Wisk Aero: The Certification-First Philosophy in eVTOL Development

The eVTOL industry is full of companies that describe their aircraft as transformative. Wisk Aero is one of the few that has structured its entire engineering organization around the hardest version of that claim: an aircraft that is fully autonomous, certified under FAA oversight, and commercially operational — not in some future regulatory sandbox, but under real Part 21 rules.

That ambition generates a particular kind of systems engineering pressure. Autonomous flight is not a feature Wisk intends to add to a certified piloted platform. It is the design point from which every requirement flows. This distinction shapes the company’s certification strategy, its relationship with the FAA, its organizational structure, and its competitive position relative to eVTOL programs that are pursuing piloted certification first.

Understanding Wisk means understanding what it actually costs to build an aviation product where the safety case cannot rely on pilot intervention as a design assumption.

What Wisk Is Building

Wisk Aero, backed by Boeing and operating out of Mountain View, California, is developing Cora and its successor autonomous eVTOL platforms for urban air mobility. The company holds the distinction of having conducted more autonomous eVTOL flight hours than any other developer — a claim it has been able to make for several years and one that reflects a deliberate strategy of accumulating operational data in support of its certification program.

The aircraft is electric, multi-rotor for vertical lift, with a fixed wing for efficient cruise. The autonomy system handles all flight phases: vertical takeoff, transition, cruise, approach, and landing. There is no pilot seat. There is no dual-mode where a remote pilot can take over stick-by-wire. The aircraft flies itself, with ground-based monitoring and intervention capability at the mission level — but not at the flight control level.

Boeing’s involvement is more than financial. Wisk has access to Boeing’s certification infrastructure, its regulatory relationships, and its institutional knowledge of building safety arguments for complex aircraft. This is not a startup writing its first Plan for Software Aspects of Certification. The company is working with people who have built those arguments for commercial airliners.

That said, institutional knowledge of traditional aircraft certification does not translate directly to autonomous aircraft certification. Some of what Boeing knows is directly applicable. Some of it is a starting point that requires significant extension. And some of the assumptions embedded in traditional certification methodology are actively incompatible with autonomous flight.

The Certification Basis Problem

Every civil aircraft certified in the United States operates under a certification basis — the specific set of airworthiness standards the FAA and applicant agree must be satisfied before a type certificate can be issued. For conventional aircraft, establishing that basis is relatively straightforward: Part 23 for small aircraft, Part 25 for transport category, with applicable special conditions where necessary.

For an autonomous eVTOL, this process is substantially more complicated.

The foundational issue is that existing airworthiness standards were written with human pilots in mind. FAR Part 23 and Part 25 contain requirements for flight crew workload, cockpit displays, alerting systems, and manual reversion that have no direct analog in an autonomous aircraft. When there is no pilot, the question becomes: what function did the pilot perform, what can go wrong when that function is absent, and what must the aircraft system do to maintain equivalent safety?

The FAA addresses novel certification challenges through issue papers and special conditions — negotiated, program-specific documents that establish how a particular requirement will be met or how a gap in existing standards will be bridged. For Wisk’s program, the number of issue papers required is substantial. The autonomy system itself — the software and hardware that makes flight control decisions — requires a safety assessment framework that existing AC 25.1309 guidance addresses only partially.

Means of compliance (MOC) documents the methods by which the applicant will demonstrate that each requirement is satisfied. For a piloted aircraft, many MOCs are well-established: flight test, analysis, simulation, similarity to previously certified designs. For autonomous flight control, some MOCs don’t yet exist as agreed regulatory artifacts. Wisk and the FAA are developing them together, which is simultaneously the only way to proceed and a significant source of schedule uncertainty.

This is not a process failure. It is what rigorous engagement with a novel certification problem looks like. The FAA is not obstructing Wisk’s program; it is doing what a competent safety regulator should do when confronted with genuinely new technology: move carefully, build defensible precedent, and resist pressure to approve something it doesn’t fully understand.

Autonomous Flight Safety: A Different Safety Case Structure

The most technically demanding aspect of Wisk’s certification program is the construction of a safety case for autonomous flight control.

In a piloted aircraft, the flight crew is part of the safety architecture. A failure that produces an erroneous flight control input can be corrected by the pilot. This allows the safety assessment to assign credit to human oversight — a standard and well-understood regulatory practice. When something goes wrong with a system, the question “can the crew detect and correct it?” is a legitimate analytical tool.

In an autonomous aircraft, that tool is not available. The autonomy system is not corrected by a pilot. It must be correct, or it must fail in a way that is predictable, containable, and survivable. The safety case must argue — with quantitative rigor — that the probability of catastrophic failure caused by the autonomy system meets or exceeds the same threshold applied to transport category aircraft: on the order of 10⁻⁹ per flight hour for catastrophic failure conditions.

Making that argument is hard. Autonomous flight control software is complex. Complex software does not fail in statistically characterizable ways the way hardware components do. The standard approach of failure modes and effects analysis works well for hardware; applying it to software-intensive autonomous systems requires methodological extensions that are not yet standardized.

Wisk’s approach draws on a combination of formal methods, extensive simulation, operational data from flight testing, and architectural redundancy — multiple independent autonomy channels that vote on control outputs, with monitoring that can detect disagreement and trigger safe-state transitions. The safety strategy is defense in depth: no single point of failure, multiple independent barriers between any initiating event and a catastrophic outcome.

