Skip to content

Wartime iteration, peacetime assurance

Fast jets, transports, helicopters, drones and the stores they carry. They change in weeks now. The approval processes behind them were built for a purchase once a decade

Anything that flies, and everything it carries

The first question a programme office asks is whether we cover the thing they build. This is the answer, drawn

Crewed air

People aboard, so the escape, the egress and the crew station are part of the showing

  • Fast jetFlight envelope, stores clearance and the escape system
  • BomberLong range structures, bays and release
  • TransportCargo restraint, airdrop and the ramp
  • TankerTwo aircraft in one showing, boom or drogue
  • Maritime patrolMission fit, endurance and the sensor bay
  • Airborne early warningA rotodome changes the aeroplane it sits on
  • TrainerSpin, recovery and the seat a student sits in

Rotary wing

Rotor, drive and gearbox, and a crash volume that has to hold

  • Attack helicopterStub wing stores, ballistic tolerance, low level
  • Lift helicopterUnderslung load, hoist and troop egress
  • Maritime helicopterDeck limits, folding rotor and the ship airwake
  • TiltrotorTwo flight regimes and the conversion between them

Uncrewed

Nobody aboard, so the command link, the lost link and the control station are inside the showing

  • Long enduranceAirspace access, link latency and return to base
  • Collaborative combatAutonomy, teaming and a contingent flight path
  • Rotary uncrewedShipborne recovery and an autonomous landing
  • Small multirotorWhat is proportionate, and what is not
  • Target and expendableRecovered by parachute, or not recovered

What they carry

Carriage, release and separation are the aircraft’s showing. What the weapon does after it leaves the rail belongs to another authority, and we do not go there

  • Air to air missileRail or eject launch, plume and separation
  • Cruise missileHeavy store carriage and clean release
  • Precision guided bombBay or pylon, arming and jettison
  • Loitering munitionTube or rail, and a store that flies itself
  • Hypersonic vehicleThermal, structural and separation at speed
  • Ballistic vehicleAir launched stages, mass and centre of gravity

Three regimes, three different answers

What lands on the authority desk depends on who regulates you. So each regime has a page of its own

Check us on itPick what you fly and who regulates you, and read every record the product composes

The threat moves, so the aircraft has to

Six steps, and the last one is the reason this page exists

The jamming works

The aircraft can no longer find its way to the target, or the target has been hardened against it

So the payload changes

A new sensor, a new datalink, a different way of being guided to the same place

So the platform iterates

In weeks. The industry planned for spirals measured in years

But the evidence was built once

The safety case assumed the aircraft would be bought and kept, not revised every quarter

And now the software thinks

Autonomy and model updates sit in the loop, changing between releases

So the assessment has to fit the cycle

The next revision arrives before the last safety case is closed, and the old process assumes the aircraft holds still while the evidence is assembled

AI hallucinates, and in a military aircraft that is fatal

Autonomy is entering the loop faster than the assurance behind it. A tool that fills a gap with a fluent guess moves the risk somewhere nobody is looking

a generated answer
Fluent, confident, unsourced
Different on the second run
A gap looks like an answer
The model is the engine
a computed answer
Cited to the clause, or explicitly undetermined
Identical on the hundredth run
A gap is reported as a gap, with what would close it
The engines run without a model at all

CertProve abstains. Where the evidence does not support a claim, it says so and names what is missing. Every statement carries its source, and nothing is asserted because it sounded right

You do not have to trust our AI, bring your own or none at all

Four settings, and a programme can sit on any of them. The engines are deterministic code, so the product works completely with the model turned off

TRIAL
Our evaluation key
Capped per month, for looking at it. Never the setting a programme runs on
YOUR KEY
Your own key and endpoint
Your account, your provider, your terms. The only setting assisted drafting will run on at all
YOUR GATEWAY
Your gateway, your region
One setting points generation and search alike at your EU, sovereign cloud or on premise gateway
OFF
Disabled by policy
No model call leaves the product. Every deterministic engine keeps running in full

“Assisted drafting runs only on your organisation's own key and endpoint (BYOK), because the fact pack leaves the deployment. Configure the AI profile in Settings, or draft by hand.”

