Requirements for SMS, hazard identification, risk assessment and mitigation arise from EU (EASA related) legislation 1035/2011.
In the case of Non-ATS Providers classified as CNS/ATM Providers, requirements for SMS, hazard identification, risk assessment and mitigation are only applicable to CNS/ATM service related equipment such as NDBs etc.
The CAA has published CAP 760 Guidance on the Conduct of Hazard Identification, Risk Assessment and the Production of Safety Cases: For Aerodrome Operators and Air Traffic Service Providers as interim guidance. Further guidance is being developed to enable compliance with the EU Regulations.
Information for organisations regarding Safety Management Systems can be found on the CAA's Safety Management Systems web page.