# EASA Easy Access Rules > EASA Easy Access Rules: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Certified Certified by Atlantic Agentic Labs on 7 November 2026, against Easy Access Rules downloads (PDF, HTML); no versioned API; expires 7 May 2027. Reads the European Union Aviation Safety Agency’s Easy Access Rules: the consolidated rules, acceptable means of compliance and guidance material for a domain, as EASA publishes them for download. EASA has no versioned API for them, so you name each document by its download address and the collector notices when the bytes change. ## At a glance | Collector | EASA Easy Access Rules, version `1.0.0` | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | European Union Aviation Safety Agency: Easy Access Rules (download library) ([the vendor's documentation](https://www.easa.europa.eu/en/document-library/easy-access-rules)) | | Family | Regulation | | Kind | Regulation | | Ways to connect | None (no credential) | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | None | | Hosts it may contact | `www.easa.europa.eu` | | Vendor API versions | Easy Access Rules downloads (PDF, XML, HTML); no versioned API | | Lowest engine version | `0.45.0` | ## What it reads - The documents you name, each by an `https://` address on [www.easa.europa.eu](http://www.easa.europa.eu): PDF downloads, XML downloads, or library pages (HTML). - For each document: its text, with the title you give it and a link to where it was read. - A document is read again only when its bytes change (the collector compares their SHA-256). A document you remove from the list is withdrawn from the knowledge base. It does not search the EASA site or follow links from a page: a site redesign would otherwise change what is read without anyone deciding to. ## How to connect 1. In LightHouse, open **Connectors** and choose **EASA Easy Access Rules**. 2. For each document, give an id of your own (for example `ear-air-ops`), its download address (from the document’s page in EASA’s library) and a title. 3. Choose a label (normally `regulation`) and how often to read. Weekly is usually enough: EASA revises each set a few times a year. No credential is needed. ## Permissions None. The collector sends only `GET` requests, without credentials, to `www.easa.europa.eu` (or any other host you add to the source’s allowed hosts). Its read-only test proves it on every change, and the certification run recorded every request it made against the live library. ## Limits - EASA’s downloads do not answer conditional requests, so each read downloads every document in full (tens of megabytes for a large set) and then compares it. Read weekly, not hourly. - PDFs are read with `pdftotext` (poppler-utils). The Atlantic Agentic gateway image includes it from engine 0.47.0; on a deployment that does not use our image, install it where the collector runs. A scanned PDF with no text layer gives an empty document. - ZIP downloads (some XML editions come zipped) are not read; name the PDF or the unzipped XML instead. - Requests are paced (one second apart by default) and back off when EASA asks (`Retry-After`). ## Data handling - The documents are public; they carry no personal data. Reuse is subject to EASA’s legal notice; set the source’s `licence` to record it. - The raw bytes are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served. - Nothing leaves your deployment: the collector runs inside it, and only the counts of documents read reach LightHouse. - XML is parsed with `defusedxml`, which refuses entity expansion and external entities. ## Troubleshooting | What you see | What it means | What to do | | -------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------- | | `documents without an https url` | An address is not `https://` | Use the address from EASA’s library | | `no reader for application/zip` | The address is a ZIP download | Name the PDF edition instead | | `pdftotext is not installed` | The deployment lacks the PDF reader (our gateway image has it from engine 0.47.0) | Update the image, or install poppler-utils where the collector runs | | `HostNotAllowed` | The address, or a redirect, is not on an allowed host | Add the host, if you trust it | | Read succeeded, 0 written | No document’s bytes changed since the last read | Nothing to do | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | --------------- | --------- | -------- | --------------------------------------------------------- | ----------------------------------- | -------------- | | 7 November 2026 | `1.0.0` | `0.45.0` | Easy Access Rules downloads (PDF, HTML); no versioned API | Vendor's sandbox (a real run) | 7 May 2027 | | 7 November 2026 | `1.0.0` | `0.45.0` | Easy Access Rules downloads (PDF, HTML); no versioned API | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/easa/