Safety Oversight Across Saudi's Expanding Airport Network: Standardising at Scale

This is for the person holding group accountability for safety across more than one Saudi aerodrome: a cluster company head of safety, a Matarat-level assurance lead, or the consultant asked to make one SMS work across sites never designed to share anything. After reading it you should be able to decide, element by element, what belongs in a group standard and what must be set locally, and have a defensible order of operations for bringing a new site onto a common system without disturbing its certificate.

How the Saudi airport system is structured

The regulator and the operator are separate legal entities, and that matters more than it sounds. The General Authority of Civil Aviation issues licences, permits and certificates and conducts safety oversight. Matarat Holding is a closed joint-stock company affiliated with GACA, established on 13 April 2013, operating the Kingdom's civilian airports through four subsidiaries: Riyadh Airports Company, Jeddah Airports Company, Dammam Airports Company and the Second Airports Cluster Company. Saudipedia records 27 airports across them, 13 international.

The consequence is that the certificate does not sit with the group. GACA does not certificate "Matarat" or "Cluster 2". It certificates an aerodrome, against a manual submitted for that aerodrome, with named accountable personnel for that aerodrome. A group standard is therefore never self-executing. It becomes binding only when incorporated into each site's own aerodrome manual and accepted SMS, which makes every group-level change a manual amendment at every site. An inspector reads the site manual, not the group intranet.

What each aerodrome must hold in its own name

GACA's published aerodrome certification and authorisation service lists what an applicant submits. Read it as a list of things that must exist per site, controlled and current:

• a list of management personnel with curricula vitae and supporting testimonials
• a customised aerodrome procedures manual covering operations, emergencies, safety and security
• aerodrome obstacle survey reports
• a safety risk assessment
• an aeronautical study report, where applicable
• approval for operation of the aerodrome from the municipality
• a no objection certificate from SANS
• proof of land ownership or a lease agreement
• any further documents required by the President

Applications route through GACA's Aerodrome Safety Department. The governing regulation is GACAR Part 139, Certification, Authorization and Operation of Aerodromes, and GACA publishes the matching inspector instrument, the Aerodrome Safety Inspector Technical Inspection Checklist for GACAR Part 139. That checklist, not the regulation, is what your evidence is scored against.

[NEEDS SOURCE: validity period of a GACA aerodrome certificate, its renewal cycle, and the notice period for renewal]

[NEEDS SOURCE: GACA fees for initial aerodrome certification, variation and renewal]

[NEEDS SOURCE: the GACAR Part 139 section numbers covering SMS, self-inspection, the aerodrome emergency plan and reporting. The regulation PDF on gaca.gov.sa was not retrievable at time of writing]

The SMS obligation is not a Saudi invention. ICAO Annex 19 requires an SMS of "operators of certified aerodromes in accordance with Annex 14", built on four components: safety policy and objectives, safety risk management, safety assurance and safety promotion. Saudi Arabia's State Safety Programme sits above that, with a National Aviation Safety Plan, a National Aviation Safety Committee, performance-based oversight and an explicit just culture position.

What GACA oversight looks for at a single site

Performance-based oversight changes the character of an audit. An inspector is less interested in whether you have a hazard register than in whether it moved in response to something that happened. Three questions do most of the damage.

Traceability from occurrence to action: report received, triaged, risk-assessed, action raised, owned, closed, effectiveness checked. A break anywhere in that chain shows as a gap between dates.

Currency of the manual against the physical aerodrome: obstacle survey data, taxiway designations, works in progress, changed hot spots. A manual describing a layout that no longer exists is a finding regardless of how good the SMS paperwork is.

The accountable person actually being accountable. Named management personnel were submitted at certification. If they have changed and the change was not notified, the certificate documentation is wrong before any safety question is asked.

GACA's Electronic Safety Reporting System takes both mandatory and voluntary reports across aircraft operations, maintenance, air navigation services, aerodrome services and ground operations, aligned to GACAR Part 4. An operator therefore runs two reporting obligations at once, internal SMS reporting and external State reporting. They are not one channel and should not be built as one.

[NEEDS SOURCE: the mandatory occurrence reporting deadline under GACAR Part 4, and which occurrence categories are mandatory for aerodrome operators]

[NEEDS SOURCE: GACA's audit frequency for certificated aerodromes, and finding classification and closure timescales]

Making numbers from many aerodromes mean the same thing

Past roughly three aerodromes, the binding constraint stops being compliance at each site and becomes comparability across sites. A group cannot direct money or people if a bird strike is coded "wildlife" at one site and "environmental" at another, if one site records a runway incursion only when ATC files it while another records every unauthorised entry to a manoeuvring area, or if "high risk" means a 4x4 matrix cell here and a 5x5 cell there. The failure is quiet. Nobody reports an error. The group dashboard produces a ranking that reflects local coding conventions rather than local risk, and resources follow it.

