CASA EX93/23 — Implementation of DAMPs (Provision of Safety-Sensitive Aviation Activities by Non-DAMP Organisations) Instrument 2023

The core concept is the DAMP-like program. Defined in section 3(1), it means a plan of a non-DAMP organisation that complies with regulation 99.045 of CASR (as applied under section 4) as if the organisation were a DAMP organisation, and is approved in writing by CASA. This is the substitute for a DAMP, but it must achieve CASA’s specific approval rather than being automatically accepted. The non-DAMP organisation is any person other than a DAMP organisation - that is, any entity that does not itself hold a DAMP but performs SSAA for a DAMP organisation under contract.

The instrument also imports several terms from regulation 99.010 of CASR via section 3(2), including applicable SSAA, DAMP, DAMP organisation, and SSAA employee. These are critical because the instrument’s mapping provisions in section 4 then read those terms across to the new context. For example, a reference to a DAMP organisation in Part 99 becomes a reference to a non-DAMP organisation; a reference to a DAMP becomes a reference to a DAMP-like program; a reference to an SSAA employee becomes a reference to an employee or contractor of the non-DAMP organisation who performs SSAA for the DAMP organisation. This mapping also redefines the roles of DAMP medical review officer, DAMP contact officer, and DAMP supervisor for the non-DAMP context. A DAMP medical review officer becomes any medical practitioner with competence in interpreting drug and alcohol test results, knowledge of substance use disorders, and knowledge of Part 99. A DAMP contact officer becomes a person appointed by the non-DAMP organisation to liaise with CASA about the DAMP-like program. A DAMP supervisor becomes a person in the non-DAMP organisation who has relevant training to assess impairment and is authorised by the non-DAMP organisation to perform drug and alcohol testing on its workers. These mappings ensure that the existing Part 99 framework can be applied consistently, but they introduce new definitions that non-DAMP organisations must satisfy - for instance, ensuring their chosen medical practitioner has the required specialist knowledge. The instrument does not define what constitutes “relevant training” for a DAMP supervisor, leaving that to be determined by CASA practice or industry standards, which creates some interpretive risk.

The instrument directly affects three categories of entity. DAMP organisations that contract with non-DAMP organisations to supply SSAA are the primary beneficiaries of the exemption in section 5. Without this instrument, a DAMP organisation would be required to extend its own DAMP to cover all SSAA employees, including those provided by contractors. The exemption removes that burden, provided the DAMP organisation reasonably believes the non-DAMP organisation has an approved DAMP-like program and is implementing it. However, DAMP organisations still retain residual obligations: they must implement their DAMP in certain circumstances (subsection 5(3) - when an employee’s faculties are suspected impaired due to drugs or alcohol, or after an accident or serious incident) and then must notify the non-DAMP organisation and CASA. They also must create and keep records of the grounds for their reasonable belief, which imposes a compliance cost. Non-DAMP organisations are the entities that perform SSAA under contract. They must obtain CASA approval for a DAMP-like program that complies with regulation 99.045 as applied. This is likely a significant undertaking: regulation 99.045 requires a DAMP to include policies, procedures, testing regimens, education, and other elements. The non-DAMP organisation then must comply with regulations 99.080 (implementation and review) and 99.085 (record-keeping and reporting) as applied. It must make the program available to its workers who perform SSAA for the DAMP organisation, and it must comply with any CASA request to provide information, make changes, or prepare a new program. The workers themselves , employees or contractors of the non-DAMP organisation who perform SSAA - are affected because they become subject to the DAMP-like program’s testing and reporting obligations. They also may be affected if the DAMP organisation intervenes under subsection 5(3) (e.g., being stood down). CASA is affected because it must approve DAMP-like programs, monitor compliance, and may issue requests for changes or new programs. This gives CASA substantial discretion over the content of private compliance arrangements. The instrument also indirectly affects medical practitioners and training providers who may be engaged as medical review officers or supervisors, though their obligations are defined by reference to competence and authorisation rather than directly imposed by this instrument.

