
Article 1 

1. This Regulation establishes a common safety method on risk evaluation and assessment (CSM) as referred to in Article 6(3)(a) of Directive 2004/49/EC.
2. The purpose of the CSM on risk evaluation and assessment is to maintain or to improve the level of safety on the Community’s railways, when and where necessary and reasonably practicable. The CSM shall facilitate the access to the market for rail transport services through harmonisation of:
(a) the risk management processes used to assess the safety levels and the compliance with safety requirements;
(b) the exchange of safety-relevant information between different actors within the rail sector in order to manage safety across the different interfaces which may exist within this sector;
(c) the evidence resulting from the application of a risk management process.
Article 2 

1. The CSM on risk evaluation and assessment shall apply to any change of the railway system in a Member State, as referred to in point (2)(d) of Annex III to Directive 2004/49/EC, which is considered to be significant within the meaning of Article 4 of this Regulation. Those changes may be of a technical, operational or organisational nature. As regards organisational changes, only those changes which could impact the operating conditions shall be considered.
2. Where the significant changes concern structural subsystems to which Directive 2008/57/EC applies, the CSM on risk evaluation and assessment shall apply:
(a) if a risk assessment is required by the relevant technical specification for interoperability (TSI). In this case the TSI shall, where appropriate, specify which parts of the CSM apply;
(b) to ensure safe integration of the structural subsystems to which the TSIs apply into an existing system, by virtue of Article 15(1) of Directive 2008/57/EC.However, application of the CSM in the case referred to in point (b) of the first subparagraph must not lead to requirements contradictory to those laid down in the relevant TSIs which are mandatory.Nevertheless if the application of the CSM leads to a requirement that is contradictory to that laid down in the relevant TSI, the proposer shall inform the Member State concerned which may decide to ask for a revision of the TSI in accordance with Article 6(2) or Article 7 of Directive 2008/57/EC or a derogation in accordance with Article 9 of that Directive.
3. This Regulation shall not apply to:
(a) metros, trams and other light rail systems;
(b) networks that are functionally separate from the rest of the railway system and intended only for the operation of local, urban or suburban passenger services, as well as railway undertakings operating solely on these networks;
(c) privately owned railway infrastructure that exists solely for use by the infrastructure owner for its own freight operations;
(d) heritage vehicles that run on national networks providing that they comply with national safety rules and regulations with a view to ensuring safe circulation of such vehicles;
(e) heritage, museum and tourist railways that operate on their own network, including workshops, vehicles and staff.
4. This Regulation shall not apply to systems and changes, which, on the date of entry into force of this Regulation, are projects at an advanced stage of development within the meaning of Article 2(t) of Directive 2008/57/EC.
Article 3 
For the purpose of this Regulation the definitions in Article 3 of Directive 2004/49/EC shall apply.
The following definitions shall also apply:

