for fuel suppliers must be at least twice the price difference between SAF and conventional jet fuel, multiplied by the shortfall volume, and any unmet shortfall still has to be supplied the following year on top of the fine. Using EASA's 2024 reference prices, that floor works out to roughly 2,700 euros per tonne for a biofuel shortfall and close to 14,000 euros per tonne for a synthetic e-kerosene shortfall. During 2026, national competent authorities are enforcing penalties for the first time against the 2025 compliance year, and Switzerland has adopted the same 2% mandate for Zurich and Geneva airports from January 1, 2026, extending the scheme beyond the EU's own borders.

What does EASA Part-IS actually require by February 2026, and who is in scope?

Part-IS is the EU's first dedicated aviation cybersecurity regime, split across two acts with two applicability dates. Delegated Regulation (EU) 2022/1645 became applicable on October 16, 2025 for design and production organisations, airport operators, and apron management and certain ATM/ANS entities. Implementing Regulation (EU) 2023/203 became applicable on February 22, 2026 for the much larger population still in scope: AOC-holding air operators, Part-145 maintenance organisations, CAMOs, approved training organisations, and aeromedical centres.

EASA does not treat the applicability date as a hard compliance finish line but as the point by which an organisation must reach the "Present" and "Suitable" levels of its four-stage PSOE maturity model, meaning a documented information security management system, defined roles and a security policy, and an initial risk assessment covering interfaces with other organisations. Reaching "Operating" and "Effective" happens afterward, through ongoing oversight and audit by the competent authority, so an organisation that treated February 22, 2026 as a one-time deadline rather than the start of continuous supervision is already behind. For teams juggling ETS reporting, SAF compliance filings, and a new cybersecurity audit trail at once, asking Obsidian's AI to cross-check which Part-IS obligations apply to a specific organisation type against the current regulatory text turns a multi-document research task into a sourced answer.

Why hasn't Europe certified a single eVTOL aircraft despite a seven-year head start?

EASA published its Special Condition for VTOL-capable aircraft, SC-VTOL, in 2019, years ahead of the FAA's own powered-lift rulemaking, putting European electric air taxi programmes on what looked like the fastest regulatory path in the world. Seven years later, no EASA type certificate has been issued for any eVTOL design, and the sector's leading candidates have hit financial rather than technical walls: Lilium filed for insolvency in February 2025 after raising more than 1.5 billion dollars, with its certification programme now paused pending restructuring, while Volocopter was acquired by Diamond Aircraft Group in March 2025 and has pushed its VoloCity type certification target to 2027 or 2028, running a European regulatory sandbox programme with ADAC Luftrettung through 2026 to keep momentum before that certificate lands.

The lesson for manufacturers and investors is that SC-VTOL compliance, including the enhanced-category catastrophic failure rate of 10 to the power of minus 9 per flight hour, is achievable on paper, but sustaining the multi-year certification runway financially has proven harder than clearing EASA's technical bar. Any operator or supplier planning around a specific eVTOL entry-into-service date needs a live view of certification status, not the target date printed in a company's last funding announcement.

What should a European aviation compliance team prioritize now?

Map the three 2025 to 2026 deadlines, ReFuelEU SAF penalties, EU ETS full auctioning, and Part-IS applicability, against your own organisation type rather than against the industry as a whole. A fuel supplier's exposure under Regulation (EU) 2023/2405 has nothing to do with a Part-145 maintenance organisation's Part-IS obligations, and an eVTOL manufacturer tracking SC-VTOL means of compliance publications is watching a completely different EASA workstream than an airline reconciling EU ETS and CORSIA reporting for the same route network.

Obsidian tracks EASA, the European Commission, and the national civil aviation authorities behind each of these regimes at the framework level, with alerts when a delegated act, a reference-price update, or a means-of-compliance publication changes status, so your team is not the one finding out about a penalty threshold or an applicability date from a trade publication after the fact. See the plans built for regulatory-affairs and compliance teams, or connect Obsidian's MCP directly into your own tools if your workflow already runs through an AI assistant.