AVSEC regulations: from ICAO and the EU to AESA in Spain

Have you ever noticed how complex an airport is and wondered why every door, every accreditation and every security checkpoint exists? These measures are not arbitrary. Behind every procedure is a deep and structured legal framework with one purpose: to protect civil aviation against unlawful interference.

For anyone who must perform duties in the ZRS (Zona Restringida de Seguridad), understanding this regulatory framework is not only an essential requirement; it is the basis of professional competence. Civil aviation security (AVSEC) is a pyramid of interconnected rules that extends from global bodies to national legislation.

In this guide, we look at that structure so you can understand the "why" behind the rules that govern your everyday work at an airport.

1. The global foundation: ICAO and the fight against unlawful interference

It all begins at global level. After the Second World War, the Chicago Convention of 1944 created the International Civil Aviation Organization (ICAO), the United Nations agency responsible for harmonizing global civil aviation.

Within its extensive work, Annex 17 is the most important aviation security document. Its purpose is to establish standards and recommended practices for protecting air transport against "acts of unlawful interference." This technical term covers some of the most serious threats imaginable:

• Unlawful seizure of aircraft, including hijacking.
• Destruction of an aircraft in service.
• Hostage-taking on board aircraft or at aerodromes.
• Introduction of weapons or dangerous devices for criminal purposes.

Annex 17 is therefore the coordinated global response designed to prevent these threats from materializing.

2. The common European framework: from recommendations to law

In Europe, the European Civil Aviation Conference (ECAC) pioneered the adaptation of these global standards to the continental context through its Document 30. However, the growing seriousness of terrorist threats led the European Union (EU) to turn these recommendations into binding laws for all Member States.

European legislation rests on two key pillars that should be distinguished:

Regulation (EC) No 300/2008:

This is the framework regulation. It sets common rules and the basic objectives of security. It defines WHAT must be done. For example, it requires baggage screening and access control, but does not go into exhaustive operational detail.

Implementing Regulation (EU) 2015/1998:

This is the implementing regulation. It develops the previous regulation and sets out detailed measures. It defines HOW things must be done. This is where permitted screening methods, technical requirements for X-ray equipment and minimum staff-training content are specified.

3. Application in Spain: AESA and the three key programmes

European rules require each country to implement them through its own institutions and programmes. In Spain, the competent authority delegates supervision and application to the Spanish Aviation Safety and Security Agency (AESA). AESA ensures that all airports and operators comply with the law through three interconnected national programmes:

• National Civil Aviation Security Programme (PNS): this is Spain's aviation security operations manual. It adapts European rules and establishes the organization, methods and procedures that airports, airlines and auxiliary companies must follow to protect against acts of unlawful interference.
• National Quality Control Programme (PNC): rules are only useful if compliance is checked. The PNC verifies, through audits, inspections and periodic tests, that PNS measures are applied correctly and effectively in day-to-day operations.
• National Training Programme (PNF): this pillar ensures the human factor does not fail. The PNF requires all personnel involved in security, from guards to ramp operators, to receive role-specific training. Its aim is to ensure everyone has the competence to apply security measures effectively.

4. Beyond compliance: building a security culture

Compliance is the baseline, but security goes one step further. AESA itself, following ICAO guidance, promotes the implementation of a "Security Culture."

This means every worker, whatever their role, must internalize security as a core value. It is not only about following a protocol; it is about staying alert, reporting suspicious behaviour and understanding that each person's actions contribute to a much larger protection system.

As we have seen, the regulations form a complex and robust chain of responsibility that connects decisions made by an international organization in Montreal with your daily actions at a Spanish airport. Understanding this structure (ICAO -> EU -> Spain/AESA) is fundamental.

Navigating this complexity may seem challenging, but it is the path to becoming an essential asset for the aviation sector.

The Spanish Aviation Safety and Security Agency (AESA) requires every professional with ZRS access to hold a valid AVSEC certification in accordance with the National Training Programme. Our official course provides the training and assessment needed to demonstrate those competencies. It is not optional; it is an essential legal requirement for performing those duties.

Back to all articles