1.. ‘risk’ means the rate of occurrence of accidents and incidents resulting in harm (caused by a hazard) and the degree of severity of that harm;
2.. ‘risk analysis’ means systematic use of all available information to identify hazards and to estimate the risk;
3.. ‘risk evaluation’ means a procedure based on the risk analysis to determine whether the acceptable risk has been achieved;
4.. ‘risk assessment’ means the overall process comprising a risk analysis and a risk evaluation;
5.. ‘safety’ means freedom from unacceptable risk of harm;
6.. ‘risk management’ means the systematic application of management policies, procedures and practices to the tasks of analysing, evaluating and controlling risks;
7.. ‘interfaces’ means all points of interaction during a system or subsystem life-cycle, including operation and maintenance where different actors of the rail sector will work together in order to manage the risks;
8.. ‘actors’ means all parties which are, directly or through contractual arrangements, involved in the application of this Regulation pursuant to Article 5(2);
9.. ‘safety requirements’ means the safety characteristics (qualitative or quantitative) of a system and its operation (including operational rules) necessary in order to meet legal or company safety targets;
10.. ‘safety measures’ means a set of actions either reducing the rate of occurrence of a hazard or mitigating its consequences in order to achieve and/or maintain an acceptable level of risk;
11.. ‘proposer’ means the railway undertakings or the infrastructure managers in the framework of the risk control measures they have to implement in accordance with Article 4 of Directive 2004/49/EC, the contracting entities or the manufacturers when they invite a notified body to apply the ‘EC’ verification procedure in accordance with Article 18(1) of Directive 2008/57/EC or the applicant of an authorisation for placing in service of vehicles;
12.. ‘safety assessment report’ means the document containing the conclusions of the assessment performed by an assessment body on the system under assessment;
13.. ‘hazard’ means a condition that could lead to an accident;
14.. ‘assessment body’ means the independent and competent person, organisation or entity which undertakes investigation to arrive at a judgement, based on evidence, of the suitability of a system to fulfil its safety requirements;
15.. ‘risk acceptance criteria’ means the terms of reference by which the acceptability of a specific risk is assessed; these criteria are used to determine that the level of a risk is sufficiently low that it is not necessary to take any immediate action to reduce it further;
16.. ‘hazard record’ means the document in which identified hazards, their related measures, their origin and the reference to the organisation which has to manage them are recorded and referenced;
17.. ‘hazard identification’ means the process of finding, listing and characterising hazards;
18.. ‘risk acceptance principle’ means the rules used in order to arrive at the conclusion whether or not the risk related to one or more specific hazards is acceptable;
19.. ‘code of practice’ means a written set of rules that, when correctly applied, can be used to control one or more specific hazards;
20.. ‘reference system’ means a system proven in use to have an acceptable safety level and against which the acceptability of the risks from a system under assessment can be evaluated by comparison;
21.. ‘risk estimation’ means the process used to produce a measure of the level of risks being analysed, consisting of the following steps: estimation of frequency, consequence analysis and their integration;
22.. ‘technical system’ means a product or an assembly of products including the design, implementation and support documentation; the development of a technical system starts with its requirements specification and ends with its acceptance; although the design of relevant interfaces with human behaviour is considered, human operators and their actions are not included in a technical system; the maintenance process is described in the maintenance manuals but is not itself part of the technical system;
23.. ‘catastrophic consequence’ means fatalities and/or multiple severe injuries and/or major damages to the environment resulting from an accident;
24.. ‘safety acceptance’ means status given to the change by the proposer based on the safety assessment report provided by the assessment body;
25.. ‘system’ means any part of the railway system which is subject to a change;
26.. ‘notified national rule’ means any national rule notified by Member States under Council Directive 96/48/EC, Directive 2001/16/EC of the European Parliament and the Council and Directives 2004/49/EC and 2008/57/EC.
Article 4 

1. If there is no notified national rule for defining whether a change is significant or not in a Member State, the proposer shall consider the potential impact of the change in question on the safety of the railway system.When the proposed change has no impact on safety, the risk management process described in Article 5 does not need to be applied.
2. When the proposed change has an impact on safety, the proposer shall decide, by expert judgement, the significance of the change based on the following criteria:
(a) failure consequence: credible worst-case scenario in the event of failure of the system under assessment, taking into account the existence of safety barriers outside the system;
(b) novelty used in implementing the change: this concerns both what is innovative in the railway sector, and what is new just for the organisation implementing the change;
(c) complexity of the change;
(d) monitoring: the inability to monitor the implemented change throughout the system life-cycle and take appropriate interventions;
(e) reversibility: the inability to revert to the system before the change;
(f) additionality: assessment of the significance of the change taking into account all recent safety-related modifications to the system under assessment and which were not judged as significant.The proposer shall keep adequate documentation to justify his decision.
Article 5 

1. The risk management process described in Annex I shall apply:
(a) for a significant change as specified in Article 4, including the placing in service of structural subsystems as referred to in Article 2(2)(b);
(b) where a TSI as referred to in Article 2(2)(a) refers to this Regulation in order to prescribe the risk management process described in Annex I.
2. The risk management process described in Annex I shall be applied by the proposer.
3. The proposer shall ensure that risks introduced by suppliers and service providers, including their subcontractors, are managed. To this end, the proposer may request that suppliers and service providers, including their subcontractors, participate in the risk management process described in Annex I.
Article 6 

