ICAO Frameworks for Autonomous Aviation Execution

Domain Context

Autonomous aviation is moving from research demonstration to certification engagement on a timeline that is no longer hypothetical. ICAO Doc 10019, the RPAS Manual, established the regulatory vocabulary under which remotely piloted operation entered the international airspace system, and its progression toward fuller autonomy is the explicit subject of the ICAO Remotely Piloted Aircraft Systems Panel (RPASP) and the more recent work program on autonomous-aircraft provisions. Annex 2 specifies the rules of the air with which any aircraft operating in controlled airspace must comply; Annex 8 specifies the airworthiness substrate; Annex 10 specifies the aeronautical-telecommunications environment, including command-and-control link integrity for unmanned operation. Annex 19 (safety management) and Doc 9859 (Safety Management Manual) wrap the substrate in operational governance.

Two regulatory motions matter for autonomous aircraft specifically. The first is the certification path: ICAO's emerging guidance and the corresponding work in EASA Special Condition for VTOL, FAA Part 21 special airworthiness criteria, and JCAB equivalents converge on a phase-decomposed certification model in which each flight phase (taxi, takeoff, climb, en-route, descent, approach, landing, emergency) is certified against phase-specific criteria, and in which transitions between phases are themselves regulated objects. The second is sense-and-avoid: ICAO's Annex 2 collision-avoidance obligations, RTCA DO-365 Detect and Avoid (DAA) Minimum Operational Performance Standards, and the corresponding ASTM F3442 standard establish that an autonomous aircraft must demonstrate per-encounter avoidance behavior against verifiable performance bounds, not aggregate statistical safety.

The eVTOL programs whose entry into service crosses 2026 and the high-altitude long-endurance autonomous platforms entering operational use over the same window all face certification engagement against this substrate. Their architectural choices today determine the cost and credibility of that engagement.

Architectural Requirement

ICAO's frameworks impose four architectural requirements on autonomous aircraft that procedural compliance cannot satisfy. First, the aircraft must operate under a per-phase mode model in which each flight phase corresponds to a distinct certified envelope of authorized actions, and in which the aircraft's current phase is a structurally retrievable property rather than an inferred state. Second, transitions between phases must be credentialed events: a climb-to-cruise transition under autonomous operation must record the conditions evaluated, the authority under which the transition was authorized (autopilot system, remote pilot, ATC clearance, or composite), and the post-transition envelope entered. Third, the aircraft's compliance with Annex 2 rules of the air — right-of-way, separation, ATC instruction conformance — must be demonstrable per-encounter rather than per-fleet-statistic. Fourth, the aircraft's sense-and-avoid behavior must produce structural evidence at the moment of avoidance decision: which intruder was detected, which avoidance trajectory was selected, what reversibility evaluation supported committing to it, and what post-actuation verification confirmed it.

Each requirement maps onto governed actuation's primitive structure. None maps cleanly onto monolithic flight-control architectures.

Why Procedural Compliance Fails

The procedural posture toward autonomous-aviation certification is to develop a safety case under DO-178C and ARP4754A, demonstrate scenario coverage against named test cards, and accumulate operational hours under a restricted special-airworthiness category until the regulator is willing to expand the operational envelope. This posture works for traditional avionics, where the system's behavior is fully specified by its requirements, and where the certification artifact is the requirements-to-implementation traceability matrix. It does not work for autonomous aircraft whose behavior is shaped by perception, prediction, and learned models, because the object that the regulator most needs to inspect — the decision logic at a specific moment in a specific encounter — is not directly produced by the procedural artifacts.

The mismatch becomes visible at the phase-transition boundary. A monolithic flight-control architecture treats phase as a global state variable updated by mode logic; a regulator asking "under what authority did this aircraft enter cruise at 14:23:07?" must reconstruct the answer from logs that were not designed to produce it. The same architecture treats sense-and-avoid as a perception-and-planning subsystem; a regulator asking "what reversibility evaluation supported the climb-right avoidance maneuver at 14:31:42?" gets a planner trace, not a structural record.

Procedural compliance also fails on cross-jurisdictional operation, which is increasingly the norm. An aircraft operating across ICAO contracting states under different national civil aviation authorities (FAA, EASA, CAAC, JCAB, CASA) is subject to different national implementations of ICAO Annexes; without a credentialed phase-and-authority record, the operator carries the cross-border verification burden as proprietary engineering effort. Sense-and-avoid is the sharpest example. DO-365 specifies performance against named encounter classes; demonstrating per-encounter conformance from a monolithic stack requires regenerating decision rationale from telemetry. Demonstrating it from an architecture that records, per encounter, the detected intruder, the evaluated avoidance options, the selected option, and the post-actuation verification result, is direct.

