A general summary:
ICAO sets rules (standards) for countries – world agreement provides a degree of standardization.
Each country sets their own rules to meet (or reject) ICAO – if not agreed, a ‘difference statement’ to ICAO should be published.
Each operator (manufacturer, service provider, etc) has to meet the rules of the country – and thence other countries visited / overflown.
The following is taken from an internal EASA document:
ICAO sets standards for member states; however the European Union (EU) consists of many states, thus rather than each interpreting ICAO, the individual states are ‘guided’ by the EU: – “the Member States of the European Union have vested the EU with legal competence in certain areas of aviation safety.” – i.e. a country's legal requirements are met at the European parliament level.
EU Member States and the European Aviation Safety Agency (EASA) are responsible for the implementation of the legal standards.
Safety is achieved with three complementary functions: the rulemaking function, the oversight function, and the safety assurance and promotion function.
Rulemaking: “the EU makes proposals and the sets regulations. EASA is responsible for setting the complimentary technical rules and guidance such as Acceptable Means of Compliance (AMC), Certification Specifications (CS) and Guidance Material (GM).”
“Oversight rests with the Member States, EASA and the Commission, each acting according to the division of responsibilities detailed in EU Regulations.”
Safety assurance and promotion involves National and pan-European initiatives or communication campaigns.
IATA is an international trade organization; (and thus not legally binding??)
IOSA is an IATA operational safety audit. IIRC, this type of safety audit is accepted by many countries (and thence ICAO) as part of a SMS.