The product refusing our own key on a drafting request. Not a setting an administrator has to remember
on a defence programmeAI LOCKED at programme scope
in the hardened buildno model client to remove
your data against a public modelnever, on any setting

Every flying object that requires certification

The engines that grade a civil case against CS-25 grade a military UAV against STANAG 4671, cited to the clause or honestly abstaining, never invented

The Alliance wants drones at scale

An official text of 7 July 2026 says so in four points. Three of them are our subject. The fourth is not, and the page says which

NATO · official text · 7 July 2026
In our words, not theirs
01Drones now decide battles, and incidents affecting Allies have risen
02Allies are expanding their ability to produce and operate drones at scale
03Industry is asked to deliver, small and medium firms named beside the primes
04Countering drones has its own investment line. Not our subject, and we do not pretend it is
Read the text on nato.int
what a drone at scale still owes
the basisSTANAG 4671 or 4703, named as a basis
the applicationEMAR 21 Subpart B, cited by point
every iterationa change record, Subpart D
to fly itflight conditions, Subpart P
the hazardshazard log and safety case
in the UKthe Regulatory Article, at issue
in the US516C criterion, 882E task
A small expendable drone owes none of this. The systems that do fly in your own airspace to reach their range, and the scope below names them
what changes in service
airframepayloaddatalinkautonomy
Each one a change classified against the type record, with the evidence it touches named and current before the next airframe leaves the line
01
Scale is a records problem before it is a production problem
Every airframe that leaves the line carries the same type record, and every iteration of it is a change classified against that record
02
A small firm files the record a prime would
The application, the change record and the hazard log have the same shape at any size. What differs is how much of the evidence you already hold
03
One record, read by more than one Ally
A record cited to the EMAR point reads the same in every nation that transposed it, so the evidence travels with the aircraft
Context: NATO, an official text of 7 July 2026, put in the product's own words and not quoted
CertProve is independent: not endorsed by, affiliated with or funded by NATO, and no emblem of theirs appears here

The regulatory ground

Four regimes write the same duty four ways. A military record is cited to the point, the article, the criterion or the task it answers to, so a reader can open what the record stands on

EDA · EMAR 21
European Military Airworthiness Requirements

The certification of military aircraft, their products, parts and appliances, and the organisations that design and produce them.

written bythe EDA MAWA forum
cited tothe point, by number
wordingthe Authority, never the Agency
transposed byeach participating nation
UK MAA · REGULATORY ARTICLES
The Military Aviation Authority

The United Kingdom transposes the requirements as Regulatory Articles, and a record names the article and the issue it read.

RA 5000 seriesdesign and modification
beside itdesign safety targets, release to service
cited tothe article and its issue
withdrawn articlecatalogued, never cited
NATO · STANAG 4671 AND 4703
The unmanned layer

The airworthiness requirements for unmanned aircraft systems, named as a basis and never reproduced.

STANAG 4671fixed wing UAS, AEP-4671
STANAG 4703light UAS, AEP-83
current editionsrestricted, named only
adopting onerecorded with your own showing
US DoD · 516C AND 882E
The United States route

The airworthiness certification criteria and the system safety standard, both works of the United States Government in the public domain.

MIL-HDBK-516Cthe criteria, cited by criterion
MIL-STD-882Esystem safety, cited by task
tailoringon the record, with rationale
silent tailoringa gap the record names
the record cites
EMAR 21.A.21Issue of a type certificateresolves to the point
01
The record reads in the regime's own words
An EMAR record says the Authority, a UK record says the MAA, a US record says the criterion. The pack is written for the reviewer who will open it
02
A restricted standard never leaks into your pack
Where the edition is restricted the product names it and stops. Your showing against it stays on your deployment, and none of the standard's text goes out
03
The tailoring is defensible on the day of the review
Every criterion set aside carries its rationale and its reference, so the question a certification review asks first is already answered in the record it is reading

CertProve is independent: not endorsed by, affiliated with or funded by any body named here. Their rules are cited as published, and no emblem of theirs appears in the product

European UnionEuropean Defence AgencyNATOUK Ministry of DefenceUnited States Department of Defense

