Before an aviation AI pilot, define the decision it may influence

A narrow image-review pilot needs a clear decision chain, evidence for human oversight and control of changes beyond the model.

Before an aviation AI pilot, define the decision it may influence

An image model marks a patch on an aircraft panel for inspection. A reviewer sees the highlight and opens the original photograph. So far, the system appears to be a tool for finding work. But if an unmarked image is silently treated as evidence that no inspection is needed, the same model has acquired a much larger decision-making role.

That change can happen through workflow design without changing the model at all. For an aviation team, a useful first question is therefore not which model has the highest image score. It is which human or system decision the output can influence, including what happens when the output is absent or wrong.

This analysis uses dated technical frameworks: EASA's May 2023 AI Roadmap 2.0, its March 2024 Concept Paper Issue 2, and the FAA's Version I AI Safety Assurance roadmap, whose foreword is signed on 23 July 2024. Sources were checked on 17 October 2026. They concern European and United States aviation contexts and are not interchangeable. This article explains assurance reasoning, not current legal requirements, certification eligibility or approval of any aircraft or product. The inspection example is hypothetical.

What the frameworks contribute

EASA's Issue 2 distinguishes assistance that enhances human capabilities from human-AI teaming, including systems taking decisions under human oversight. It develops learning assurance, explainability and human interaction guidance. The distinction directs attention to the authority of a system in its surrounding workflow, rather than to the presence of a person somewhere in the process. [EASA Concept Paper Issue 2, March 2024](https://www.easa.europa.eu/en/downloads/139504/en)

The FAA's Version I roadmap sets out a strategy for safety assurance, including clear responsibility and a distinction between a fixed learned system and one that adapts in operation. It advocates an incremental approach within the aviation safety ecosystem. It is a roadmap for developing assurance methods, not a certificate for a particular application. [FAA AI Safety Assurance roadmap, Version I](https://www.faa.gov/aircraft/air_cert/step/roadmap_for_AI_safety_assurance)

EASA's 2023 roadmap describes a lifecycle extending upstream into data collection and governance and downstream into operational monitoring and training. Its future milestones are plans as written in 2023, not evidence that later milestones were achieved. The useful engineering lesson here is to examine the whole lifecycle, rather than regard model training as the complete assurance task. [EASA AI Roadmap 2.0, May 2023](https://www.easa.europa.eu/sites/default/files/dfu/easa_ai_roadmap_2_0_2023.pdf)

Taken together, these documents suggest three complementary questions for a proposed pilot: what authority does the output carry, what evidence supports that role and how will the deployed configuration remain within the examined boundary? The following workflow is an editorial application of those questions, not a prescribed compliance method.

Describe the pilot as a decision chain

For the fictional panel-image pilot, write down the chain in ordinary language. A technician captures an image under a defined procedure. The model proposes areas for attention. An authorised reviewer checks the original image and the proposal. The established inspection and disposition process remains responsible for the actual maintenance decision. The pilot neither authorises work nor releases an aircraft.

Now inspect the less visible paths. What happens if upload fails? If the image is out of focus? If the model produces no highlights? If two images cover the same panel? If the reviewer cannot open the original? An empty result must not quietly become an all-clear. The interface should distinguish successful processing with no candidate highlight from an image that could not be evaluated, while avoiding any unsupported assurance that a successfully processed image is defect-free.

The proposed boundary also needs to state which cameras, surfaces, lighting conditions and defect categories are in scope. Include cases the team knows it cannot evaluate. A model trained on one set of panels cannot be assumed to cover another material, repair history or capture angle just because the image looks similar to an engineer.

Build evidence for the decision, not just the image score

A local research evaluation could use images whose reference assessments have been independently reviewed. Preserve disagreement and uncertainty rather than forcing every ambiguous image into a clean label. Split data so that near-duplicate photographs of the same physical condition do not appear across development and evaluation sets. Otherwise the test can reward familiarity with a particular panel rather than performance on a new inspection.

Evaluate missed relevant regions, false highlights, unusable images and reviewer handling separately. Aggregate accuracy is a poor description of a workflow in which different misses have different consequences. A highlight that is slightly misplaced may still guide a careful reviewer; a visually clean image that conceals a relevant region may lead them away from it. The assessment has to connect the error to the action it can influence.

Run a reviewer study that includes both helpful and wrong model suggestions. Compare decisions and review time under defined conditions, while preserving the original process and independent reference assessment. Ask whether reviewers inspect unmarked areas and recognise unavailable results. The purpose is to test the proposed assistance, including possible over-reliance, rather than assume that adding a confirmation button creates effective oversight.

No numerical acceptance threshold is supplied here. Setting one requires the responsible organisation's safety assessment, relevant expertise and applicable approval process. A small successful pilot cannot establish rare-event safety or justify a broader operational role by itself.

Treat a changed workflow as a changed system

Freeze the model, preprocessing, capture procedure, user interface and decision boundary used in the evaluation. Record which versions produced a proposal and which source image a reviewer saw. If a later release changes image compression, camera hardware or the display of “no highlight”, assess the effect before treating old results as applicable.

A fixed model can encounter changed conditions even when its weights do not update. A model that learns during operation introduces an additional change mechanism. Either way, the team needs a way to detect departures from its evaluated boundary, suspend the assistance and return to the established process. Monitoring should have an owner and a response, not merely a dashboard.

The potential benefit of a narrow pilot is better-directed human attention, if testing supports it. The limits are equally concrete: an image tool cannot infer unseen structure, a human confirmation cannot repair every presentation bias, and an advisory pilot is not operational acceptance. Start by making those limits visible in the decision chain. Only then can the team decide what evidence a useful next step would require.