On 3 June 2026, EASA released Proposed Issue 03 of its Concept Paper on artificial intelligence, the final Concept Paper deliverable under its AI Roadmap 2.0. Issue 03 extends the agency's learning-assurance guidance beyond the supervised models of earlier issues to reinforcement learning, symbolic AI, and Level 3 'advanced automation', the category where the human operator may be remote or absent. The consultation runs until 12 August 2026. The direction is unambiguous: the regulator is now writing assurance objectives for AI that adapts, and for AI that acts with high authority.

The process standard that programs need in order to actually generate certification evidence is not keeping the same pace. ED-324, the EUROCAE designation for the joint EUROCAE WG-114 and SAE G-34 standard (ARP6983 on the SAE side), is listed by EUROCAE as a draft with a target publication date of 31 December 2026. Public briefings on the standard describe its first issue as scoped to frozen, non-adaptive, supervised-learning models, up to design assurance level C, with reinforcement learning and other techniques deferred to a later issue.

Read together, the two documents describe a seam. One side defines objectives that increasingly assume the model can change. The other side, the part a certification authority can hold a program to, assumes the model does not.

Every objective in a learning-assurance process is anchored to a specific model instance. The operational design domain is characterized for that model. Dataset sufficiency, data management, and learning-process verification are evidence about how that model was trained. The verification activities confirm that this model, the one under evaluation, behaves acceptably across its stated input space. The assurance case is, in effect, a statement about one artifact at one point in time.

This is a reasonable foundation, and it mirrors how DO-178C and DO-330 treat airborne software and the tools that produce it. The difficulty is not that the frozen-model approach is wrong. The difficulty is that a learned component rarely stays frozen for the life of the system.

A model gets retrained when in-service data exposes a gap. It gets compressed or quantized so it fits the target processor and its timing budget. It gets swapped when a better architecture appears or a supplier changes. Each of these is a change to the exact artifact the assurance case was written about, and each one, under a frozen-model standard, moves the system outside the scope the evidence was built for.

Today there is no agreed evidence model for that transition. The practical consequence is that a change a software team would treat as routine becomes a recertification question, and the program either absorbs a long manual review cycle or holds the update. Decoupling a model update from full system recertification, without lowering the assurance bar, is the bottleneck that gates how fast AI can be adopted in airworthy and mission-critical systems.

The mechanism for closing this gap is beginning to appear in the open literature, which a lab can cite without exposing anything proprietary. The relevant question is not only whether an updated model is accurate. It is whether the updated model is behaviorally equivalent to the certified original, within a stated and defensible bound.

A March 2026 paper, SimCert (arXiv 2603.14818), certifies exactly that property for compressed networks: it produces quantitative, confidence-bounded guarantees that a quantized or pruned model preserves the behavior of the original, and it demonstrates the method on the public ACAS Xu collision-avoidance benchmark. Related work on semantics preservation argues that the certified artifact is a precise description of the model's behavior rather than a particular weights file, so any re-implementation is sound only if it provably preserves that description. Runtime out-of-distribution monitoring supplies the complementary piece: an in-operation check that flags when live inputs leave the domain the certification evidence actually covers.

The standard is not final, and the regulator's objectives are still moving. Programs integrating machine learning into safety-critical aerospace and defense systems do not have to wait for either to settle. The work that holds up later is the work that treats each model version as a controlled configuration item and records, per change, what was modified and what evidence was regenerated.