Certifying software for an aircraft, a spacecraft or an air traffic system is one of the most expensive activities in engineering. Published analysis puts certification of a complex avionics system at the highest assurance level upwards of $25 million and five years. Engineers in the field estimate that developing tests against low-level requirements costs about two days per function, which on a 250,000-line project works out to roughly 50 person-years.
Numbers like these make the case for AI obvious, and most tools built for the problem reach for a large language model. AeroCert does not, and the reason is a distinction about what kind of task certification actually is.The system underneath it is a neuro-symbolic engine, which pairs two kinds of AI with opposite properties. Symbolic reasoning works from explicit rules, so it gives the same result every time and every step can be inspected. Language models handle messy human language well but guarantee nothing about any particular output. The design question is which half is given authority over the answer. In AeroCert, an algorithmic symbolic reasoning engine called Socrates encodes the intent of a task and composes the answer. A language model is used only to formulate that answer in readable form, and it takes no part in deciding what the task means.
Why that arrangement matters comes down to the kind of question a certification document has to answer.
A distinction that predicts where AI works
Squint draws a distinction here that tells you in advance which tasks language models will handle well, and it has nothing to do with model size.
Consider two requests. "Write a version of the space invaders game that runs in a browser" leaves language, design and structure open. Many answers are acceptable and judging success is subjective, which is where language models excel.
"For every frame of the game, make every other enemy ship pink and every third enemy bullet heart-shaped" has exactly one correct answer, checkable against the request. Language models perform poorly at this class of task.
Certification documents belong entirely to the second category. A low-level requirement either describes what a function does or it does not. A traceability link either holds or it does not. Fluency contributes nothing when the content is wrong. Squint's position is that agentic AI and prompt engineering can accelerate parts of a certification project while being equally capable of massively slowing down others.
What changes when the answer is worked out rather than predicted
When a language model is given authority over intent, it settles what the request means before any checking begins. If it misreads the request, every downstream check confirms a well-formed answer to the wrong question, and because intent is re-inferred on each run, two runs can diverge without either appearing wrong.
Socrates encodes the intent of a task in a symbolic representation, and Squint describes that intent as preserved and maintained over the life of a project. Answers are composed from that representation rather than predicted from a prompt. Squint reports two consequences: the results are repeatable, and the reasoning traceability from input to output is maintained.
Squint's position is that Socrates does not hallucinate, because it is not generating a plausible continuation in the first place. Results therefore do not need mass review to uncover fabrications, deletions or regressions, which is the difference between a document a reviewer confirms and one a reviewer has to interrogate.
What this looks like on a programme
Squint reports a completed certification project that illustrates the difference in scale.
The codebase was 60,000 lines. AeroCert generated 800 high-level requirements and 4,000 low-level requirements, with traceability running from system-level requirements through high-level and low-level requirements to code, produced alongside the certification evidence. Squint describes the artefacts as carrying 100% algorithmic traceability.
The programme moved through all four Stages of Involvement on a four-week cadence. SOI 2 was produced entirely by AeroCert at zero customer effort, four weeks after SOI 1 completed. SOI 3 followed four weeks later, subject to the customer configuring their test case framework, and SOI 4 was human-reviewed.
Squint puts the reduction in certification effort at more than 90%. Squint describes the artefacts as deterministically generated rather than prompt engineered, which is what makes them repeatable and maintainable over time. A certified codebase lives for a long time and changes throughout, which makes that the difference between maintaining certification and earning it again.
The broader implication
The instinct to apply generative AI to expensive knowledge work is sound, and certification is expensive knowledge work. The mistake is treating the work as writing when it is really proving. The question worth putting to a vendor concerns which part of the system decides what the task means, and whether that part can explain itself to a regulator. AeroCert's answer is that a reasoning engine decides and a language model describes. Whatever tool you are evaluating should have an answer of its own.
