The reliability check (ZÜP) under § 7 LuftSiG (German Aviation Security Act) is an official review based on register and government data: it answers the question of whether a person may be granted access to security-sensitive areas of aviation security. What it does not answer: whether the statements in the CV are accurate, whether relevant foreign convictions exist outside the official query channels, whether economic entanglements are present — and what happens between two review cycles. Precisely these points remain the employer’s responsibility.
What the ZÜP delivers — and how it works
The ZÜP is an access requirement for employees at airports, at airlines and in air cargo who enter security-restricted areas or perform security-relevant tasks. Its basis, scope and procedure follow from § 7 LuftSiG, in particular paragraphs 3 and 4, in conjunction with the LuftSiZÜV (the implementing ordinance). The competent aviation security authority bases its decision on queries to security and register authorities — that is, on data holdings that are, for good reasons, closed to a private employer.
Two key parameters shape practice: the procedure typically takes around four weeks, and a granted clearance is valid for five years. Both are appropriate for a sovereign procedure — but they create two structural gaps employers should be aware of: the waiting period before clearance and the long interval between review cycles.
What the ZÜP structurally does not check
The official review is deliberately tailored to the protected interest of aviation security law. It is therefore neither incomplete nor flawed — it simply has a different mandate than the employer’s personnel selection. Outside its scope of review lie in particular:
- CV integrity: No authority checks whether degrees, career stations and qualifications in the CV are accurate.
- Foreign findings outside the query channels: Convictions and proceedings in states not covered by the official queries remain invisible.
- Economic entanglements: Secondary activities, shareholdings or conflicts of interest — such as links to service providers or competitors — are not part of the ZÜP.
- Ongoing conduct: Five years can lie between two review cycles. Sanctions-list entries, insolvencies or adverse media reports arising during this time do not flow in automatically.
- Transparency of the outcome: The employer essentially learns only the result — not the considerations behind it. For the employer’s own risk assessment, the ZÜP thus provides little substance.
Why the gap concerns the employer
The employment-law and organisational responsibility for personnel selection remains with the company — the ZÜP does not take it off its hands. This shows in three typical constellations: first, the waiting period — anyone who wants to deploy a worker in non-security-sensitive areas before the official review is complete needs their own documented risk assessment. Second, contractor personnel in the air cargo and ground handling chain, whose turnover is high and whose CVs nobody systematically verifies. Third, positions with economic responsibility — procurement, cargo control, IT administration — where conflicts of interest are at least as relevant as the criminal record. How official and employer-side checks relate to one another in principle is set out in the article State security clearance vs. own screening.
Complementary screening: complement, not substitute
Private background screening cannot and must not replace the ZÜP — the sovereign query channels remain reserved to the authority. But it can usefully complement it: verification of CV statements, international press and sanctions-list research, review of economic entanglements and a documented repetition in shorter, risk-appropriate cycles. For operators who also fall under the KRITIS umbrella act, personnel security has in any case become a distinct set of obligations — details in the article KRITIS umbrella act: obligations, deadlines and sectors.
Recommended course of action
First, map which roles in your operation are subject to the ZÜP and which risks per role lie outside the official review programme. Then define a tiered complementary screening: a basic check across the board, a deeper check for key roles and contractor coordinators, each with clear documentation of trigger, sources and result. Indicium delivers audit-proof software reports for this purpose, with dated sources and human final review (Art. 22 GDPR) — from €79 per report. We are happy to show you what such a programme looks like for aviation and critical infrastructure in a demo.
This article provides general information and does not constitute legal advice.