The requirements aren't in the statute

A frequent misconception is that the law tells you how to get certified. It doesn't. The statute frames the programme; the operative requirements sit in a structured body of DGA resolutions, security policies, procedures and self-assessment questionnaires — updated regularly, differentiated by tier and by operator type, and cross-referencing one another.

Certification succeeds or fails on how accurately your operation is mapped against that body of documents — the right security policy, the right questionnaire for your activity and tier, the current version of each. This is where most applications stall: not on eligibility, but on navigating the documentation correctly and keeping it current across the four-year cycle.

Knowing which documents govern your case, in their current form, and how they fit together, is the substance of the work.

Photo: Pawel Czerwinski on Unsplash

You should also read:

An MRA doesn't make the requirements the same

A common assumption is that mutual recognition means an EU AEO automatically satisfies Costa Rica's OEA requirements, or the reverse. It does not — and that gap is exactly where the practical problems sit. Recognition grants benefits at the border and removes duplicate verification: an…

Continue reading...