The instrument creates distinct duties for DAMP organisations and non-DAMP organisations, with limited rights for the latter to operate under their own program. For DAMP organisations, the key duty under section 5(2) is not a duty but an exemption from compliance with subregulation 99.030(4) (to the extent it requires compliance with paragraph 99.045(d)) and regulation 99.035 (to the extent it requires implementation of the DAMP by giving effect to regulation 99.080) regarding the non-DAMP organisation’s workers. However, this exemption does not apply if the DAMP organisation implements its DAMP under subsection 5(3) - that is, when an SSAA employee is suspected of impairment or involved in an accident or serious incident. In that case, subsection 6(1) imposes a duty to notify the non-DAMP organisation in writing as soon as practicable, and to notify CASA in writing if the DAMP organisation does not permit the worker to perform SSAA. Subsection 6(2) imposes a record-keeping duty: the DAMP organisation must record the grounds for its reasonable belief under paragraph 5(1)(b), include the creation date, keep it securely for five years, and then within six months destroy the record or at least the parts relating to drug or alcohol test results. The destruction obligation is notable because it limits the retention of sensitive personal data, balancing privacy against evidentiary needs.

For non-DAMP organisations, the duties are more extensive. Under subsection 7(1), they must comply with regulations 99.080 and 99.085 as applied by section 4. Regulation 99.080 requires implementation and periodic review of the DAMP-like program; regulation 99.085 deals with record-keeping and reporting (including notifying CASA of test results and adverse findings). Under subsection 7(3), they must make the DAMP-like program available to each employee or contractor who performs SSAA for a DAMP organisation. Under subsection 7(4), they must comply with CASA requests to provide the program and supporting information, to make changes specified by CASA, to prepare a new program complying with regulation 99.045 as applied, and to submit proposed changes or a new program to CASA. This is a broad power that allows CASA to dictate the content of a private organisation’s compliance system; the non-DAMP organisation has no statutory right to resist or seek review of the request. Subsection 7(2) provides a limited relief: if the DAMP organisation has implemented its DAMP under subsection 5(3), the non-DAMP organisation is not required to meet the requirements of regulation 99.080 to the extent the DAMP gives effect to the matters mentioned. This prevents double regulation for the same incident.

The instrument itself does not create specific penalty provisions. Instead, it operates by modifying the application of Part 99 of CASR, which is a legislative instrument made under the Civil Aviation Safety Regulations. Breaches of the directions in the instrument are likely to be enforceable under existing enforcement mechanisms in CASR or the Civil Aviation Act 1988. For example, a failure to comply with a direction under subsection 6(1) to notify CASA or the non-DAMP organisation, or a failure to keep records under subsection 6(2), would be a breach of a direction given under CASR regulations 11.160 and 11.245 (the enabling provisions). The Civil Aviation Act provides for civil penalties for contraventions of regulations and directions, as well as suspension or cancellation of approvals, licences, or authorisations. The instrument also gives CASA the power under subsection 7(4) to request information, changes, or a new DAMP-like program; non-compliance with such a request would likely be a breach of the direction in subsection 7(4) and could result in enforcement action, including the withdrawal of the CASA approval of the DAMP-like program. Because the instrument is time-limited (exemption provisions only until 2026), the enforcement window is short. There is also a risk that CASA could treat a non-DAMP organisation’s failure to have an approved DAMP-like program while performing SSAA as a breach of Part 99 more broadly, though the instrument provides a defence to the DAMP organisation (via the exemption) rather than directly protecting the non-DAMP organisation. Practically, CASA’s enforcement discretion will be significant. The instrument does not prescribe any criminal penalties, but the underlying CASR framework includes strict liability offences for drug and alcohol violations. The absence of express penalty provisions in the instrument means practitioners must cross-reference the CASR penalty schedules or the Act.

