How to map an AI model to DO-178C / DO-330 tool qualification

Teams sometimes ask whether a trained neural network can be “qualified as a DO-330 tool” instead of assured as airborne software. The public pages do not support that shortcut. This article maps the words the standards use, then states what we could not find.

What DO-178C is assuring

RTCA describes DO-178C as the core document for defining both design assurance and product assurance for airborne software. FAA AC 20-115D calls it an acceptable means, but not the only means of showing compliance for the software aspects of airborne systems, and does not constitute a regulation.

If a trained model executes on the aircraft and contributes to a software level, it is in that software-assurance conversation. See DO-178C and machine learning gaps and the DO-178C / DO-330 explainer.

What DO-330 qualifies (a tool, not the model)

RTCA’s DO-330 product page defines a tool as a computer program used to help develop, transform, test, analyze, produce or modify another program, its data or its documentation, for example code generators, compilers and test tools.

Whether qualification is needed is determined by DO-178C subsection 12.2, with DO-330 providing the guidance. Effort scales with tool qualification level: TQL-5 tools meet 14 DO-330 objectives while TQL-1 tools must meet 76.

That definition does not describe the trained model that flies. It describes the software used to build, transform or check that model.

A practical mapping, labeled as analysis

Analysis, not sourced fact. Three buckets fall out of the definitions above:

1. The trained model and the inference code that run on the aircraft. These are candidates for DO-178C software assurance (or a project-specific alternative the authority accepts). They are not DO-330 tools under the RTCA tool definition.
2. Development and verification programs that automate a DO-178C objective (training pipelines that generate code or data, test-case generators, coverage or robustness analyzers, documentation generators). These may be tools in the DO-178C 12.2 / DO-330 sense. Whether they need qualification depends on whether you rely on them to eliminate, reduce or automate a process without reviewing the output, which is the question 12.2 is written to ask.
3. Learning that continues in operation. The FAA roadmap says that for learning AI it is not possible to qualify each version and treats that case as an ongoing research topic.

EASA, for its part, proposes learning assurance as an extension of traditional development assurance, not as a DO-330 qualification of the model. A MathWorks worked example treats training and validation data-set requirements as equivalent to software requirements and the trained model as the software design. That is a vendor mapping of the model onto DO-178C artifacts, not a claim that the model is a qualified tool.

What the FAA has said about DO-330 and AI

The FAA roadmap says the agency is supporting the application, and possible extension, of existing standards including DO-178C/ED-12 and DO-330/ED-215, and new AI standards in SAE G-34. “Possible extension” is not a published means of compliance.

EUROCAE still lists ED-324 / ARP6983 as a draft. Status as of 14 October 2026: that WG-114 page still lists ED-324 as Draft with target publication date of 31 December 2026; ER-027 remains published 31 December 2024. Extra draft ERs (human factors, information security, supporting information, RL gap analysis, use cases) still target 31 December 2026–30 June 2027. Until ED-324 is issued and accepted, there is no public G-34 process standard that replaces DO-330 for ML toolchains. Track it on the SAE G-34 / ARP6983 status article, the SAE G-34 page and the G-34 filter. For TQL on the toolchain itself, see DO-330 tool qualification for ML toolchains.

What we searched for and did not find

We did not find an FAA advisory circular, EASA acceptable means of compliance, or RTCA topic paper that says a trained AI model is itself a DO-330 qualified tool. We also did not find an official table that assigns TQL-1 through TQL-5 to training, data-labeling or robustness-verification products. Treat those as questions for the certification authority and the FAA AI Safety Assurance Roadmap.

Listed tools that document airborne ML verification examples, not tool-qualification certificates, include MathWorks AI Verification and Numalis Saimple. MathWorks also publishes a DO Qualification Kit whose public page names DO-178C and DO-330 and says the kit does not prequalify tools. Ansys SCADE Suite names KCG as qualified as a development tool for DO-178B software up to Level A and DO-178C/DO-330 at TQL-1. Rapita RVS names Qualification Kits - Tool qualification for DO-178C. Those are vendor statements about conventional code generation and verification tools, not certificates that a trained model is a DO-330 tool.

Questions

Can I skip DO-178C if I qualify the training stack to DO-330?

No source we cite says that. DO-330 is guidance for qualifying tools used on another program. It does not replace assurance of the airborne software those tools produce.

Does TQL-5 apply to an ML compiler or code generator?

Only if that program meets the DO-178C 12.2 criteria that send you to DO-330. The TQL, if required, comes from that determination, not from the fact that the software mentions AI.

Is ED-324 the mapping?

EUROCAE lists ED-324 / ARP6983 as a draft with a target publication date of 31 December 2026. A draft is not an accepted means of compliance.