In March 2019, the world's regulators did something that looked simple and was anything but: they grounded an entire aircraft type. Every Boeing 737 MAX, everywhere, stopped flying within days of the second of two fatal accidents. The aircraft did not become physically incapable of flight that week. What changed was its legal standing. The thing that lets an aircraft fly is not just engineering -- it is a certificate, and a certificate can be withdrawn. Annex 8 is the rulebook for those certificates.
Annex 8 to the Convention on International Civil Aviation governs the airworthiness of aircraft: the standards that establish an aircraft is safe to fly, by design, by manufacture, and by its continued condition over a working life that can stretch for decades. Its purpose is to make a Certificate of Airworthiness mean the same thing internationally -- so that when one state certifies an aircraft as fit to fly, others can trust that judgement.
A chain of responsible states
Airworthiness is not the job of any single authority, because an aircraft's life passes through several hands. Annex 8 organises responsibility into a chain of states, each owning a phase.
- The State of Design is responsible for the original approval of the design and for the continued integrity of that design throughout the type's service life. When a design flaw emerges years later, this is the state that must act.
- The State of Manufacture oversees that aircraft are actually built to the approved design.
- The State of Registry is responsible for the individual aircraft on its register -- issuing its Certificate of Airworthiness and ensuring it stays in an airworthy condition.
This maps onto three activities: type certification (is the design sound?), production (is this aircraft built to that design?), and continuing airworthiness (does it stay sound in service?). The genius of the structure is that no single failure point owns the whole problem -- but it also means the chain is only as strong as its weakest custodian.
The Type Certificate: approving a design
Before a single example carries a passenger, the design itself must be approved. The Type Certificate is that approval -- a formal finding by the responsible authority that the design meets the applicable airworthiness requirements for its category. Annex 8 recognises that a small training aeroplane and a large transport jet cannot be held to identical detailed standards, so requirements are organised by aircraft category, with the most demanding applied to large aircraft carrying the most people.
Earning a type certificate is a years-long campaign. The manufacturer must show, through analysis, ground testing, and an extensive programme of flight testing, that the design meets every applicable requirement -- structural strength, system redundancy, performance, handling, and the ability to survive failures. The authority verifies that the aircraft built conforms to the design it approved. Only then does the type certificate issue, and it becomes the foundation on which every individual aircraft of that type stands. Later changes are controlled too: a major modification, whether by the original manufacturer or a third party, is approved through a Supplemental Type Certificate (STC), so that even improvements pass through the same disciplined gate.
The Certificate of Airworthiness
Where the type certificate approves the design, the Certificate of Airworthiness (CofA) certifies the individual aircraft. The State of Registry issues it when satisfied the aircraft conforms to its approved type design and is in a condition for safe operation. The crucial point is that a CofA is conditional and continuous, not permanent. It stays valid only while the aircraft is maintained according to the rules and remains in conformity with its approved design. Let the maintenance lapse, or fail to comply with a mandatory action, and the certificate's validity falls away with it. The certificate is a statement about the present, renewed by the work that keeps it true.
Continuing airworthiness: the long middle of a life
Most of an aircraft's existence is spent in service, and this is where airworthiness is genuinely won or lost. Continuing airworthiness covers everything that keeps an in-service aircraft fit: scheduled maintenance, the control of modifications and repairs so that changes do not quietly undermine the approved design, and -- the sharp end -- compliance with airworthiness directives.
An airworthiness directive (AD) is a mandatory instruction issued when an unsafe condition is found in a type -- a fix, an inspection, an operating limitation -- that every affected operator in the world must carry out within a set deadline. The AD system is the feedback loop that makes the whole structure self-correcting: a problem discovered on one aircraft, anywhere, flows back to the State of Design, which issues the corrective action, which propagates to every example of the type across every register. Service experience teaches the design state something, and the lesson is pushed out to the entire fleet. A cracked fitting found during a heavy check in one country can, within weeks, trigger an inspection of every identical aircraft on the planet.
A Certificate of Airworthiness is not a verdict delivered once. It is a promise kept continuously, or not at all.