The instrument is made under regulations 11.160 (general power to issue exemptions and directions) and 11.245 (specific power to make instruments concerning DAMPs) of CASR. It directly modifies the application of Part 99 of CASR (Drug and Alcohol Management Plans) for the purpose of allowing non-DAMP organisations to operate under a DAMP-like program. The mapping provisions in section 4 ensure that the technical requirements of Part 99 - including testing protocols, reporting obligations, medical review officer qualifications, supervisor training, and record-keeping - are read as applying to the non-DAMP context. This means that regulations such as 99.045 (content of a DAMP), 99.080 (implementation and review), and 99.085 (record-keeping and reporting) apply with the substituted definitions. The instrument also interacts with other CASA instruments that may impose DAMP obligations, such as air operator certificates or maintenance organisation approvals. Where a non-DAMP organisation holds multiple authorisations, the DAMP-like program approval may need to be consistent with those. The Civil Aviation Act 1988 provides the overarching enforcement framework; section 20A of that Act deals with drug and alcohol management plans generally. The instrument does not affect state or territory drug and alcohol laws, but those may apply concurrently, especially in relation to workplace health and safety obligations. For example, a state work health and safety law may require a PCBU to manage drug and alcohol risks at work; the instrument’s DAMP-like program may satisfy some but not all of those obligations. The instrument also interacts with privacy laws: the record-keeping and destruction obligations in subsection 6(2) may need to comply with the Privacy Act 1988 and Notifiable Data Breaches scheme, particularly because drug and alcohol test results are sensitive information. The instrument requires destruction of records after five years but only requires destruction of parts relating to test results, not necessarily the grounds record itself. Practitioners should consider whether the 5-year retention period aligns with other regulatory requirements, such as those under the Civil Aviation Safety Regulations for personnel records.

The instrument is a new legislative instrument (EX93/23) that commenced on 1 October 2023. It has not been amended; however, its built-in repeal schedule acts as a form of automatic sunset amendment. Section 2(3) provides that sections 5 and 6(1) and section 7 are repealed at the end of 30 September 2026. This is a staged repeal: the exemption and the primary directions for DAMP organisations and non-DAMP organisations expire after three years. The remaining provisions - particularly subsection 6(2) which requires keeping records for five years - continue until 31 March 2032, when the entire instrument is repealed. This means the record-keeping obligation outlives the substantive exemption by over five years, reflecting the need to maintain records for the full limitation period for enforcement actions. No amendment history is known as of the instrument's commencement. CASA may issue amending instruments before 2026 if the framework proves problematic, but none are recorded in the text provided. The instrument’s existence suggests that CASA recognised a gap in Part 99: that DAMP organisations could contract out SSAA but had no clear mechanism for the contractor to operate its own DAMP. The transitional nature implies that CASA intends to amend Part 99 itself to address this gap permanently, but has not done so as of 2023.

As a legislative instrument made in September 2023 with a current lifespan to 2026 (main provisions) and 2032 (record-keeping), there are no reported litigation cases directly interpreting CASA EX93/23 as of the time of writing. The instrument is relatively obscure and has not been challenged in the Administrative Appeals Tribunal or Federal Court. However, there is potential for future litigation in several areas. First, the definition of “DAMP-like program” requires CASA approval; a refusal to approve could be appealed under the Administrative Appeals Tribunal Act 1975, though the instrument does not provide a merits review mechanism explicitly. Second, CASA’s power under subsection 7(4) to “make changes specified by CASA” to a DAMP-like program is broad and could be challenged as an invalid delegation of legislative power or as lacking procedural fairness. Third, the operation of the “reasonable belief” requirement in paragraph 5(1)(b) could be litigated if a DAMP organisation relies on the exemption but CASA disputes the reasonableness of the belief. The instrument does not define “reasonable belief” by reference to any statutory standard, leaving it open to judicial interpretation. Fourth, the interaction with Part 99 enforcement - for example, if a non-DAMP organisation fails to comply with its DAMP-like program and causes an accident - may lead to litigation about whether the DAMP organisation retains residual liability under Part 99 despite the exemption. The instrument does not address vicarious liability or overlapping duties. Practitioners should watch for any CASA enforcement decisions or Tribunal appeals involving these issues. The sunset dates may limit the scope for long-running litigation, but disputes could arise within the three-year period.