Three things, done properly

01
Airworthiness evidence, native to the military basis
STANAG 4671, EMAR 21, national military requirements, and the civil codes for non segregated airspace. Cited at the amendment in force, abstaining where a document is restricted
02
Delta assurance, so a change costs an afternoon
Record the baseline, declare the change. The platform names what it touches, what evidence stands, what it invalidates, and the reassessment plan, frozen and hashed
03
Test evidence that stays reusable
Every trial linked to the claim it supports and the configuration it was flown at, so the evidence survives the next version instead of being repeated

A new payload should cost an afternoon

Declare the change against the approved baseline, and the platform computes the certification impact instead of a team rediscovering it

a change is declared against the approved baseline
Sensor payload replaced · autonomy software revised
affected requirements and hazardslisted, with the path that connects them
evidence that still countskept, with the reason
evidence the change invalidatesnamed, never quietly reused
the reassessment planordered by what unblocks the most
the whole recordfrozen and hashed for the authority

Where certification is a requirement, and where it is not

Two of these three are ours. Naming the third is the honest part

IN
Manned military aircraft
Certification required, and the platforms are now expected to evolve as fast as the software inside them
IN
Long range uncrewed systems
Medium and high altitude. They fly in your own airspace to reach the range, which is what makes certification the thing that unlocks the training
OUT
Small expendable drones
There is no airworthiness requirement, and we do not pretend otherwise

What your security review will ask, answered by the machine

Their checklist on the left, our live readout on the right. Every row is a shipped behaviour with a test that fails the build the day it stops being true

DEPLOYMENT
“Can it run on our own hardware, in our own region?”
tenancysingle, yours
air gapsupported
beyond its own databasenothing leaves
Every destination is listed with the setting that created it, live, dated and tamper evident
ACCESS
“Who can see this programme, and can you prove it?”
named key · viewuntil it lapses
organisation membershipopens nothing
the access review registerprinted from the instrument
Need to know is enforced by the machine, not by a convention the team follows
MARKING
“Will export controlled material carry our marking?”
RESTRICTED
dossier · packs · PDFs · CSVsstamped
an unmarked export pathfails the build
Your own scheme, national, NATO or internal, carried verbatim and never invented for you
AI
“Is the output defensible, and does our data train a model?”
model assist at programme scopeLOCKED
deterministic enginesrunning in full
a route without the lockfails the build
Cited or abstaining, and the hardened build has no model client to remove
VERSIONS
“How do we know which evidence the authority read?”
every submission packfrozen and content hashed
any two packsdiffed, reference by reference
A hash the authority can check against the pack in their own hands
SEPARATION
“Is advice kept apart from approval?”
assembles the evidenceyes
grants approvalnever
every sign offa human name, a time, a version
The engineer and the authority stay the authors, and the record says who signed what

Said plainly: the first deployments carry unclassified and non export controlled evidence, on an architecture built for the more sensitive tiers that follow

Build the evidence once, reuse it across allies

one authoritative baseline
The evidence, held once
DELTAnational differences identified against the baseline, never re-entered
pack, authority A
pack, authority B
pack, authority C
Several NATO nations means several authorities and several sets of national differences. Build the evidence once, produce each country pack from it, keep them in step when the aircraft changes

Two worlds, one refusal apart

The separation is not a promise in a contract, it is a behaviour of the machine you can test

the shared commercial cloud
Someone tries to create a defence programme
refused

“Defence programmes run on dedicated CertProve Defence deployments, never on this commercial one - by design, so no defence data can exist here.”

Not a policy sentence. The machine refuses, so no defence data can exist on the commercial cloud even by accident.
your CertProve Defence deployment
The same defence programme is requested
created
RESTRICTED · EXPORT CONTROLLED
DEFENCE · AI LOCKEDnamed keys onlyevery export stamped
The same build, one deployment setting apart. The marking vocabulary is yours - national, NATO or internal - and it rides every page and every export from the first minute.

Evidence management, never approval

NOApproval decisions, the engineer and the authority stay the authors
NOCertifying an AI model, we assemble the evidence an authority will read about the aircraft
NOWeapon effects, the platform models airworthiness evidence, nothing else
NOSignatures by software, every sign off carries a human name, a time and a version

What it does is narrower and harder: it keeps the certification evidence connected, cited and honest, continuously.

Bring us an iteration you have already certified

Six weeks. A change you have already been through on your own baseline, run through the engines, and what it would have cost with the evidence connected

your own baselinesix weeksevery engineyou keep the report either way