What the AQ Primitive Provides

Governed actuation maps the four ICAO requirements onto first-class architectural objects. Phase becomes an explicit credentialed mode; the aircraft is always operating in exactly one named phase, with that phase's identity, version, and authorizing credential recorded in every actuation event within the phase. Transitions between phases proceed through the continue / defer / refuse / partial graduation: a transition request is evaluated against the conditions the receiving phase requires, and the architecture either continues into the new phase, defers (holds the current phase while requesting clarification), refuses (with credentialed refusal evidence), or executes a partial transition that enters a constrained subset of the receiving envelope. Each branch is a structural event.

Post-actuation verification supplies the per-encounter evidence that DO-365 and Annex 2 implicitly require. After every actuation — a flight-control surface command, a thrust adjustment, a navigation update, an avoidance maneuver — the architecture compares the predicted-and-committed outcome to the observed outcome and produces a verification record. Discrepancies trigger structural events rather than emergent recovery behavior. Reversibility evaluation runs ahead of commitment: actuations whose downstream consequences exceed the current phase's authorized envelope are flagged before commit, and the architecture either escalates to a higher-authority credential, refuses the actuation, or executes a partial action whose consequences remain within the envelope.

For sense-and-avoid specifically, the primitive produces, per encounter, a structural record that names the detected intruder track, the candidate avoidance trajectories evaluated, the reversibility verdict on each, the selected trajectory, the credential under which selection was authorized, and the post-actuation verification of the executed maneuver. This is the artifact a DO-365 conformance demonstration actually needs. It is also the artifact an incident investigation under Annex 13 actually needs.

Compliance Mapping

The primitive maps compactly onto the ICAO substrate. Doc 10019 RPAS Manual provisions for command-and-control link integrity and remote-pilot authority correspond directly to credential-bearing actuation events: link-degradation conditions become refuse-or-partial branches with credentialed evidence, and remote-pilot override is a credential-promotion event rather than an out-of-band command. Annex 2 rules-of-the-air conformance becomes a per-event property of the actuation record rather than an aggregate compliance claim. Annex 8 airworthiness, particularly as implemented through EASA SC-VTOL and FAA Part 21 special airworthiness criteria, gains the per-phase envelope evidence those instruments require. Annex 10 command-and-control link provisions integrate as credential-authority conditions on the actuation graduation.

Annex 13 incident investigation moves from telemetry reconstruction to structural-record retrieval. Annex 19 safety management gains the per-event structural evidence that statistical safety claims have always lacked. RTCA DO-365 and ASTM F3442 sense-and-avoid conformance becomes per-encounter verifiable. EASA's emerging guidance on autonomous flight, FAA's Part 108 framework for beyond-visual-line-of-sight operation, and the JCAB and CAAC equivalents inherit the same structural advantage.

For eVTOL programs (Joby, Archer, Wisk, EHang, Beta, Volocopter, Lilium, and the broader cohort) and for autonomous fixed-wing programs entering certification, the mapping turns the certification engagement from a defense of implementation choices into a demonstration of envelope conformance.

Adoption Pathway

The most productive entry point for autonomous-aviation programs is the phase that already carries the highest certification scrutiny: takeoff and landing for eVTOL, en-route sense-and-avoid for fixed-wing autonomous platforms, taxi-and-ground for autonomous airport-surface operation. Initial adoption surfaces the relevant phase as a credentialed mode, instruments transitions into and out of the phase, and produces post-actuation verification records for the actuations within the phase. This first deployment alone replaces a substantial portion of the certification submission's reconstruction burden with structural evidence.

The second adoption step extends phase coverage to the full flight envelope and adds reversibility evaluation to the phases whose actuation consequences are most safety-critical (final approach, missed approach, contingency-mode entry). The third step integrates external authority credentials — ATC clearance authority, remote-pilot override, command-and-control link state, and contingency-management authority — into the credential structure. By this stage, the aircraft's behavior under any phase, transition, encounter, or contingency is structurally evidenced, and the certification submission is a conformance demonstration rather than a reconstruction exercise.

Programs adopting governed actuation early in their certification cycle gain a regulatory pathway that monolithic competitors cannot match without architectural rework. The ICAO substrate is moving toward structural evidence; the architectural choice is whether to meet it directly or to translate from a mismatched stack at every certification engagement.