1. An independent assessment of the correct application of the risk management process described in Annex I and of the results of this application shall be carried out by a body which shall meet the criteria listed in Annex II. Where the assessment body is not already identified by Community or national legislation, the proposer shall appoint its own assessment body which may be another organisation or an internal department.
2. Duplication of work between the conformity assessment of the safety management system as required by Directive 2004/49/EC, the conformity assessment carried out by a notified body or a national body as required by Directive 2008/57/EC and any independent safety assessment carried out by the assessment body in accordance with this Regulation, shall be avoided.
3. The safety authority may act as the assessment body where the significant changes concern the following cases:
(a) where a vehicle needs an authorisation for placing in service, as referred to in Articles 22(2) and 24(2) of Directive 2008/57/EC;
(b) where a vehicle needs an additional authorisation for placing in service, as referred to in Articles 23(5) and 25(4) of Directive 2008/57/EC;
(c) where the safety certificate has to be updated due to an alteration of the type or extent of the operation, as referred to in Article 10(5) of Directive 2004/49/EC;
(d) where the safety certificate has to be revised due to substantial changes to the safety regulatory framework, as referred to in Article 10(5) of Directive 2004/49/EC;
(e) where the safety authorisation has to be updated due to substantial changes to the infrastructure, signalling or energy supply, or to the principles of its operation and maintenance, as referred to in Article 11(2) of Directive 2004/49/EC;
(f) where the safety authorisation has to be revised due to substantial changes to the safety regulatory framework, as referred to in Article 11(2) of Directive 2004/49/EC.
4. Where the significant changes concern a structural subsystem that needs an authorisation for placing in service as referred to in Article 15(1) or Article 20 of Directive 2008/57/EC, the safety authority may act as the assessment body unless the proposer already gave that task to a notified body in accordance with Article 18(2) of that Directive.
Article 7 

1. The assessment body shall provide the proposer with a safety assessment report.
2. In the case referred to in point (a) of Article 5(1), the safety assessment report shall be taken into account by the national safety authority in its decision to authorise the placing in service of subsystems and vehicles.
3. In the case referred to in point (b) of Article 5(1), the independent assessment shall be part of the task of the notified body, unless otherwise prescribed by the TSI.If the independent assessment is not part of the task of the notified body, the safety assessment report shall be taken into account by the notified body in charge of delivering the conformity certificate or by the contracting entity in charge of drawing up the EC declaration of verification.
4. When a system or part of a system has already been accepted following the risk management process specified in this Regulation, the resulting safety assessment report shall not be called into question by any other assessment body in charge of performing a new assessment for the same system. The recognition shall be conditional on demonstration that the system will be used under the same functional, operational and environmental conditions as the already accepted system, and that equivalent risk acceptance criteria have been applied.
Article 8 

1. The railway undertakings and infrastructure managers shall include audits of application of the CSM on risk evaluation and assessment in their recurrent auditing scheme of the safety management system as referred to in Article 9 of Directive 2004/49/EC.
2. Within the framework of the tasks defined in Article 16(2)(e) of Directive 2004/49/EC, the national safety authority shall monitor the application of the CSM on risk evaluation and assessment.
Article 9 

