Commensurate Confidence: artificial intelligence, assurance and airworthiness in aerospace and defence

Artificial intelligence in aerospace and defence is sold on capability and bought on assurance evidence, and that evidence has to outlive the demonstrator.

Nothing in this article constitutes legal, regulatory or safety-certification advice. It is offered to support discussion and further review with qualified advisers.

What does artificial intelligence in aerospace and defence actually require?

Evidence, held under configuration management from the first week. The customer’s directive asks for data provenance, verification across a written operating domain, and demonstrated safe behaviour outside it. None of that can be reconstructed from a demonstrator, which is why the assurance case is the product.

• JSP 936, published on 13 November 2024, binds Ministry of Defence staff, and the obligation reaches a supplier through contracting teams under Section 8.
• ED-324, designated ARP6983, stood at draft seven with about 1,800 first-ballot comments in August 2025, against a target publication date of 31 December 2026.
• The EASA concept paper released for comment on 3 June 2026 caps supervised learning in initial airworthiness at design assurance level C.
• The Government Accountability Office reported in June 2026 that the F-35 mission capable rate fell from 67 per cent to 44 per cent between financial years 2021 and 2025.
• A Commons Defence Committee report of 10 January 2025 found a say-do gap in the demand signal and valued the UK defence AI sector at about £285m in 2023.

Who does JSP 936 actually bind?

JSP 936 binds the Ministry of Defence, and its reach stops at the department’s own door. Dependable Artificial Intelligence in Defence, Part 1 Directive, published on 13 November 2024 at version 1.1, must be applied by all MOD staff in every phase of the system lifecycle, and every role on its list sits inside the Ministry. The obligation travels to industry through Section 8, which requires contracting teams to make suppliers demonstrate competence to deliver products to a level of confidence commensurate with their use. A company waiting for that clause will be assembling evidence retrospectively about work it has already done.

Defence AI governance is still under construction. A Ministry report of 3 October 2025 records 17 nominated Responsible AI Senior Officers across Defence and describes implementation as at a formative stage with momentum building.

Where does safety certification and AI currently stand?

No published certifiable process standard for machine learning exists in civil aviation. ED-324, designated ARP6983 by SAE, comes jointly from EUROCAE working group 114 and SAE G-34, with a EUROCAE target publication date of 31 December 2026. The EASA concept paper released for a 10-week comment period on 3 June 2026 caps supervised learning in initial airworthiness at design assurance level C. Within its treatment of net safety benefit it states that allocation of level D or the equivalent lower levels to an AI constituent involved in catastrophic failure conditions will not be accepted, which is the narrower statement. NPA 2025-07, opened for consultation on 10 November 2025, remains a proposal.

ARP4754B and ARP4761A were both published in December 2023, superseding editions of 2010 and 1996. DO-178C stands current with no AI supplement. The ED-324 draft introduces the machine learning constituent as the transition point from conventional development into a distinct process, and isolating learned components behind that boundary now is my own recommendation, made in the knowledge that the draft may still change and that no published standard yet requires it. I could find no Military Aviation Authority publication on AI assurance, so the absence of AI-specific UK military airworthiness regulation is an evidence gap, and a planning assumption I would rather not rely on. The argument is then built case by case against Def Stan 00-055 issue 5 and Def Stan 00-056 issue 8, whose full text sits behind MOD ASSIST and which I have not inspected.

Does instrumentation produce availability?

The Government Accountability Office reported in June 2026 that the F-35 mission capable rate fell from 67 per cent in financial year 2021 to 44 per cent in financial year 2025. Two cautions travel with it. The report concerns a United States programme, and the causes it names are parts availability, depot capacity, the reset programme and contractual incentives. The inference that follows is mine. No aircraft generates more health and usage data, so this fleet is the best available test of the claim that data richness produces availability, and a reasonable person could argue that the confound is too large to read anything from it.

The published economics rest on modelling. The cost-benefit analysis of condition-based maintenance for a 150-seat aircraft is a discrete-event simulation, and the life-cycle cost study of prognostic health management for helicopter avionics is a modelling exercise too. I located no measured, independently verified improvement in UK military aircraft or vehicle availability attributable to AI-based predictive maintenance. That gap is the opportunity, since a company running an evaluation with a characterised baseline and an independent analyst would hold evidence the field lacks.

What changes when an opponent is trying to cause the error?

Assurance here has to hold against an opponent trying to cause the error. The canonical demonstration remains a 2018 physical-world attack on visual classification, where stickers applied to a stop sign produced targeted misclassification in 100 per cent of laboratory images and 84.8 per cent of video frames from a moving vehicle. A review of adversarial robustness in aerial detection reports infrared attack success above 90 per cent using thermal-insulation and temperature-control materials, one implementation costing under $5, and black-box attacks on synthetic aperture radar succeeding 98.5 per cent of the time. It also records insufficient real-world testing, no standardised defence evaluation framework, and and datasets of low resolution where operational-grade imagery was called for. I found no verified, officially reported adversarial attack on a fielded defence system, so the evidence base is laboratory and field-experiment work alongside the NIST taxonomy at AI 100-2e2025.

