Wisk Aero: Systems Engineering for the World’s Most Tested Autonomous Air Taxi

Current State

By mid-2026, Wisk Aero has conducted more than 1,750 test flights of its Generation 6 aircraft, Cora, accumulating a flight hour total in autonomous operations that no other electric vertical takeoff and landing (eVTOL) program has matched. That number is not marketing. It is the foundation of a certification strategy.

Most eVTOL companies seeking FAA type certification are arguing safety from analysis, simulation, and limited flight data. Wisk is arguing safety from operational evidence at scale—a deliberate and meaningful distinction when the certification basis itself is still being written.

Cora is a lift-plus-cruise design: twelve independent lift rotors arranged around a fixed-wing airframe, plus a single pusher propeller for cruise. No pilot onboard. No pilot backup. The aircraft operates under a ground-based supervision model in which a remote operator monitors flights and can intervene in limited ways, but cannot fly the aircraft manually. The safety architecture must therefore make the aircraft’s autonomous flight management system the final authority on aircraft state—and must convince the FAA that this is acceptable under Part 21.

That is the engineering problem Wisk is solving. It is harder than it looks from the outside.

What’s Actually Happening vs. the Hype

The Certification Basis Problem

Autonomous passenger aircraft do not have a certification pathway in existing FAA regulations. Part 23, Part 25, and Part 27 all presuppose human pilot authority. The FAA’s MOSAIC rulemaking and Special Class certification under 21.17(b) provide the legal mechanism Wisk is using, but the means of compliance—the specific standards and methods that constitute acceptable evidence of airworthiness—must be negotiated aircraft by aircraft.

Wisk has been publicly engaged with FAA on this since 2022, and the company’s approach involves several parallel workstreams that interact in ways conventional programs do not encounter.

DO-178C and DO-254 at high design assurance levels: Cora’s flight management system and its supporting avionics hardware are being developed to DAL A and DAL B requirements across multiple subsystems. This is standard practice for commercial transport aircraft software and hardware, but the scope here is unusual. Because there is no pilot in the loop to catch software anomalies, the autonomous flight management system carries failure mode consequences that would ordinarily be shared with human judgment. The independence requirements, the verification depth, and the traceability obligations are correspondingly more demanding.

ARP4754A system safety processes: The aircraft-level safety assessment under ARP4754A must establish a functional hazard assessment, a preliminary system safety assessment, and ultimately a system safety assessment that closes to quantitative probability targets. For a conventional aircraft, the failure condition categories—catastrophic, hazardous, major, minor—map to well-understood failure modes. For an autonomous air taxi, the mapping is murkier. What is the failure condition category for an edge-case perception error that causes the flight management system to misinterpret its position relative to an obstacle? The answer depends on how the operational design domain is bounded, what detect-and-avoid logic is in place, and how the safety case treats the interaction between algorithmic behavior and environmental conditions not present in the training distribution.

This is not a gap in Wisk’s engineering. It is the actual difficulty of the problem, and it is why Wisk’s engagement with the FAA is as much about defining the question as answering it.

Distributed electric propulsion interdependencies: The twelve lift rotors are not independent systems in a certification sense. They share power architecture, flight control authority, and structural coupling through the airframe. A single-rotor failure is a credible failure mode that the flight management system must detect, accommodate, and recover from without pilot action—and must do so within a time window that the structural and aerodynamic analysis defines. The requirements that govern this behavior flow from ARP4754A system safety analysis down into DO-178C software requirements and DO-254 hardware requirements, and the traceability between those layers is not optional. It is the evidence chain.

Managing that chain across a program with dozens of subsystems, multiple suppliers, and an evolving certification basis is the day-to-day systems engineering challenge Wisk’s organization faces.

The Autonomous Safety Case

A conventional avionics safety case argues that specified functions work correctly under specified conditions, with specified failure rates, within a bounded operational envelope. The pilot handles everything outside that envelope.

An autonomous safety case must argue that the system behaves safely across an open-world operational envelope—because there is no pilot to handle the unexpected. This requires a fundamentally different structure of evidence.

Wisk’s approach, inferred from public filings and technical presentations, involves several elements. First, operational design domain (ODD) definition: Cora is not being certified for all weather, all airspace, and all traffic conditions. The ODD is bounded, and the safety case argues within those bounds. Second, functional safety architecture: the flight management system is architected with multiple independent channels that vote on aircraft state, so that no single software or hardware failure can produce a catastrophic outcome. Third, flight data as evidence: the accumulated flight hours constitute statistical evidence of system behavior in representative conditions—evidence that supplements analysis and simulation in ways the FAA has indicated it finds meaningful.

