Can AI write a certification compliance matrix?

AI can draft one. It can list the applicable clauses of the certification basis, propose a means of compliance for each, and link each row to the documents that will carry the evidence. The decision on applicability, the choice of means of compliance and the compliance statement itself remain engineering judgements that a nominated person reviews and signs. Treat the AI output as a first draft that arrives with its sources attached.

Is ChatGPT safe to use for EASA regulation questions?

A general assistant answers from the open internet, so you cannot be sure which revision of a rule it relied on, whether it mixed acceptable means of compliance with the implementing rule, or whether the reference exists at all. Uploading the Easy Access Rules into a session improves this, but the control is manual and the documents leave your organisation. For compliance work, use a system that answers only from an approved, revision-controlled corpus and shows the citation.

What does a cited answer mean in practice?

Every statement in the answer points to a specific document, revision and section that the organisation has approved, and you can open that source in one step to confirm the wording. If an answer cannot be traced to an approved source, the system should say so rather than fill the gap.

Does using AI change what the authority expects from my organisation?

No. The approval holder remains responsible for the accuracy of every document it submits, whichever tool produced the draft. What changes is your internal procedure: define which tasks AI may support, require citation checks before release, and keep a record of who reviewed and approved each AI-assisted document.

What is the safest first use of AI in a compliance department?

Retrieval from your own approved manuals and procedures. Questions such as which procedure covers subcontracted maintenance, or which clause a finding refers to, have a checkable answer in a controlled document. Start there, measure how often the citations hold up, and extend to drafting once the team trusts the retrieval.

Can AI be trusted for aviation compliance documentation?

Yes, for the parts of the work whose output can be checked against an approved source. No, for the judgement that a compliance document exists to record. AI can retrieve, cross-reference and draft. The organisation's nominated persons still decide and sign. Whether AI output can be trusted depends less on the model than on four conditions around it: a controlled corpus, citations at clause level, a boundary users cannot cross, and human review that leaves a record.

Accountability does not move

Aviation compliance rests on approvals granted to organisations and to the people nominated within them. A design organisation holds its approval under Part 21, a maintenance organisation under Part 145, a continuing airworthiness organisation under Part-CAMO, an operator under its air operator certificate. The authority approved the organisation, its exposition and its nominated persons. It did not approve a software tool, and no tool can hold an approval.

This is the first thing to settle when the question of trust comes up. An AI system does not become responsible for a compliance statement by writing it. The compliance manager, the head of design, the accountable manager remain responsible, exactly as they would be for a draft written by a new engineer. The practical consequence is that AI output must be reviewable by those people in the time they actually have, which is why citations matter more than eloquence.

The regulators have said as much in their own work on AI. The FAA published its Roadmap for Artificial Intelligence Safety Assurance in 2024 and framed the subject as a safety assurance problem to be approached incrementally, not as a new technology to be waved through. EASA's Artificial Intelligence Roadmap 2.0 of May 2023 and its Concept Paper Issue 2 of March 2024 describe Level 1 applications, where AI assists a human, and Level 2 applications, where AI and human work as a team under human oversight. Those documents address AI inside aircraft systems and operations rather than office tools, but the principle carries over unchanged: the human keeps oversight, and the system has to be assured to the level of its authority.

The most recent step is NPA 2025-07, published by EASA on 10 November 2025 with comments accepted until 10 March 2026. It proposes detailed specifications on AI trustworthiness, called DS.AI, for AI-based systems that a risk assessment determines to be high-risk under the EU Artificial Intelligence Act and that are classified as Level 1, human augmentation or assistance, or Level 2, human and AI cooperation. The specifications cover the concept of operations, classification, operational domain, risk assessment, an ethics-based assessment, intended behaviour and continuous risk assessment with in-service data recording. Maintenance organisations, continuing airworthiness management organisations, design organisations and operators are all listed among the stakeholders affected. Two things the NPA does not do are worth stating plainly, because they are often misreported: it does not prescribe what documents an AI assistant may answer from, and it does not prescribe citation formats or audit logs for office tools. Those controls come from the organisation's own approval and procedures, and from the four conditions below. Whether a compliance assistant even falls within DS.AI depends on the risk assessment the NPA itself defines, and a follow-on task will connect the framework to the domain rules.

How AI actually fails in compliance work

General-purpose language models fail in four characteristic ways when asked regulatory questions. Knowing them is the basis for deciding what to trust.

