The Certification Exposure Sitting Inside the Toolchain

The toolchain question nobody has answered yet

Most aerospace boards are framing their AI decision around the cockpit and the airframe: will the FAA and EASA let AI fly or help fly the aircraft, and under what performance-based certification regime. That is the right long-term question. It is not the urgent one.

The urgent one sits earlier in the pipeline. AI coding agents are already being used to write and verify software destined for certified avionics, and the governing standards, DO-178C and DO-330, were written for deterministic development tools, not generative ones. DO-330 tool qualification assumes a tool’s behavior is bounded and repeatable enough to reason about formally. A large language model agent generating or reviewing flight software code does not meet that assumption cleanly, and EASA’s proposal to extend its AI guidance to development and verification tools is a concept paper, not a final rule. Until it lands, program teams are qualifying AI-assisted tools against a framework that was not built for them, using judgment calls that will be scrutinized retroactively the moment something goes wrong.

Why this is harder than it looks

The core problem is the one Gabriel Pedroza describes plainly: AI models behave statistically. Their stability, robustness, and generalization have to be characterized, not assumed, and they are vulnerable to inputs that deterministic tools never had to defend against. DO-330’s qualification criteria were designed around tools whose failure modes are enumerable. A statistical tool’s failure mode is a distribution, and distributions do not fit neatly into a qualification checklist built two decades ago.

This is distinct from the autonomy certification debate. Frameworks like the continuous assurance loop proposed by the MEDUSA project, moving from standards through evaluation, monitoring, feedback, and improvement, are aimed at AI systems that fly or control aircraft in operation. Tooling sits upstream of that. A flawed qualification of an AI coding or verification tool does not show up as an in-flight anomaly. It shows up as a latent defect in certified software that nobody flagged because the tool qualification record said it did not need flagging.

What the decision actually is

Program leaders face a binary choice right now, not in two years when EASA finalizes guidance. Either qualify AI-assisted development and verification tools under DO-330 today, building a defensible rationale for why a statistical tool meets criteria it was not designed to meet, or restrict AI agents to non-critical-path work (test generation, documentation, code review suggestions that a human owns) until the regulatory floor is firmer. The market pressure pushing toward the first option is real. The $57.6 billion shift in aerospace AI investment rewards speed, and AI coding agents are one of the fastest ways to compress a certification timeline.

The board-level question is not whether AI belongs in the aerospace software lifecycle. It already does. The question is whether the qualification rationale for that AI sits in a drawer waiting for an auditor, or whether it was built to survive one.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The argument is coherent and the central claim—that DO-330 tool qualification criteria were designed for deterministic tools and do not cleanly accommodate statistical AI models—is logically sound and
Source & Claim Verification	glm-5.3-flash-fp4 · local	held. The draft’s load-bearing regulatory claims — that EASA’s extension of AI guidance to development/verification tools is a concept paper and will finalize ‘in two years’ — carry no citation at all, the
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects DO-178C/DO-330 tool qualification requirements and their misalignment with generative AI, with no material omissions or framework inaccuracies.
Technical Accuracy	Llama	cleared. The article accurately highlights the technical challenges of qualifying AI-assisted tools under DO-330 for aerospace software development, citing relevant sources and experts in the field.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively anticipates and addresses counterarguments by distinguishing between operational AI and development tool AI, and by framing the core problem as a regulatory gap rather than a
Novelty & Non-Duplication	Grok	cleared. DO-330 qualification of generative coding/verification agents for certified avionics is a distinct toolchain decision not restated in prior EASA-capacity, MRO-tool-record, design-tool ITAR, or DO-178C
Validation	DeepSeek	cleared. The central claim that AI coding agents are being used to develop certified avionics software under standards (DO-178C/DO-330) not designed for them is validated by expert sources and regulatory discu

Sources cited: 9. Validation challenges: 0. Learn how these briefings are written and verified.