Several traps in the instrument can catch practitioners unaware. First, the exemption in section 5 does not relieve the DAMP organisation of all obligations under Part 99. Subsection 5(3) carves out the situation where a DAMP organisation implements its DAMP regarding an employee or contractor of the non-DAMP organisation to give effect to subregulation 99.065(2) - which covers suspected impairment, accidents, or serious incidents. If a DAMP organisation’s supervisor suspects impairment in a contractor’s worker, the DAMP organisation must activate its own DAMP procedures, notify the non-DAMP organisation, and if it stands the worker down, notify CASA (subsection 6(1)). This means the DAMP organisation cannot simply rely on the contractor’s DAMP-like program to handle all instances; it must have internal processes ready to step in. Second, the reasonable belief requirement in paragraph 5(1)(b) is not self-executing. The DAMP organisation must record the grounds for its belief and keep that record for five years (subsection 6(2)). If it cannot later demonstrate reasonable belief, the exemption fails and the organisation may be non-compliant for the entire period. Third, the record destruction obligation in paragraph 6(2)(d) requires destroying the record or parts relating to test results within six months after the five-year retention period. The phrase “destroy or delete” suggests that electronic records must be securely deleted, and physical records shredded. Failure to destroy on time could be a breach. Fourth, the instrument only applies if there is a written contract between the DAMP organisation and the non-DAMP organisation that explicitly states the DAMP-like program (instead of the DAMP) will apply. Oral contracts or implied arrangements are insufficient. Fifth, the definition of DAMP-like program requires CASA approval in writing. The non-DAMP organisation cannot simply adopt a program; it must submit it for approval and receive a written approval. There is no deemed approval or timeframe specified, so delays could hold up operations. Sixth, the mapping provisions in section 4 change definitions in ways that may have unintended effects. For example, a “DAMP medical review officer” under Part 99 must be independent of the testing process; the mapped definition under paragraph 4(d) does not explicitly include an independence requirement, only competence and knowledge. A non-DAMP organisation could inadvertently appoint a treating medical practitioner, creating a conflict. Seventh, the DAMP organisation’s record-keeping obligation under subsection 6(2) applies even if the contract ends or the exemption ceases; the record must be kept for five years from the date of its creation. Eighth, the instrument does not address what happens if the non-DAMP organisation’s CASA approval is suspended or revoked - the exemption would then likely become unavailable, and the DAMP organisation would need to revert to its own DAMP immediately.

For a DAMP organisation intending to rely on the exemption, compliance steps are: (1) Ensure there is a written contract with the non-DAMP organisation that expressly states the DAMP-like program (rather than the DAMP) will apply for the SSAA. (2) Confirm that the non-DAMP organisation holds a valid CASA-approved DAMP-like program. The DAMP organisation should request a copy of the approval and maintain it on file. (3) Form a reasonable belief that the non-DAMP organisation is implementing its DAMP-like program in relation to the specific employees or contractors who perform SSAA. This requires ongoing monitoring - for example, by reviewing testing records, audit reports, or CASA correspondence. (4) Create a written record of the grounds for that reasonable belief, dated, and keep it in a secure location for five years from the date of creation. (5) Ensure internal supervisors are trained to recognise impairment and know when to activate the DAMP organisation’s own DAMP under subsection 5(3) (i.e., when a worker is suspected impaired, involved in an accident or serious incident). (6) If such activation occurs, notify the non-DAMP organisation in writing as soon as practicable, and also notify CASA in writing if the worker is not permitted to perform SSAA. (7) Within six months after the five-year record retention period ends, destroy or delete the record, or at least any parts that relate to drug or alcohol test results. This may require segregation of test data in the record.

For a non-DAMP organisation, compliance steps are: (1) Develop a DAMP-like program that meets the requirements of regulation 99.045 of CASR as applied by section 4. This must cover policies, testing (including random, post-accident, reasonable suspicion, and return-to-duty), education, training, reporting, and record-keeping. (2) Submit the program to CASA for written approval. Approval is a prerequisite to operating under the instrument. (3) Once approved, implement the program and ensure compliance with regulation 99.080 (including regular review) and 99.085 (record-keeping and reporting to CASA). (4) Provide a copy of the DAMP-like program to every employee or contractor who performs SSAA for a DAMP organisation under the arrangement. (5) Appoint a contact officer to liaise with CASA, a medical review officer (a medical practitioner with the specified competence and knowledge), and supervisors with relevant training and authorisation. (6) Respond to any CASA requests under subsection 7(4) - including providing information, making changes, or preparing a new program - within any timeframe CASA specifies. Non-compliance risks the loss of approval and potential enforcement. (7) If the DAMP organisation activates its DAMP under subsection 5(3), the non-DAMP organisation is relieved from regulation 99.080 requirements to that extent; but it should still document the incident and ensure the worker is managed appropriately under its own program for other purposes. (8) Note that the exemption and main directions expire on 30 September 2026; before that date, CASA may introduce permanent amendments to Part 99 or a replacement instrument. Keeping abreast of regulatory developments is essential.