Invented references. The model produces a clause number, a paragraph or a document title that reads correctly and does not exist. In a compliance matrix, one such row can pass three reviews because it looks like every other row.
Wrong revision. The model answers from whatever version of a rule dominated its training data. Regulations change, acceptable means of compliance are amended, and the Easy Access Rules are reissued. An answer that was right two revisions ago is a finding today.
Blurred hierarchy. An implementing rule is binding. An acceptable means of compliance is one way to comply, not the only way. Guidance material explains. Models routinely present all three with the same confidence and the same "shall".
Mixed jurisdictions. CS-23 and 14 CFR Part 23 are not the same certification basis. EASA Part 145 and the FAA's Part 145 differ in structure and in the forms they reference. A model that has read both will blend them when the question does not pin the jurisdiction down.

Underneath all four is the same problem. A fluent answer reads like an authoritative one. In most office work that costs a correction. In a certification programme it can cost a finding, a delayed approval, or a document that has to be withdrawn from an authority that has already read it.

Trust depends on the task

The useful question is not whether AI can be trusted but for which task, under what checking. The table below is how an airworthiness engineer would sort the work.

Task	Can AI output be relied on?	Condition
Formatting, restructuring and rewriting approved text	Yes	Diff against the source before release
Finding the procedure, clause or record that answers a question	Yes, from a controlled corpus	Every answer carries a citation the reader opens
Cross-referencing a company procedure against a regulation	Yes, as a proposal	Reviewer confirms the clause and the revision
Drafting compliance statements and means of compliance	As a first draft	Engineer with the design knowledge edits and owns it
Interpreting an ambiguous requirement	Only as input	Specialist judgement, often a discussion with the authority
Deciding that a design or operation complies	No	Nominated person
Signing or approving compliance evidence	No	Not an AI role

The four conditions for trustworthy AI in compliance work

The failure modes above are properties of a model answering from the open internet. All four are contained by the system around the model rather than by the model itself. Four conditions do the work.

1. A controlled corpus

The assistant answers only from documents the organisation has approved: the current Easy Access Rules or their equivalent for the jurisdiction, the exposition, the procedures, the records that apply. Nothing enters that corpus without a named person accepting it, and superseded revisions leave it when the new one arrives. This single condition removes the wrong-revision and mixed-jurisdiction failures, because the model has nothing else to draw on.

2. Citations at clause level

Each statement in an answer points to the document, revision and section it came from, and the reader can open the source in one step. This turns review from an act of faith into a check that takes seconds. It also exposes invented references immediately: a citation that cannot be opened is a wrong answer, and a system built this way should decline to answer rather than fill the gap.

3. A boundary users cannot cross

The people asking questions must not be able to change what the assistant knows. Ingestion is a privileged, reviewed step. Everyday use is read-only. This is a structural property of the deployment, not a line in a prompt, because prompts can be argued with and structures cannot. It is the same separation of duties that already governs who may issue a revision of the exposition.

4. Review that leaves a record

An AI-assisted document is reviewed and approved by the same nominated person who would have approved a human draft, and the record shows who reviewed what and when. The assistant proposes, the evidence supports, the engineer decides, an independent reviewer verifies. If your procedures already say this for human authors, they need one sentence added for AI-assisted drafts.

Seven questions to ask before you trust any tool

Which documents can it answer from, and who decides what goes in?
Does every answer show the document, revision and section, and can I open it?
What does it do when the answer is not in the approved documents?
Can a user add to or alter the knowledge base, and is that separated from everyday use?
Where does the data live, and does any of it leave our environment, including model calls?
Can I export the citations with the draft so a reviewer sees them together?
Which of our procedures needs a revision to describe AI-assisted drafting and its review?

A vendor who can answer all seven without hesitation has built for compliance work. One who leads with the model's benchmark scores has built a chatbot.

How Wingman360 Teammate applies this

Wingman360 Teammate was built by aviation people around exactly these four conditions. Administrators ingest regulations, manuals and records into a knowledge base, and nothing enters it without human approval. Everyone else gets answers drawn only from that approved knowledge, with citations they can open, and users cannot alter the knowledge base because the boundary is structural. The compliance workflows it ships with, certification basis compliance matrices, SORA and FHA safety assessments, operations and organisation approval documents, produce drafts for review, not signed documents. Each deployment is a dedicated single-tenant instance in the customer's own cloud or on-premise, and with a local model nothing leaves the network, not even model calls.

We do not claim it never produces a wrong answer. We claim that every answer can be checked against the source it names, in the time a reviewer actually has, and that the people who hold the approval keep every decision that the approval makes them responsible for.