1. Each infrastructure manager and each railway undertaking shall, in its annual safety report referred to in Article 9(4) of Directive 2004/49/EC, report briefly on its experience with the application of the CSM on risk evaluation and assessment. The report shall also include a synthesis of the decisions related to the level of significance of the changes.
2. Each national safety authority shall, in its annual safety report referred to in Article 18 of Directive 2004/49/EC, report on the experience of the proposers with the application of the CSM on risk evaluation and assessment, and, where appropriate, its own experience.
3. The European Railway Agency shall monitor and collect feedback on the application of the CSM on risk evaluation and assessment and, where applicable, shall make recommendations to the Commission with a view to improving it.
4. The European Railway Agency shall submit to the Commission by 31 December 2011 at the latest, a report which shall include:
(a) an analysis of the experience with the application of the CSM on risk evaluation and assessment, including cases where the CSM has been applied by proposers on a voluntary basis before the relevant date of application provided for in Article 10;
(b) an analysis of the experience of the proposers concerning the decisions related to the level of significance of the changes;
(c) an analysis of the cases where codes of practice have been used as described in section 2.3.8 of Annex I;
(d) an analysis of overall effectiveness of the CSM on risk evaluation and assessment.The safety authorities shall assist the Agency by identifying cases of application of the CSM on risk evaluation and assessment.
Article 10 

1. This Regulation shall enter into force on the 20th day following its publication in the Official Journal of the European Union.
2. This Regulation shall apply from 1 July 2012.However, it shall apply from 19 July 2010:
(a) to all significant technical changes affecting vehicles as defined in Article 2(c) of Directive 2008/57/EC;
(b) to all significant changes concerning structural subsystems, where required by Article 15(1) of Directive 2008/57/EC or by a TSI.
This Regulation shall be binding in its entirety and directly applicable in all Member States.Done at Brussels, 24 April 2009.
For the Commission
Antonio TAJANI
Vice-President
ANNEX I
1.  1.1.  1.1.1. 

((a)) the risk assessment process, which shall identify the hazards, the risks, the associated safety measures and the resulting safety requirements to be fulfilled by the system under assessment;
((b)) demonstration of the compliance of the system with the identified safety requirements; and
((c)) management of all identified hazards and the associated safety measures.

This risk management process is iterative and is depicted in the diagram of the Appendix. The process ends when the compliance of the system with all safety requirements necessary to accept the risks linked to the identified hazards is demonstrated.
 1.1.2. 

((a)) shall include appropriate quality assurance activities and be carried out by competent staff;
((b)) shall be independently assessed by one or more assessment bodies.
 1.1.3. The proposer in charge of the risk management process required by this Regulation shall maintain a hazard record according to section 4.
 1.1.4. 

((a)) the risk assessment methods or tools are described in a safety management system which has been accepted by a national safety authority in accordance with Article 10(2)(a) or Article 11(1)(a) of Directive 2004/49/EC; or
((b)) the risk assessment methods or tools are required by a TSI or comply with publicly available recognised standards specified in notified national rules.
 1.1.5. Without prejudice to civil liability in accordance with the legal requirements of the Member States, the risk assessment process shall fall within the responsibility of the proposer. In particular the proposer shall decide, with agreement of the actors concerned, who will be in charge of fulfilling the safety requirements resulting from the risk assessment. This decision shall depend on the type of safety measures selected to control the risks to an acceptable level. The demonstration of compliance with the safety requirements shall be conducted according to section 3.
 1.1.6. The first step of the risk management process shall be to identify in a document, to be drawn up by the proposer, the different actors’ tasks, as well as their risk management activities. The proposer shall coordinate close collaboration between the different actors involved, according to their respective tasks, in order to manage the hazards and their associated safety measures.
 1.1.7. Evaluation of the correct application of the risk management process described in this Regulation falls within the responsibility of the assessment body.
 1.2.  1.2.1. For each interface relevant to the system under assessment and without prejudice to specifications of interfaces defined in relevant TSIs, the rail-sector actors concerned shall cooperate in order to identify and manage jointly the hazards and related safety measures that need to be handled at these interfaces. The management of shared risks at the interfaces shall be coordinated by the proposer.
 1.2.2. When, in order to fulfil a safety requirement, an actor identifies the need for a safety measure that it cannot implement itself, it shall, after agreement with another actor, transfer the management of the related hazard to the latter using the process described in section 4.
 1.2.3. For the system under assessment, any actor who discovers that a safety measure is non-compliant or inadequate is responsible for notifying it to the proposer, who shall in turn inform the actor implementing the safety measure.
 1.2.4. The actor implementing the safety measure shall then inform all the actors affected by the problem either within the system under assessment or, as far as known by the actor, within other existing systems using the same safety measure.
 1.2.5. When agreement cannot be found between two or more actors it is the responsibility of the proposer to find an adequate solution.
 1.2.6. When a requirement in a notified national rule can not be fulfilled by an actor, the proposer shall seek advice from the relevant competent authority.
 1.2.7. Independently from the definition of the system under assessment, the proposer is responsible for ensuring that the risk management covers the system itself and the integration into the railway system as a whole.

