Under DO-178C, the AI agent that writes your airborne code is the easier case to defend. The one that reviews it is where tool qualification catches up with you.
That runs against intuition. Generating flight code feels like the risky use and reviewing it feels like the safe one. The certification logic says the opposite, and teams that get it backwards end up taking credit for verification they cannot support.
How DO-178C treats a tool that writes code
Under DO-178C, a tool needs qualification under DO-330 when it eliminates, reduces, or automates a DO-178C process and its output is not verified. A code generator whose output goes into the airborne software unverified sits in the most demanding qualification category.
No regulator has accepted a DO-330 qualification of a generative code generator. EASA's proposed AI guidance, out for consultation in 2026, would cap large off-the-shelf models at the lowest tool qualification level, which rules them out as code generators whose output goes unverified. So teams do the sensible thing: they verify everything the agent writes, exactly as if a person wrote it. Nothing the agent produces is taken on trust, so the agent itself needs no qualification.
How it treats a tool that checks code
Verification tools follow a different rule. A tool that could fail to detect an error, and whose results you take credit for, is a verification tool. Point an AI reviewer at the code and count its review toward a verification objective, and you have introduced a tool that needs qualification, at a higher level for Level A and B software if its results are also used to justify reducing other verification or development work. An AI reviewer stays outside qualification only when a person performs the complete review independently and takes the credit.
That is the trap. The writing agent sits safely behind human verification. The reviewing agent, the moment its findings stand in for a reviewer's, is the verification.
What agents do to independence
At the higher software levels, DO-178C expects some verification objectives to be met with independence, meaning someone other than the developer of the item does the verification. Agents blur both sides of that.
Who is the developer of a module an agent wrote at an engineer's direction? The defensible answer is the engineer. If that same engineer then reviews it, the independence exists only in the account names. And if an AI reviewer made the first pass and the engineer signed off on its findings, the review in the record is not quite the review that happened.
The FAA and EASA have both published roadmaps for assuring AI, and EASA has issued concept papers with guidance for AI across aviation. Its latest proposal extends that guidance to AI-based development and verification tools, but it is not final. Until it is, DO-178C and DO-330 remain the reference for tools, and both predate generative AI. Automotive teams reach a similar place by a different route, through ISO 26262 tool confidence. See ISO 26262 and Automotive SPICE® with AI coding agents.
What to have ready
- Every AI tool named in your plans, on the right side of the line. State whether each tool's output is verified or taken for credit. A generative coding agent belongs firmly on the verified side.
- AI review as assistance, not credit. Let AI reviewers help people find issues, and take verification credit for the human review, unless you are prepared to qualify the tool.
- A developer and a verifier for each item. Record who directed the agent and who verified the result, and keep them different people where independence is required.
- Proof, change by change. A policy that says every agent change is verified is not evidence. A record that shows it is.
Proving the verification happened
Bloomfilter takes no verification credit and is not a tool you qualify. It is the record that shows the verification you do take credit for actually ran: for every change an agent wrote, who reviewed it and whether a review or test was skipped, rebuilt from your requirements, version control, reviews, CI, and agent sessions. Because it shows who reviewed each change, it also shows whether the review you take credit for was done by a person, which is what keeps AI review in its place as an assistant. Bloomfilter for regulated software.