Controlled information travels more easily than models do. Prompts, telemetry, drawings and outputs can each carry controlled content across a security or export boundary without anybody intending it, and JSP 936 asks that export control assessment include data as well as algorithms and models. There is no UK export control on model weights as such, since the control bites on compute hardware and on technology and software transfer. Two United States changes cut against received wisdom, because the ITAR exemption for AUKUS took effect on 1 September 2024 and the framework for artificial intelligence diffusion of 15 January 2025 was rescinded on 13 May 2025, two days before its compliance date.

What does the human factors evidence require of autonomous systems accountability?

Aviation has studied what automation does to the people supervising it for more than 40 years. Bainbridge argued in 1983 that automating the easy parts of a task leaves the human with the hardest residual work while degrading the skill needed to do it. A full flight simulator study of 20 professional pilots flying six landing scenarios at three automation levels found that higher automation improved flight performance and reduced mental workload, but that it came with decreased vigilance to primary instruments. Automation buys performance, yet it costs monitoring.

The Tempe investigation supplies the machine learning failure mode. The National Transportation Safety Board report adopted on 19 November 2019 records that the system detected the pedestrian 5.6 seconds before impact, yet never accurately classified her as a pedestrian or predicted her path, changing the classification several times between vehicle, bicycle and other. What failed was classification stability, which destroyed track continuity and then path prediction, while detection metrics would have looked acceptable throughout. JSP 936 requires analysis of the allocation of functions between human and AI agents to ensure there is no accountability gap, and unstable classification is one way that control quietly disappears.

From demonstrator to fielded capability

An 18-month sequence produces assurance evidence as a by-product of engineering, so the evidence exists when a contract asks for it. The first six weeks bound the work, defining the security, safety, configuration and authority boundaries, writing each operational design domain in testable form, and characterising the incumbent human or legacy system on the same inputs before any model is trained. Months two to five run three bounded pilots under configuration control, none authoritative and one in shadow mode, each with a stop condition agreed beforehand. Months six to 11 cover independent verification and validation, demonstrated safe behaviour outside the domain, and a defined release authority. Months 12 to 18 field the capability with monitoring, drift detection and change control tied to a compatibility matrix.

The assurance case is what the customer is actually buying. A company that builds the evidence chain as it engineers, from need through configuration and test into service, sells into both markets from one controlled record and answers a requirement in weeks. Data provenance, configuration management of all output-influencing data, and a versioned record of model, data, tooling and test are each cheap during development and expensive to reconstruct afterwards.

Timescale is what makes defence AI governance different. A commercial deployment that turns out badly gets switched off, but a platform stays in service for decades, so evidence produced today has to be intelligible to somebody in 2050 who never met anybody involved. Airworthiness argument, safety certification and AI assurance all depend on that record surviving its authors.

One question stays open, and I have turned it over without reaching a firm view. JSP 936 holds that in some applications these issues will simply present too much risk and AI must not be adopted, which is a licence to decline issued by the customer. Who can invoke it is the harder half, since the supplier has a commercial interest against it, the programme office has a schedule, and 17 Responsible AI Senior Officers across Defence is a ratio too thin for case-by-case scrutiny. I suspect the answer is the chief engineer.

Frequently asked questions

Does JSP 936 apply to defence suppliers?

JSP 936 binds Ministry of Defence staff across the system lifecycle. The obligation reaches a company through contract, since Section 8 requires contracting teams to make suppliers demonstrate competence commensurate with the use of the product. Its general statement about industry is hortatory.

Is there a certification standard for machine learning in civil aviation?

No published certifiable process standard exists. ED-324, designated ARP6983 by SAE and produced jointly by EUROCAE working group 114 and SAE G-34, stood at draft seven with about 1,800 first-ballot comments in August 2025, against a target publication date of 31 December 2026. Issue 1 is scoped to non-adaptive machine learning in supervised mode, up to level C.

What design assurance level can an AI function currently reach?

The EASA concept paper released for a 10-week comment period on 3 June 2026 caps supervised learning in initial airworthiness at design assurance level C. Within its treatment of net safety benefit, it states that allocation of level D or the equivalent lower levels to an AI constituent involved in catastrophic failure conditions will not be accepted.

Has AI-based predictive maintenance been shown to improve fleet availability?

The published economic case rests on discrete-event simulation and life-cycle cost modelling. No measured, independently verified improvement in UK military aircraft or vehicle availability could be located. On the most heavily instrumented fleet ever built, the mission capable rate fell by 23 percentage points between financial years 2021 and 2025, which cuts against any claim that instrumentation produces availability on its own.

Which artefacts should exist before a model is trained?

An operational design domain for the capability, written so that it can be tested, and a characterised baseline for the human or legacy system it would replace, measured on the same distribution of inputs. Those two take roughly six weeks, and the JSP 936 substitution argument depends on the second.