It's primarily the responsibility of the individual companies, the railways. The regulator provides regulatory oversight, so they do audits for SMS. They do inspections on the ground. Those two are intended to complement one another.
On April 1st, 2014. See this statement in context.