AI in Aviation Safety Management: Use Cases, Risks and Human-in-the-Loop Controls

AI in aviation safety is most useful where the workload is repetitive, structured and currently throughput-constrained by human attention. Four use cases stand out.

Occurrence classification. Every occurrence has to be classified against the operator's taxonomy (ICAO occurrence categories, internal severity, hazard linkage). Human classification is slow, inconsistent across reviewers, and the throughput bottleneck of every safety team. AI classification agents propose categories with confidence scoring; the safety manager approves, edits, or rejects.

CAPA drafting. Drafting a corrective action against an open finding is a 15-to-30-minute job per finding. AI drafting agents produce a starting draft against the finding, the relevant procedure section and the previous action history; the human edits and approves.

Weak-signal detection. Spotting a pattern no single report shows, the same barrier rated less than effective on approaches with one aircraft type at one airport, was historically the work of a senior safety analyst with time on their hands. eAviora runs that search every day, and the search itself is statistics rather than a language model: it tests combinations of facts such as event type, aircraft, location, flight phase, risk family and degraded barrier across occurrences, hazards, findings and flight-data exceedances, and lists the ones that recur more often than chance explains for the safety team to acknowledge, act on or dismiss. Two AI agents work beside it: one writes the scan's brief from the numbers the scan produced, and one, on request, reads the occurrences, findings, hazards and training linked to a regulatory requirement and advises whether the operation tells a different story than the paperwork.

Summarisation. Producing a safety review board pack from five exports across SMS, QMS, training, documents and audits is a multi-hour weekly job. eAviora builds the board safety pack itself every month from the live records, with no model involved, and AI agents narrate on top of what it computed: a risk-portfolio summary of the register, the risk profile and the barriers for the accountable manager, and, for a board agenda item, a drafted disposition with candidate corrective actions that the board accepts, edits or rejects.

These four use cases share two properties: they have a clearly-bounded scope, and the output goes through a human reviewer before having operational effect.

The list of operations where AI should not decide alone is short and important. It is also the most useful test of whether a vendor's AI positioning is responsible or marketing.

• Closing a CAPA. Closure requires effectiveness verification, which is a judgement about whether the action achieved its intended outcome based on operational evidence. AI can propose; only a named human can sign.
• Finalising an occurrence classification. The classification has regulatory consequences. AI can propose; the safety manager finalises.
• Signing effectiveness verification. The verifier signature is a personal undertaking. AI cannot sign.
• Delivering regulator-facing claims. Any statement to a regulator about compliance, posture, or status is a human-signed artefact.
• Assigning sanctions under Just Culture. The Just Culture decision tree is a human conversation involving panel review and accountable manager sign-off. AI does not enter this loop.
• Altering the Safety Risk Profile in a way that bypasses the underlying records. The SRP is a derived view, not an asserted state.
• Any action with operational effect on the aircraft, crew or passengers. Operational decisions belong to qualified humans in defined roles.

The pattern is consistent: AI proposes, the qualified human decides. A vendor whose AI roadmap blurs this line is offering features that will not survive a regulator audit.

Human-in-the-loop (HITL) is the structural pattern that distinguishes defensible aviation AI from undefensible aviation AI. The pattern is four-step:

1. The AI proposes. Classification, draft, summary, signal, the agent produces a candidate.
2. The system records. The audit trail captures the agent, the model, the prompt, the inputs, the proposed output and the confidence score.
3. The qualified human reviews and decides. Named human, appropriate role for the decision, approves, edits, or rejects.
4. The platform replays. Three years later, the regulator can replay the agent run, see the inputs, see the proposal, see the human approval, see the outcome.

The HITL pattern is also the test of vendor maturity. Ask: show me the agent run history. Show me an example log. Replay a run from six months ago with the original inputs. The vendor either ships these capabilities or doesn't. Marketing language about “explainable AI” without the underlying audit infrastructure is not the same shape.

The auditability bar for AI in aviation safety is the same as the bar for the SMS itself: the regulator three years later must be able to reconstruct what happened, why, and on whose authority.

Run-level traceability. Every AI run has a unique ID and a timestamp. The agent, the model, the model version, the prompt, the inputs, the structured output, the confidence score, the human reviewer, the human decision and any edits are all recorded.

Replay capability. Given a run, the platform can show the original inputs, the proposed output and the human decision exactly as they were. A fresh execution rarely produces the same words, so the recorded run is the evidence, not a re-run.

Tenant isolation. AI runs are scoped to the operator's tenant. eAviora operates no model training pipeline, so operator data trains nothing here, and the AI provider states it does not train on inputs or outputs.

Append-only trail. The audit log is append-only. A reviewer cannot edit history; a reviewer can only add a correcting entry visible alongside the original.

Together these capabilities make AI in aviation safety defensible. Ask vendors how each capability is implemented; the answers tell you whether the platform was designed for audit or for demo.