Building an AI assurance case (GSN/AMLAS) for certification

Certification conversations often ask for “the assurance case.” Two public documents are cited more than most: the Goal Structuring Notation (GSN) community standard, and AMLAS, a six-stage method that uses GSN patterns for machine-learning components. Neither one is an FAA advisory circular or an EASA acceptable means of compliance in the sources we checked.

What GSN is

The Safety-Critical Systems Club hosts Goal Structuring Notation standardisation, maintained by the GSN Standard Working Group of the Assurance Case Working Group. The GSN Standard page says the standard has two functions: a comprehensive, authoritative definition of GSN, and clear guidance on current best practice for people who develop and evaluate engineering arguments.

The current text is Version 3. SCSC’s citation record dates the publication to 4 May 2021. The PDF is the community standard. It is a notation standard for arguments, not an aviation product-assurance process and not a machine-learning method.

Status as of 14 October 2026: the GSN Standard page still lists version 3 as current. The AMLAS page still describes six stages and still says Since launching in 2022. The Visio prototype is still AMLAS Tool v1 May 2022. We still found no FAA or EASA AMC that adopts GSN or AMLAS.

What AMLAS adds

The University of York’s Centre for Assuring Autonomy publishes AMLAS (Assurance of Machine Learning for use in Autonomous Systems). The centre describes it as a methodology which supports the safer deployment of autonomous technologies which have a machine learning component, with six stages and a set of safety case patterns.

The Version 1.1 guidance (March 2021) says AMLAS comprises a process for systematically integrating safety assurance into the development of ML components and for generating the evidence base for explicitly justifying the acceptable safety of these components. The six stages in that document are:

1. ML safety assurance scoping
2. ML safety requirements assurance
3. Data management
4. Model learning
5. Model verification
6. Model deployment

AMLAS takes a whole system approach: safety considerations are only meaningful once scoped within the wider system and operational context. The process requires as input the system safety requirements generated from the system safety process. It is iterative.

The argument patterns are represented using the Goal Structuring Notation (GSN). The guidance tells readers to consult the publicly available GSN standard. In AMLAS, the use of “shall” indicates a required element of the guidance. That “shall” is inside AMLAS. It is not an FAA or EASA “shall.”

The download page hosts the PDF. Version 1.1 says AMLAS should not be used in isolation from other standards and guidelines that specify safety-critical practice, and names ARP4754A among the examples. It has a primary focus on off-line supervised learning.

What the aviation authorities have actually said

The FAA AI Safety Assurance Roadmap supports application, and possible extension, of existing standards including DO-178C and DO-330, and new AI standards in SAE G-34. We searched that page for “GSN”, “AMLAS” and “assurance case” and did not find those terms. The route it describes for learned AI remains project-specific issue papers and special conditions. See the FAA explainer and How to map an AI model to DO-178C / DO-330 tool qualification.

EASA’s concept paper Issue 02 proposes learning assurance as an extension of traditional development assurance. It is preliminary guidance. We did not find a sentence in that PDF that adopts AMLAS or GSN as an AMC. ED-324 / ARP6983 remains a draft. See DO-178C and ML gaps.

A practical reading, labeled as analysis

Analysis, not sourced fact. If a certification authority asks for a structured argument that the ML component is acceptably safe in context, GSN is a documented notation for writing that argument, and AMLAS is a documented way to generate the claims and evidence for an ML component once system-level safety requirements exist. The case still has to map to whatever the authority accepted (issue paper, special condition, or a future G-34 standard). AMLAS does not replace DO-178C / DO-330.

The directory lists Adelard ASCE because the vendor page names full support for Goal Structuring Notation (GSN) Version 3 and a Modular GSN plugin, and CAE ASCAD 2.0 for autonomous systems and AI-driven machine learning behaviour. That is a vendor statement, not a qualification.

Questions

Does the FAA require a GSN assurance case for airborne ML?

We did not find that requirement on the FAA roadmap page or in the other aviation sources cited here.

Can AMLAS stand in for DO-178C?

No source we cite says that. AMLAS scopes the ML component and requires system safety requirements as input. DO-178C remains the airborne software baseline the FAA roadmap says it will apply and possibly extend.

Is Version 1.1 the current AMLAS?

The centre’s AMLAS page and the download page are the places to re-check. The PDF we read is labeled Version 1.1, March 2021.