2.  2.1.  2.1.1. 

((a)) the system definition;
((b)) the risk analysis including the hazard identification;
((c)) the risk evaluation.

The risk assessment process shall interact with the hazard management according to section 4.1.
 2.1.2. 

((a)) system objective, e.g. intended purpose;
((b)) system functions and elements, where relevant (including e.g. human, technical and operational elements);
((c)) system boundary including other interacting systems;
((d)) physical (i.e. interacting systems) and functional (i.e. functional input and output) interfaces;
((e)) system environment (e.g. energy and thermal flow, shocks, vibrations, electromagnetic interference, operational use);
((f)) existing safety measures and, after iterations, definition of the safety requirements identified by the risk assessment process;
((g)) assumptions which shall determine the limits for the risk assessment.
 2.1.3. A hazard identification shall be carried out on the defined system, according to section 2.2.
 2.1.4. 

((a)) the application of codes of practice (section 2.3);
((b)) a comparison with similar systems (section 2.4);
((c)) an explicit risk estimation (section 2.5).

In accordance with the general principle referred to in section 1.1.5, the assessment body shall refrain from imposing the risk acceptance principle to be used by the proposer.
 2.1.5. The proposer shall demonstrate in the risk evaluation that the selected risk acceptance principle is adequately applied. The proposer shall also check that the selected risk acceptance principles are used consistently.
 2.1.6. The application of these risk acceptance principles shall identify possible safety measures which make the risk(s) of the system under assessment acceptable. Among these safety measures, the ones selected to control the risk(s) shall become the safety requirements to be fulfilled by the system. Compliance with these safety requirements shall be demonstrated in accordance with section 3.
 2.1.7. The iterative risk assessment process can be considered as completed when it is demonstrated that all safety requirements are fulfilled and no additional reasonably foreseeable hazards have to be considered.
 2.2.  2.2.1. 
All identified hazards shall be registered in the hazard record according to section 4.
 2.2.2. To focus the risk assessment efforts upon the most important risks, the hazards shall be classified according to the estimated risk arising from them. Based on expert judgement, hazards associated with a broadly acceptable risk need not be analysed further but shall be registered in the hazard record. Their classification shall be justified in order to allow independent assessment by an assessment body.
 2.2.3. As a criterion, risks resulting from hazards may be classified as broadly acceptable when the risk is so small that it is not reasonable to implement any additional safety measure. The expert judgement shall take into account that the contribution of all the broadly acceptable risks does not exceed a defined proportion of the overall risk.
 2.2.4. During the hazard identification, safety measures may be identified. They shall be registered in the hazard record according to section 4.
 2.2.5. The hazard identification only needs to be carried out at a level of detail necessary to identify where safety measures are expected to control the risks in accordance with one of the risk acceptance principles mentioned in point 2.1.4. Iteration may thus be necessary between the risk analysis and the risk evaluation phases until a sufficient level of detail is reached for the identification of hazards.
 2.2.6. 

((a)) the verification of the relevance of the code of practices or of the reference system;
((b)) the identification of the deviations from the code of practices or from the reference system.
 2.3.  2.3.1. The proposer, with the support of other involved actors and based on the requirements listed in point 2.3.2, shall analyse whether one or several hazards are appropriately covered by the application of relevant codes of practice.
 2.3.2. 

