I've heard of the SA-16. I thought it was replaced by part-is. Isn't that right?

Regulation 203/2023 of the PART-IS establishes cybersecurity requirements to be met by entities belonging to civil aviation from the SAFETY point of view; while Regulation 2019/1583 and its transposition into the National Security Programme and Instruction SA-16 also establishes cybersecurity requirements, but from the AVSEC (SECURITY) point of view.

Therefore, they are regulations with measures related to Information Security (Cybersecurity) but with different objectives and establishing different measures that in some cases may or will need synergies since there will be entities that are affected by both regulations as often happens with the legislations of SAFETY and SECURITY. It is clear that one does not come to replace the other, and therefore, both must coexist.