AI in regulated engineering

Accountability does not transfer

A licensed Professional Engineer who seals a drawing is responsible for it, however it was produced. An aerospace supplier certifying a part conforms is responsible for that statement. A design authority signing off a safety analysis owns its conclusions. AI tools can assist every one of these activities, but none of them can hold the responsibility. The lead's job is to make sure that the person who signs understands what they are signing.

Controlled technical data and AI tools

Technical data controlled under the ITAR or the EAR can't be shared with unauthorized foreign persons, and export rules also govern where and how it is stored and transmitted. Before any controlled drawing, model, specification or source code goes into an AI tool, establish:

• where the tool processes and stores data, and who can access it, including the provider's staff and subcontractors;
• whether the deployment is approved for controlled data under your export compliance program;
• whether prompts and outputs are retained, and used for training;
• how outputs derived from controlled data are themselves marked and controlled.

The safe default is simple: no controlled technical data goes into a tool until export compliance has approved that specific deployment. Train engineers on it before they get access, not after.

Records and quality systems

Quality management systems such as AS9100 and ISO 9001 expect controlled processes, documented information and competent people. When AI tools participate in design, analysis or inspection:

1. Define the process. Say where AI assistance is permitted and where it isn't.
2. Record its use. Note when an artifact was AI-assisted and which tool and version were used, where your quality system requires traceability.
3. Verify independently. Check AI-assisted analysis by methods that don't depend on the same tool.
4. Qualify the tool where required. Some safety and certification frameworks require tools whose output isn't independently verified to be qualified. Check what your domain demands.
5. Keep people competent. Auditors will ask whether the engineers could do the work without the tool, and whether they can recognize when it is wrong.

Safety-critical software and hardware

Domains with established assurance standards, such as airborne software and hardware, automotive functional safety and medical device software, have strict expectations for requirements traceability, verification and tool confidence. AI-generated artifacts need to fit those expectations, not bypass them. Engage your certification authority or assessor early when AI tools will touch certified work.

A rollout checklist for regulated teams

• Export compliance, quality and security have approved the specific tool and deployment
• Written rules on permitted data, permitted uses and required review
• Training completed before access is granted
• Logging and retention settings match your record-keeping obligations
• A named owner for the policy, reviewed as tools change

For team-level practices that apply everywhere, see leading engineers who build with AI.