Every passenger and crew member flying to the US now has to confirm where they've been before they board. Here's what the rule asks of airlines, and what it took to have a customer ready when it came into force.

If you work in airline operations, you'll know that new travel requirements often arrive with little warning. A rule is announced, the start date is only days away, and every passenger still needs to board the right flight with the right documents.

The CDC attestation order is the latest example of this. The US Centers for Disease Control and Prevention issued the order on 22 October 2026 and amended it on 28 October, with the new requirement applying to flights departing from 11:59pm EST on 3 November. In practice, airlines had just 12 days to work out how to collect a new legal declaration from everyone flying to the US.

This is a short window to get it right. Airlines need to be compliant from the first departure, keep extra pressure off check-in, gate and contact centre teams, and make sure passengers know what's being asked of them before they set off for the airport. Any passenger who can’t show an attestation has to be refused boarding, and every denied boarding has a cost for the airline, both in looking after the passenger and in the disruption it causes on the day.

For one of our customers, attestation collection was running on the day the rule came into force. Here's what the rule asks for, and how we worked together to make that possible.

What does the CDC attestation rule ask of airlines?

Everyone boarding a flight from another country to the US must confirm they haven't been in the Democratic Republic of the Congo (DRC) in the 21 days before boarding. The order is intended to reduce the risk of Ebola reaching the US through air travel.

The rule is broad. It covers passengers and crew, including crew travelling as deadheads, as well as US citizens and permanent residents. People transiting through the US to another country are included, and so is anyone who has passed through a DRC airport, whether or not they left the aircraft.

For airlines, the CDC order sets out four main obligations:

• Confirm that each person has attested, at or shortly before boarding.
• Refuse boarding to anyone who hasn't, unless they have a US government exemption.
• Keep each attestation for at least 42 days after travel.
• Provide records to the US government on request, separately from APIS.

Airlines can use the CDC’s own form or their own digital process, as long as it includes all of the CDC’s required text.

The CDC’s form is a fillable PDF that passengers can print or complete on screen, but it sits outside the booking. When it’s checked at the airport, teams have to review each copy by hand, store it where it can be found if the US government asks for it, and delete it once it’s no longer needed under data protection rules. Managing and auditing records in that way is much harder with printed forms and separate files than with a record held against the booking.

A third party can collect attestations on an airline’s behalf, but the airline keeps sole legal responsibility. The amended order is set to run until 18 December 2026, unless the CDC changes or ends it sooner, and any extension will be based on a review of the outbreak at that point.

Why the airport is the hardest place to collect it

Most passengers check in online. If the attestation is collected before travel and recorded on the booking, it can be checked automatically during automatic and/or web check-in flows.  For those destinations requiring airport check-in, teams on the ground can see at a glance who has completed it, so they can be confident about compliance and save manual checks for the passengers who need help.

When passengers only find out at the airport, the declaration ends up being completed in the queue. Frontline teams take on extra checks at the busiest point of the journey, and anyone who hasn't completed it faces an uncomfortable conversation at the desk or the gate, often with little time to spare before their flight.

Timing is just as important as the form itself. When passengers receive a clear message before they travel, explaining what's needed and why, they arrive prepared and airport teams can process them without extra delay. The attestation becomes one more step in their pre-departure checklist, completed at a time that suits them.

How we had an airline customer ready on day one

Airlines faced a similar challenge during COVID-19, when we built a CDC data collection workflow for airlines flying into the US. for airlines flying into the US. Once the new order was announced, we worked closely with one of our customers to adapt that workflow for the new rule, and it went live on 3 November, the day the requirement came into force.

For passengers, it’s a short process, and the security comes from the booking itself. Ahead of each US-bound flight, we use the airline’s booking data to identify who is travelling and send a personalised, secure link. A quick check of the booking details means only passengers on that booking can attest. Each traveller then has their own page, already filled in, and one person can complete them for everyone on the booking before receiving a confirmation to show at the airport.

As soon as an attestation is submitted, we store the record for audit and update the booking in the airline’s reservation system, which clears it for check-in. Because the process connects to the booking before, during and after each attestation, check-in and gate teams can trust what the booking shows. Passengers who miss the reminder can reach the same page through a public link, and airlines can display it as a QR code at the airport for anyone who arrives without having attested.

Passengers who miss the reminder can use a public version of the same page, which checks their booking details before they start, and airlines can display it as a QR code at the airport for anyone who arrives without having attested.

"When an order like this lands, our first job is reading it line by line and working out what it means for the airline’s operation and for its passengers. During COVID-19, airlines saw queues of up to five hours at airports while this kind of information was collected at the desk. Once passengers could complete it before they travelled, those queues cleared and airport teams could get back to normal operations. We work closely with our customers’ teams every day, so when a rule like this arrives, we can agree the right approach quickly and support them from the first departure." 

Gemma Maidlow,
Principal Solutions Consultant, 15below

What makes a fast response possible

Speed in a situation like this rarely comes from working faster. It comes from what's already in place before a rule is announced, and from working as a partner to our customers. We watch for changes that could affect their operation, so when something new lands, we can adapt with them quickly. Four things made the difference:

• Our technology is built for aviation: Our platform was designed for airline and airport communications, so it already works with bookings, flight changes and the points in the journey where passengers need information. We don't need to adapt a general-purpose tool to an aviation problem.
• We’re connected to the booking in real time: We work with our customers’ booking and flight data as it changes, so we can identify every US-bound passenger from the start and update the booking the moment someone attests. The airline’s own systems then show who is ready to fly.
• Passengers already recognise the messages: The reminder carries the airline’s own branding and goes out through the channels our customers already use with us for pre-departure messages, such as check-in and data-collection reminders. It arrives alongside the travel updates passengers expect, from a name they trust.
• We've worked through regulation like this before: In more than 25 years of airline communications, and most recently during COVID-19, we’ve learned what these orders ask of airlines and where the pressure falls in the operation. Our team reads each requirement in detail and works through it with the customer’s own teams.

Every airline's set-up is different. For an airline that's new to 15below, there's more to put in place first, including a connection to its reservation system, so it takes longer. We'll always be clear about what's involved and how long it will take.

Questions to take back to your team

Whether or not you work with us, the CDC rule is a useful test of how ready your airline is for the next short-notice change. A few questions to ask:

• Where do passengers first hear about a new requirement: before travel, or at the desk?
• Can check-in and gate teams see who has completed it without a manual check?
• Who holds the records, for how long, and how quickly could you produce them if asked?
• If a third party collects data for you, does the process still meet every requirement?
• If the rule is amended again, how quickly could you update what passengers see?
• If another country you fly to introduces a similar requirement, could you reuse the same process?

The US isn’t the only country asking for this kind of information. Since the outbreak began, several countries have introduced health declarations or travel-history checks for people who have recently been in affected regions, and we’re following how these requirements develop so we can help our customers respond.

The lesson also goes beyond attestation. Whether it's a new regulation or a day of disruption, timely, clear communication helps passengers arrive prepared and know what to do next (read more in our industry White Paper). It also reduces compliance risk, cuts avoidable contacts to the contact centre and takes pressure off frontline teams when they're at their busiest. The airlines that cope best tend to be the ones that can tell passengers what's needed before they reach the airport.

If you'd like to talk about how ready your passenger communications are for the next regulation change or disruption, speak to our team.