((a)) be widely acknowledged in the railway domain. If this is not the case, the codes of practice will have to be justified and be acceptable to the assessment body;
((b)) be relevant for the control of the considered hazards in the system under assessment;
((c)) be publicly available for all actors who want to use them.
 2.3.3. Where compliance with TSIs is required by Directive 2008/57/EC and the relevant TSI does not impose the risk management process established by this Regulation, the TSIs may be considered as codes of practice for controlling hazards, provided requirement (c) of point 2.3.2 is fulfilled.
 2.3.4. National rules notified in accordance with Article 8 of Directive 2004/49/EC and Article 17(3) of Directive 2008/57/EC may be considered as codes of practice provided the requirements of point 2.3.2 are fulfilled.
 2.3.5. 

((a)) these risks need not be analysed further;
((b)) the use of the codes of practice shall be registered in the hazard record as safety requirements for the relevant hazards.
 2.3.6. Where an alternative approach is not fully compliant with a code of practice, the proposer shall demonstrate that the alternative approach taken leads to at least the same level of safety.
 2.3.7. If the risk for a particular hazard cannot be made acceptable by the application of codes of practice, additional safety measures shall be identified applying one of the two other risk acceptance principles.
 2.3.8. 

((a)) the hazard identification in accordance with section 2.2.6;
((b)) the registration of the use of the codes of practice in the hazard record in accordance with section 2.3.5;
((c)) the documentation of the application of the risk management process in accordance with section 5;
((d)) an independent assessment in accordance with Article 6.
 2.4.  2.4.1. The proposer, with the support of other involved actors, shall analyse whether one or more hazards are covered by a similar system that could be taken as a reference system.
 2.4.2. 

((a)) it has already been proven in-use to have an acceptable safety level and would still qualify for approval in the Member State where the change is to be introduced;
((b)) it has similar functions and interfaces as the system under assessment;
((c)) it is used under similar operational conditions as the system under assessment;
((d)) it is used under similar environmental conditions as the system under assessment.
 2.4.3. 

((a)) the risks associated with the hazards covered by the reference system shall be considered as acceptable;
((b)) the safety requirements for the hazards covered by the reference system may be derived from the safety analyses or from an evaluation of safety records of the reference system;
((c)) these safety requirements shall be registered in the hazard record as safety requirements for the relevant hazards.
 2.4.4. If the system under assessment deviates from the reference system, the risk evaluation shall demonstrate that the system under assessment reaches at least the same safety level as the reference system. The risks associated with the hazards covered by the reference system shall, in that case, be considered as acceptable.
 2.4.5. If the same safety level as the reference system cannot be demonstrated, additional safety measures shall be identified for the deviations, applying one of the two other risk acceptance principles.
 2.5.  2.5.1. When the hazards are not covered by one of the two risk acceptance principles described in sections 2.3 and 2.4, the demonstration of the risk acceptability shall be performed by explicit risk estimation and evaluation. Risks resulting from these hazards shall be estimated either quantitatively or qualitatively, taking existing safety measures into account.
 2.5.2. 
If the estimated risk is not acceptable, additional safety measures shall be identified and implemented in order to reduce the risk to an acceptable level.
 2.5.3. When the risk associated with one or a combination of several hazards is considered as acceptable, the identified safety measures shall be registered in the hazard record.
 2.5.4. 
For technical systems where a functional failure has credible direct potential for a catastrophic consequence, the associated risk does not have to be reduced further if the rate of that failure is less than or equal to 10-9 per operating hour.
 2.5.5. Without prejudice to the procedure specified in Article 8 of Directive 2004/49/EC, a more demanding criterion may be requested, through a national rule, in order to maintain a national safety level. However, in the case of additional authorisations for placing in service of vehicles, the procedures of Articles 23 and 25 of Directive 2008/57/EC shall apply.
 2.5.6. 
Nevertheless, if the proposer can demonstrate that the national safety level in the Member State of application can be maintained with a rate of failure higher than 10-9 per operating hour, this criterion can be used by the proposer in that Member State.
 2.5.7. 

