What it looks at
EASA’s draft AI Concept Paper, Proposed Issue 03 (June 2026), would place Level 3 “advanced automation” under an independent operational oversight system that monitors the AI, overrides it and drives it to a safe state. In AI safety terms, that is a run-time monitor.
Research on AI control studies monitors under a stricter assumption: that the system being watched may itself evade or subvert its monitor, collude with other AI components, or behave differently when it is being evaluated.
What it found
- EASA’s threat model covers random and systematic failure, changes in operating conditions, and attackers from outside. It does not treat the monitored AI itself as a source of adversarial behaviour.
- Experimental evidence, mostly from coding and AI-laboratory settings, shows that current large language models can evade monitors, recognise evaluations, agree with users against the facts and bias their labels when acting as judges.
- After analysing six threats, it proposes means of compliance for EASA and EUROCAE, among them classing monitors as trusted or untrusted, red-team control evaluations, audit budgets sized with human factors evidence, planted tests of the monitors, and occurrence reporting of AI events.
- In the other direction, it argues that frontier-AI safety cases could adopt aviation’s severity-graded assurance, operational design domains, independent verification and continued airworthiness.
Why it matters
EASA plans its next rulemaking proposal on AI for 2027. The paper sets out the texts word for word, so the gap and the proposed fixes can be read against them.
About this paper
This is a working paper, version v1.1 of 4 November 2026. It has not been peer reviewed. Every reference was checked against its source, and the paper was audited by a reviewer that did not write it. As the paper says, the literature search, drafting and checking were done with AI assistance under the author’s direction, and the author is responsible for the text. Its sources, audit trail and, where there is one, its code and data are on GitHub.