What Wisk is not doing is arguing that its machine learning components are certified under existing DO-178C structure. The company has been careful in its public statements to distinguish between machine learning used in development (simulation, scenario generation, system testing) and deterministic logic certified to DO-178C in the flight-critical path. This distinction matters because the FAA’s EASA-aligned guidance on AI in aviation, EUROCAE ED-324 and the FAA’s own roadmap documents, does not yet provide a clear certification path for learning-enabled components in DAL A functions. Wisk is building its certification case around the boundary where that guidance is clearest.

Boeing’s Operational Influence

Wisk is a Boeing company—fully acquired in 2022 after several years of investment partnership. What that means practically for Wisk’s engineering organization is worth examining without the promotional framing that tends to accompany such relationships.

Boeing brings three things to Wisk’s program that matter to certification.

Design assurance level process infrastructure: Boeing’s avionics and aircraft systems supply chain has spent decades building DO-178C and DO-254 compliance processes, including the internal auditing, stage-of-involvement reviews, and supplier oversight mechanisms that DAL A programs require. Wisk inherits access to that institutional knowledge. More concretely, it inherits access to engineers who have closed certification programs and can identify, early, where a requirements structure will not survive FAA scrutiny.

Supplier quality and oversight: An eVTOL with twelve lift rotors and a fully autonomous flight management system has a long bill of materials with certification consequences. Battery packs, motor controllers, power distribution units, and structural components each carry their own design assurance obligations. Boeing’s supplier quality management infrastructure—AS9100-based, with audit and corrective action processes—provides Wisk with a framework for managing those obligations that a startup building from scratch would take years to develop.

Organizational independence: DO-178C and DO-254 require verification activities to be conducted independently from development. For a small company, establishing and maintaining that independence is organizationally difficult. It requires headcount dedicated to verification that does not report to development management, and it requires disciplined process enforcement when schedule pressure is high. Boeing’s organizational model, and Boeing’s process auditors, provide structural support for that independence in ways that matter at certification milestones.

What Boeing does not provide is a shortcut. FAA type certification of an autonomous aircraft is a first-of-kind effort regardless of organizational heritage. The certification basis is novel. The means of compliance are being negotiated. The flight test program is generating data that does not have established interpretation frameworks. Boeing’s process maturity accelerates Wisk’s ability to execute, but it does not change the fundamental novelty of what Wisk is certifying.

Practical Implications for the Industry

Wisk’s program is being watched carefully by every other eVTOL company pursuing type certification, for a simple reason: whatever means of compliance the FAA accepts for Cora will partially define the terrain for subsequent programs. The FAA’s decisions on autonomous flight management system certification, on operational design domain bounding as a safety argument, and on the evidentiary weight of accumulated flight hours will become reference points—formal or informal—for Joby, Archer, Lilium’s successor programs, and others.

This creates a dynamic where Wisk’s engineering decisions are not purely internal. They are precedent-setting. The company’s willingness to publish technical details—in AIAA papers, in FAA docket submissions, in public technical presentations—reflects an understanding that the certification ecosystem benefits from shared problem definition, even among competitors. The FAA cannot develop means of compliance guidance in isolation. It needs data and technical argument from applicants.

For systems engineers at other eVTOL companies, the practical takeaway from Wisk’s approach is methodological: the requirements architecture matters before the means of compliance are finalized. Organizations that have built clean traceability from system-level safety requirements through software and hardware requirements, with the independence and rigor that ARP4754A and DO-178C demand, will be positioned to adapt when the FAA provides clarifying guidance. Organizations that deferred that architecture work to focus on flight test will face expensive rework at exactly the moment when schedule pressure is highest.

Honest Assessment

Wisk has advantages that are real: flight hours, Boeing process infrastructure, and several years of head start on FAA engagement for an autonomous certification basis. These are not trivial.

The program also faces challenges that flight hours and process maturity do not resolve. The autonomous safety case for a passenger-carrying aircraft requires arguing the absence of catastrophic failure across an operational envelope that includes conditions no analysis can fully anticipate. The FAA’s current guidance leaves significant questions about AI and machine learning in safety-critical functions unanswered, and Wisk’s program will encounter those questions at some point regardless of how carefully it has bounded its ODD.

The timeline to type certification for Cora remains the most honest indicator of program difficulty. Every year that passes without a type certificate is not evidence of failure—it is evidence that certifying autonomous passenger aircraft is as hard as the engineering problem suggests it should be. Wisk’s accumulated flight hours are the most credible evidence that the engineering is sound. Whether they are sufficient, on what schedule, and under what conditions, is a question the FAA will answer. The engineering organization’s job is to make that answer easier to reach.