((a)) the methods used for explicit risk estimation shall reflect correctly the system under assessment and its parameters (including all operational modes);
((b)) the results shall be sufficiently accurate to serve as robust decision support, i.e. minor changes in input assumptions or prerequisites shall not result in significantly different requirements.

3.  3.1. Prior to the safety acceptance of the change, fulfilment of the safety requirements resulting from the risk assessment phase shall be demonstrated under the supervision of the proposer.
 3.2. This demonstration shall be carried out by each of the actors responsible for fulfilling the safety requirements, as decided in accordance with point 1.1.5.
 3.3. The approach chosen for demonstrating compliance with the safety requirements as well as the demonstration itself shall be independently assessed by an assessment body.
 3.4. Any inadequacy of safety measures expected to fulfil the safety requirements or any hazards discovered during the demonstration of compliance with the safety requirements shall lead to reassessment and evaluation of the associated risks by the proposer according to section 2. The new hazards shall be registered in the hazard record according to section 4.

4.  4.1.  4.1.1. Hazard record(s) shall be created or updated (where they already exist) by the proposer during the design and the implementation and till the acceptance of the change or the delivery of the safety assessment report. The hazard record shall track the progress in monitoring risks associated with the identified hazards. In accordance with point 2(g) of Annex III to Directive 2004/49/EC, once the system has been accepted and is operated, the hazard record shall be further maintained by the infrastructure manager or the railway undertaking in charge with the operation of the system under assessment as an integrated part of its safety management system.
 4.1.2. The hazard record shall include all hazards, together with all related safety measures and system assumptions identified during the risk assessment process. In particular, it shall contain a clear reference to the origin and to the selected risk acceptance principles and shall clearly identify the actor(s) in charge of controlling each hazard.
 4.2. 
All hazards and related safety requirements which cannot be controlled by one actor alone shall be communicated to another relevant actor in order to find jointly an adequate solution. The hazards registered in the hazard record of the actor who transfers them shall only be ‘controlled’ when the evaluation of the risks associated with these hazards is made by the other actor and the solution is agreed by all concerned.

5.  5.1. The risk management process used to assess the safety levels and compliance with safety requirements shall be documented by the proposer in such a way that all the necessary evidence showing the correct application of the risk management process is accessible to an assessment body. The assessment body shall establish its conclusion in a safety assessment report.
 5.2. The document produced by the proposer under point 5.1. shall at least include:

((a)) description of the organisation and the experts appointed to carry out the risk assessment process;
((b)) results of the different phases of the risk assessment and a list of all the necessary safety requirements to be fulfilled in order to control the risk to an acceptable level.

Appendix
ANNEX II
1. The assessment body may not become involved either directly or as authorised representatives in the design, manufacture, construction, marketing, operation or maintenance of the system under assessment. This does not exclude the possibility of an exchange of technical information between that body and all the involved actors.

2. The assessment body must carry out the assessment with the greatest possible professional integrity and the greatest possible technical competence and must be free of any pressure and incentive, in particular of a financial type, which could affect their judgement or the results of their assessments, in particular from persons or groups of persons affected by the assessments.

3. The assessment body must possess the means required to perform adequately the technical and administrative tasks linked with the assessments; it shall also have access to the equipment needed for exceptional assessments.

4. 

— proper technical and vocational training,
— a satisfactory knowledge of the requirements relating to the assessments that they carry out and sufficient practice in those assessments,
— the ability to draw up the safety assessment reports which constitute the formal conclusions of the assessments conducted.

5. The independence of the staff responsible for the independent assessments must be guaranteed. No official must be remunerated either on the basis of the number of assessments performed or of the results of those assessments.

6. Where the assessment body is external to the proposer’s organisation must have its civil liability ensured unless that liability is covered by the State under national law or unless the assessments are carried out directly by that Member State.

7. Where the assessment body is external to the proposer’s organisation its staff are bound by professional secrecy with regard to everything they learn in the performance of their duties (with the exception of the competent administrative authorities in the State where they perform those activities) in pursuance of this Regulation.
