Why MRO Governance Cannot Default to General AI Policy
Aerospace MRO operations are regulated environments where maintenance actions must be traceable to an accountable, certificated individual. FAA rules under 14 CFR Part 43 and Part 145 require repair stations to document who performed and approved each maintenance action, and to retain those records for specified periods. These requirements were written with a human certificate holder as the accountable party. They do not currently contemplate an AI agent initiating, recommending, or executing a step in that workflow. This creates a specific governance problem: any AI agent that touches maintenance records, work orders, or diagnostic systems introduces an attribution gap unless the organization builds a mechanism that ties agent actions back to a responsible human reviewer. General-purpose AI governance guidance does not resolve this gap on its own. It has to be applied deliberately against the recordkeeping and quality system obligations that already govern MRO operations.
What Existing Standards Actually Require
No FAA or EASA regulation defines requirements specific to AI agents invoking tools or accessing maintenance management systems. In the absence of that standard, three existing frameworks provide the closest applicable baseline. FAA Part 145 quality control requirements mandate traceability of parts, tools, and procedures used in maintenance actions. NIST's AI Risk Management Framework defines four functions (Govern, Map, Measure, and Manage) and identifies accountability, transparency, and human oversight as necessary characteristics for AI systems used in high-consequence settings. NIST SP 800-207 establishes Zero Trust principles requiring continuous verification of identity and authorization for every access request, including non-human identities, rather than trust based on network location. None of these were written for aerospace AI agents specifically, but together they define the minimum control surface a governance program needs to address: who is the agent, what is it allowed to do, and how is that decision recorded.
Categories of Agent Actions That Require Runtime Controls
Not all AI agent activity in an MRO environment carries the same risk. Read-only actions, such as retrieving technical documentation or summarizing historical maintenance records, present a different control profile than actions that write to a system of record. Work order updates, diagnostic tool invocations, and parts sourcing requests all modify state or trigger downstream processes, which means they intersect directly with FAA-mandated recordkeeping and quality traceability requirements. A governance framework should separate these categories explicitly. Segmentation between read access and write or action capability is a basic requirement for least-privilege design, and it also simplifies the question of where human approval is mandatory. Scheduling suggestions may tolerate more agent autonomy than an action that would otherwise require a certificated individual's sign-off before return to service.
Auditability as a Recordkeeping Requirement, Not a Feature
FAA Part 145 already requires maintenance records to identify who performed and approved work, and repair station quality systems already require traceability of tools and procedures. An AI governance program should treat audit logging for agent actions as an extension of this existing obligation rather than a separate technical feature. At minimum, a log entry for an agent action should capture the agent's identity, the tool or system invoked, the input and output data involved, and the authorization decision that permitted or denied the action. Retention periods for these logs should align with existing FAA maintenance record retention rules rather than creating a parallel and inconsistent recordkeeping system. Where an agent action stands in for a step that currently requires human sign-off, the log should also capture the identity of the human reviewer who approved it, preserving the same accountability chain Part 43 and Part 145 require today.