The ground monitoring element adds complexity. Wisk’s operational concept includes ground-based operators who monitor flights and can intervene at the mission level — rerouting, commanding a landing, aborting a takeoff. This is not the same as a remote pilot with stick authority, and the FAA treats it differently. But it does introduce a communication link and a human-in-the-loop at a supervisory level, which means the safety case must account for link failure, operator error, and the boundaries of appropriate supervisory intervention.

Defining those boundaries precisely — what a ground operator can and cannot do, under what conditions automated systems take precedence, and how conflicts between ground commands and autonomous flight management are resolved — is itself a certification challenge with significant systems engineering implications.

Organizational Structure for Long-Cycle Certification

Wisk’s engineering organization reflects the demands of its certification program in ways that distinguish it from faster-moving eVTOL developers.

The company maintains deep vertical integration between its flight sciences team, its autonomy engineering organization, and its certification group. This is not a separate compliance department that reviews what engineers build after the fact; it is embedded engagement throughout the design process. When a flight control engineer makes an architectural decision, the certification implications are evaluated in the same design review.

This integration is expensive. It requires systems engineers who understand both the technical problem and the regulatory framework — a rare combination that commands significant compensation and is not abundantly available in the labor market. It also requires a documentation discipline that is foreign to software-intensive startups: every requirement traced, every design decision recorded, every test result linked back to the compliance argument it supports.

The program’s multi-year timeline — Wisk has been in development for over a decade, and type certification is still ahead of it — creates its own organizational challenges. Maintaining institutional knowledge across staff turnover, keeping the FAA relationship warm and productive as personnel change on both sides, and sustaining investor confidence through a certification process that does not produce visible milestones at consumer-product cadence all require deliberate organizational management that purely technical companies often underinvest in.

Boeing’s backing provides a buffer against the worst of these pressures. A company that might run out of runway during a two-year FAA review cycle can survive that delay if its primary backer has both deep pockets and an institutional interest in the program’s success. This is a genuine competitive advantage — not over competitors in the technical sense, but over the risks that have ended otherwise credible aerospace startups.

The Comparison with Piloted eVTOL Programs

Several well-funded eVTOL programs — Joby Aviation, Archer Aviation, Lilium before its difficulties — have pursued certification with a human pilot as part of the design. This choice offers a real near-term advantage: the FAA has a clearer regulatory framework for piloted aircraft, the existing MOC library is more applicable, and the safety case can credit pilot oversight.

The result is that piloted programs are likely to achieve type certification before Wisk. Joby has been explicit about its certification timeline ambitions and has made meaningful progress. Archer has its own certification program underway. These are real programs making real progress against a more navigable regulatory path.

The question Wisk is implicitly answering is: what happens next?

A piloted eVTOL certified under Part 23 is a significant achievement. Operating it profitably is a separate problem. Piloted air taxi economics require pilots — and pilot salaries, training costs, and supply constraints are not trivially solved. The long-term unit economics of urban air mobility at scale depend heavily on reducing or eliminating the per-flight pilot cost.

If autonomous operation is the eventual target — and for any serious urban air mobility business case, it essentially must be — then the certification path for that capability runs through something very close to what Wisk is doing now. A company that certifies a piloted aircraft and then attempts to certify autonomous operation of the same design is not on a faster path overall; it is on a path that defers the hard certification work to a later program phase, with the additional complication that the aircraft design may not have been optimized for autonomous operation from the start.

Wisk’s counterargument is structural: we are paying the certification cost now, on a schedule we control, building the regulatory precedent that will define the autonomous aviation industry. The companies that certify piloted aircraft first will eventually face that same cost, without the lead time Wisk has already accumulated.

Whether that argument holds depends on execution — and on the FAA’s willingness to extend the regulatory framework Wisk is helping to develop.

The FAA’s Role as a Program Constraint

Any honest assessment of Wisk’s program must acknowledge that the FAA’s pace is not fully within Wisk’s control. The agency is resource-constrained. Its aircraft certification staff must allocate time across an unusually crowded pipeline of novel aviation programs — autonomous aircraft, supersonic transport, urban air mobility, advanced air mobility, electric propulsion — simultaneously. A review that stalls at the agency level cannot be accelerated by better engineering on the applicant side.

This is not a criticism of the FAA. An agency that certifies new aircraft categories quickly under political pressure is more dangerous than one that moves deliberately. But it is a real program risk that Wisk’s investors and partners must have visibility into.

The mitigation is sustained, high-quality engagement: issue papers developed proactively rather than reactively, proposed MOCs submitted with thorough analytical backing, and relationship continuity maintained at the technical level with the FAA engineers who are actually working the program. Wisk’s organizational investment in its certification function is, in part, an investment in keeping that engagement productive.

An Honest Assessment

Wisk Aero is attempting one of the hardest things in civil aviation: certifying a genuinely novel aircraft category, under existing regulatory structures that were not designed for it, without the design compromises that would make the regulatory path easier but the business case harder.

The certification-first philosophy is not a marketing position. It is a design constraint that runs from the top-level aircraft architecture through every subsystem requirement, every software safety argument, and every organizational process. The company has absorbed costs that competitors have deferred, and it has done so deliberately.

Whether the strategy succeeds depends on execution over a timeline measured in years, on the FAA’s capacity to process novel certification challenges at program-relevant speed, and on whether the urban air mobility market materializes in a form that rewards the autonomy-first approach.

What is not in serious doubt is that Wisk has built the most technically rigorous certification program in the autonomous eVTOL space. For an industry where technical rigor is the minimum ante for commercial operation, that is a meaningful position to hold.