Five things carry the aggregation, and each must be genuinely identical rather than similar.

A common hazard taxonomy. One controlled, versioned list with definitions and inclusion notes per code. Aligning the top level to ICAO occurrence categories keeps State-level and group-level numbers reconcilable, but the value is in the second and third levels where local terminology diverges. Cap free-text "other" or it becomes your largest category within a year.

A common risk matrix. Same axes, same cell count, same severity descriptors, same likelihood definitions. If severity 3 means "serious injury or major aircraft damage" at one site and "significant operational disruption" at another, the matrix cannot be summed.

Common SPIs with locally set alert levels. This is the pivot of the design. Indicator definition, numerator, denominator and measurement period are group standards. Alert level and target are local. Runway incursions per 10,000 movements is one indicator across the network, but the threshold at a 200,000-movement international aerodrome and a 4,000-movement regional one cannot be the same number without either flooding the small site with false alerts or blinding the large one.

One reporting channel with local triage. Single intake form, single set of mandatory fields, single reference number series. Triage stays with the aerodrome safety officer who knows the taxiway and the contractor.

A shared investigation methodology. Same causal model, contributory factor list, evidence standard and template. Without it, one site produces "human error" and another a systemic finding about procedure design, and the group learns from neither.

Standardise centrally or set locally

Element	Central or local	Why
Hazard taxonomy and occurrence codes	Central, single controlled list	Aggregation fails if two sites code the same event differently
Risk matrix axes, cell count, severity descriptors	Central	A group heat map only sums if the cells mean the same thing
Risk acceptance authority	Central rule, local post-holder	The threshold is group appetite; the person is a site fact
SPI definitions, numerator, denominator, period	Central	Comparability across sites and against State indicators
SPI alert levels and targets	Local, ratified centrally	Movement volumes differ by an order of magnitude across the network
Occurrence report form and reference numbering	Central	One intake means one dataset and no reference collisions
Triage and initial risk classification	Local	Only the site knows the stand, the contractor and the works
Investigation methodology and templates	Central	Cross-site learning needs comparable causal analysis
Corrective action register schema and status vocabulary	Central	Central visibility requires identical status meanings
Corrective action ownership and due dates	Local	The person who can close it works at the aerodrome
Aerodrome manual structure and change control	Central template, local content	Each certificate is site-specific; the shell can be common
Aerodrome-specific hazard register	Local	Terrain, wildlife, weather and adjacent land use do not generalise
Runway safety team	Local	ICAO defines it as a local body for that aerodrome
Aerodrome emergency plan and exercises	Local, central minimum standard	Mutual aid, hospitals, civil defence and access roads are site facts
Safety training curriculum	Central core, local annex	SMS fundamentals are common; airside driving hazards are not
Contractor and works-in-progress controls	Central procedure, local permits	The permit is issued against a specific taxiway on a specific night

The local column is not a concession. ICAO's Runway Safety Team Handbook states the runway safety team is "considered an activity of the SMS of the aerodrome operator, which coordinates safety issues from all the users of that aerodrome", drawing membership from the aerodrome operator, air traffic services, aircraft operators, flight crew familiar with that aerodrome, and controller and pilot association technical experts. Its output is a master hazard register with current controls, risk analysis, mitigations, an implementation plan with owners and timelines, and residual risk. One group cannot hold a single runway safety team for 27 runways.

Bringing a new aerodrome onto the group SMS

Run this as a controlled transition. The site operates under a live certificate throughout, and the old system cannot be switched off before the new one is accepted.

1. Baseline the site as it is. Copy the current aerodrome manual, hazard register, 24 months of occurrence reports, open corrective actions, SPI history and the last GACA audit report with findings and closure evidence. Freeze and date the copy.
2. Map the local taxonomy to the group taxonomy. Build an explicit crosswalk code by code and record every code with no clean equivalent. Do not delete history, map it.
3. Re-score history through the group risk matrix. At minimum, re-score every event previously classed at the top two severity levels. If the distribution shifts sharply, either the crosswalk is wrong or the local matrix was applied loosely.
4. Set local SPI alert levels from the site's own history. Use the site's movement data and its own rates. A threshold inherited from a larger aerodrome misfires from week one.
5. Confirm the accountable executive and named safety post-holders. Check against the management personnel list submitted to GACA at certification. Any difference is a notification obligation, not an internal HR matter.
6. Draft the aerodrome manual amendment. Adopt the group SMS structure while preserving site-specific content: hazards, emergency plan, layout, works procedures. Version, date and change-log every affected section.
7. Submit to GACA and wait. Do not migrate live reporting before the amendment status is known. [NEEDS SOURCE: GACA's required notice period and acceptance process for aerodrome manual amendments under GACAR Part 139]
8. Stand up or re-charter the local runway safety team. Confirm membership against the ICAO categories, agree terms of reference including data sharing protections, set the first meeting and standing agenda.
9. Run both reporting channels in parallel for one full cycle. Same events entered twice, reconciled weekly. You are testing whether the group form captures what the site needs to record.
10. Train and assess rather than brief. Assess triagers by having them classify 20 historical events against the group's own classification of the same events.
11. Transfer open corrective actions with owners and original raise dates intact. Resetting due dates on migration is the commonest way a group loses its ageing profile and its credibility with the regulator.
12. Cut over, then hold a 90-day assurance review. Check report volume, classification consistency, closure rate, and whether any alert level fired or should have. Retire the old system read-only and log the transition itself as a management of change record.