A framework, not a complete code
One thing Annex 8 deliberately does not do is specify every rivet. It sets framework-level airworthiness requirements -- the broad standards a state's system must meet -- and leaves the detailed technical codes to states and the major certification authorities. This is why the granular design rules live in national and regional codes rather than in the Annex itself. ICAO defines the floor and the shape of the system; the FAA and EASA write the thick books of specifics. It is a sensible division: detailed airworthiness codes change constantly with technology, far faster than a treaty Annex could.
The same division explains how a CofA earns international trust. When one authority certifies a type, others do not blindly re-run the whole campaign; through bilateral airworthiness agreements they validate and accept each other's findings, with defined checks. That mutual recognition is what lets an aircraft designed in one country be registered and flown in dozens of others -- and it depends on every party building to the common Annex 8 framework.
How states implement it
The national codes are where airworthiness becomes concrete. Saudi Arabia exercises airworthiness oversight through the General Authority of Civil Aviation (GACA). The United States, through the FAA, uses a well-known set of regulations: 14 CFR Part 21 for certification procedures, Part 23 for smaller aeroplanes and Part 25 for transport-category aeroplanes, Part 33 for engines, and Part 39 for airworthiness directives. Europe, through EASA, uses Part-21 for certification, the certification specifications CS-23 and CS-25 for the same aircraft classes, and Part-M with Part-CAMO for continuing airworthiness management. Different documents, the same Annex 8 architecture underneath.
When the system acts in public
The 737 MAX grounding is the clearest modern illustration of Annex 8's logic in action -- and of its dependencies. A type that had been certified was grounded when an unsafe condition came to light, and it stayed grounded, worldwide, until the design issue was corrected, re-evaluated, and airworthiness was formally re-established. No amount of commercial pressure could return the aircraft to service until the certificate basis was sound again. The episode also prompted hard questions about how type certification is conducted and overseen -- in particular how much of the work an authority delegates to the manufacturer -- which is exactly the kind of scrutiny the airworthiness system is supposed to invite when it is tested.
The maintenance ecosystem behind the certificate
A Certificate of Airworthiness stays valid only because an entire industry keeps it valid, and Annex 8 assumes that industry exists in a controlled form. The work is done by approved maintenance organisations -- the FAA's Part 145 and EASA's Part-145 repair stations -- whose facilities, tooling, procedures, and people are themselves approved and audited. Every aircraft follows an approved maintenance programme that schedules inspections by hours, cycles, and calendar time, escalating from quick line checks to the deep, weeks-long heavy checks where the aircraft is partially dismantled and examined.
The hinge of the whole system is a single act: the release to service. After any maintenance, a qualified, authorised person signs a certificate stating the work was done correctly and the aircraft is fit to fly. That signature is, in miniature, what keeps the CofA alive between deeper checks -- and it is exactly why Annex 1 treats maintenance licensing as seriously as it treats pilots. Behind it runs a feedback loop: reliability data from the fleet flows back to the maintenance programme and to the design state, so intervals are tuned and emerging problems are caught from the pattern across many aircraft rather than one. Airworthiness, done properly, is a system that learns.
Where it still falls short
The open problems in airworthiness are concentrated in the long, unglamorous middle of an aircraft's life.
- Continuing-airworthiness rigour. Type certification gets intense attention; the decades of in-service maintenance that follow depend on the discipline of operators and the depth of oversight, which vary.
- AD compliance tracking. The directive system only works if every mandatory action is actually performed on every affected aircraft and recorded, and tracking that across large, mobile, often-leased fleets is genuinely hard.
- Oversight of aging aircraft. As airframes accumulate years and cycles, fatigue and corrosion become the dominant risks, and keeping old aircraft genuinely airworthy demands more, not less, attention.
An aircraft is one of the few machines we expect to remain safe for thirty or forty years of brutal duty cycles. It manages that not because it was built perfectly, but because a system keeps deciding, over and over, that it is still fit to fly -- and is willing to say no when it is not. Annex 8 is the rulebook for that recurring decision. The certificate on the wall is only as good as the day's work standing behind it.