Where teams get this wrong

Report volume is read as a safety signal. Reports usually fall after cutover. The near-universal cause is friction in the new form. Treat any post-cutover drop as a usability defect until proven otherwise.

The group re-triages. Central teams quietly reclassify site reports they disagree with. The site notices within two cycles and stops investing in initial classification. Audit classification quality quarterly and coach, do not overwrite.

Alert levels are set once and never revisited. A level derived from a two-year-old baseline will be either permanently breached or never breached.

Actions close on activity rather than effect. "Toolbox talk delivered" is not closure for a vehicle incursion hazard. Give the register a separate effectiveness check field with its own date, or the open-action count measures administration rather than risk.

Local hazards get pruned to fit the central register. A hazard about a specific wadi crossing that floods, or a seasonal bird movement, may have no group code. If the taxonomy has no home for it, the taxonomy is wrong.

What to automate, and what not to

Automation earns its place where the work is clerical and high-volume: intake and deduplication of reports, applying the taxonomy consistently, calculating SPIs from movement data without anyone rebuilding a spreadsheet, ageing and escalating open actions, and assembling the evidence pack an inspector asks for. Each is individually trivial and collectively impossible across 27 sites.

It does not help with the judgement calls. Whether an event is severity 3 or 4, whether a mitigation addresses the causal factor, whether a runway safety team's action plan is credible: those are conversations between people who know the aerodrome. A system that offers a suggested risk score will find the suggestion becomes the answer within a month. If you deploy anything of that kind, log the suggestion and the human decision separately so you can see how often they diverge.

Where a system helps

The workflow that benefits most is the one crossing site boundaries: one intake form feeding a taxonomy that cannot be edited locally, per-site alert levels held against a shared indicator definition, and a corrective action register where the group sees every open action with its original raise date, owner and ageing without asking for a status update. KreupAI's aviation safety solution is built around that shape of problem, with triage kept at the aerodrome rather than pulled to the centre.

It does not create or hold your GACA certification, and no software should be described to a regulator as if it does. The certificate rests on your aerodrome manual, your named post-holders and your evidence.

Related reading: KB-015 [title to confirm at publication] and KB-107 [title to confirm at publication].

FAQ

Does a group safety policy apply automatically at every aerodrome in the network? No. Each aerodrome holds its own certificate against its own manual and accepted SMS. A group policy takes effect at a site only once incorporated into that site's manual through the amendment process. Until then an inspector reading the site manual will not see it.

Can we use one SPI alert level across all our aerodromes? Use one indicator definition, but not one alert level. A threshold calibrated to a high-volume international aerodrome will almost never fire at a small regional one, and the reverse produces constant false alerts at the large sites.

Should the central team triage incoming reports? Triage belongs at the aerodrome. The person who knows which contractor was on which stand that night classifies faster and more accurately than anyone at head office. Central's role is visibility, quarterly classification audits and cross-site pattern detection.

Do we still need a runway safety team at every aerodrome if we have a group safety committee? Yes. ICAO frames it as an activity of that aerodrome operator's SMS, coordinating the users of that specific aerodrome, with membership from local air traffic services, aircraft operators and flight crew familiar with the site. A group committee cannot perform that function.

How do we handle historical data that does not fit the new taxonomy? Map it rather than delete it. Keep the original code as a retained field and flag every event where the mapping was uncertain. You need the history to set credible alert levels.

Sources

• GACA: Aerodrome Certification / Authorization service, required documents
• GACAR Part 139: Certification, Authorization and Operation of Aerodromes
• GACA: Electronic Safety Reporting System, aligned to GACAR Part 4
• GACA: KSA State Safety Program
• GACA: Certification and Licensing Standards department
• GACA: Aerodrome Safety Inspector Technical Inspection Checklist, GACAR Part 139
• ICAO Annex 19: Safety Management
• ICAO Runway Safety Team Handbook, 2nd Edition
• Saudipedia: Matarat Holding Company