Travel & Hospitality AI agent · Aviation SMS
Aviation SMS Declaration AI Agent
Match every hazard to the control raised against it, track which of the four retention clocks in 14 CFR 5.97 governs each artefact, and hold the declaration package for the accountable executive.
- Typical delivery
- 4–6 weeks
- Deployment
- Your stack
- Named executive
- One signature
- After launch
- Agent Care
What this agent does
Assembles the package, never the signature
In
- 01
A hazard is reported, and subpart C of 14 CFR part 5 decides what risk control it earns.
- 02
A control is raised, and 14 CFR 5.97(a) keeps its output while that control stays relevant.
Reason
- 03
An assurance output is filed, and 14 CFR 5.97(b) holds it a minimum of five years.
- 04
A safety message goes out, and 14 CFR 5.97(d) holds it twenty-four calendar months.
- 05
A person is trained, and 14 CFR 5.97(c) keeps that record for the term of employment.
Decide
- 06
A control loses relevance, and the output behind it stops carrying the declaration.
- 07
A declaration falls due, and 14 CFR 5.9 sets 28 May 2027 for part 135 and 91.147 operators.
Out
- 08
A safety policy is signed, and 14 CFR 5.21(b) reserves that act to the accountable executive.
- 09
Execute write actions only inside the approval boundaries agreed during implementation.
Product statement
The agent assembles the package and tracks the clocks. The accountable executive designated under 14 CFR 5.25(a) signs the safety policy, and that act cannot be delegated.
Example workflow
One hazard, evidence to signature
- 1Hazard evidence receivedOccurrence reports, risk assessments, assurance outputs or training records
- 2Hazard context assembledThe hazard, the control raised against it, the subpart it answers to and the clock it runs on
- 3Declaration evidence draftedThe hazards, the controls behind them, the gaps and completeness
- 4Controls appliedRelevance checks, retention-clock checks, subpart-coverage checks and completeness confidence
No human action required
Stages 1 to 4 run unaided, and nothing is signed at any of them — the agent is assembling, and the safety lane opens at the completeness gate.
Goes to the accountable executive to sign.
Adds a safety manager read first.
Safety review
The package is held with its hazards, its controls and the outputs behind them.
Sign · Append evidence · Send to safety review
Signed — by the accountable executive
- 6Hazard and control records updatedOnly where write access and records policy allow it
- 7Outcome evaluatedControl currency, retention coverage, reviewer corrections and what the read found
Corrections
Each safety correction is counted in the evaluation.
What should not run autonomously
Human approval stays in control
Outside the boundary — human approval required
8 items
- Signing the safety policy under 14 CFR 5.21(b).
- Submitting the declaration of compliance to the FAA.
- Deciding that a risk control is no longer relevant.
- Judging safety performance substandard under 14 CFR 5.75.
Automation boundary
Agent acts unaided
- ✓Hold each hazard against the risk control raised.
- ✓Track which of the four retention clocks governs every artefact.
- ✓Mark the control whose relevance lapsed, and why.
- ✓Flag the missing record that the declaration package still needs.
Nothing is signed or submitted except by a named person, inside the agreed boundaries.
- Judging whether an SMS meets part 5.
- Telling the FAA the operator is compliant.
- Setting the safety objectives the policy states.
- Changes to hazards, controls or retention records.
Example output
One hazard, annotated
The declaration of compliance falls due on 28 May 2027; this record is what one hazard carried into the package.
Declaration evidence · single hazard
Illustrative example- Hazard
- Runway excursion risk, subpart C
- Recorded as
- Control raised, relevance confirmed
- Subpart
- Subpart C output
- Evidence of record
- Risk assessment, 3 August 2026
- Confidence
- Held unsigned
- Held for
- The accountable executive, by name
As received
Taken from the occurrence report and the risk assessment — it reaches as far as those sources do.
What the record holds
- Occurrence report
- Risk assessment
- Control relevance note
Why no signature here
Signing the safety policy is reserved to the accountable executive.
What the score decides
Below the configured threshold the package takes a safety read before the executive sees it.
Action
SignAppend evidenceSend to safety reviewValue
Where AI adds value
The same four claims, placed at the point in the workflow where each one applies.
Where the value lands
Value 01 – 04
Every hazard
From the system that reported it
Where the evidence is used
Nothing else in the corpus answers to a named accountable executive who carries a whole certificate, so this page collides with no other agent we ship.
One signature, four clocks
14 CFR 5.21(b) leaves no room to spread it: "The safety policy must be signed by the accountable executive described in § 5.25." One human, personally, for the certificate entire.
What was checked, and not found
The part 21 compliance dates, the DATES paragraph of 89 FR 33068 word for word, the signer of that rule and an eCFR stamp reading last amended 17 August 2026 were each checked and none was confirmed; no delay or withdrawal of the rule was found either.
Build an evidence trail
The hazard, the control raised against it and the executive who signed stay on the policy.
Integrations
Typical integrations
Five system groups connect to the same agent. Which of them are in scope is decided in discovery.
Safety reporting
- Occurrence reports
- portal
- Confidential hazard reports
Risk and assurance
- Risk registers
- Audit and assurance outputs
Training and personnel
- Training records
- HR feed
- Per-individual employment
Agent
Aviation SMS declaration
- Reads the hazards
- Assembles the package
- Holds for the executive
Flight data and operations
- FDM
- maintenance systems
- Safety communications
Observability & evaluation
- OpenTelemetry
- Langfuse
- Supported monitoring/evaluation sources
Integration availability depends on the client's existing systems and API access.
Agent controls
Six barriers between the model and the executive
Six barriers, and one hazard must clear every one of them. What gets past is named in the map below.
L6 · Outermost — last line of defence
Inward → L1 · closest to the model
- L1 – L2
- Test whether a package may stand
- L3
- Puts the signature in a person's hands
- L4 – L5
- Keep the hazard and the control behind it
- L6
- Retreats to record assembly when signals degrade
How Nestack evaluates it
Evaluate the whole assembly — not only the declaration package that comes out.
Coverage runs the whole depth of the workflow, and every layer is cut by slice.
Surface — the package an inspector reads
- E1Final-output evaluationDid the package record what each hazard actually raised?
- E2Step-level evaluationDid the agent read the right hazard, the right control and the live retention clock?
- E3Tool evaluationDid it read and write the correct hazard and the correct control?
- E4Confidence calibrationDo low-confidence packages actually attract more safety corrections?
- E5Slice evaluationHow does performance change across specific hazard classes?
- E6Business outcomeHow many packages needed a correction before the executive signed?
Floor — the certificate the operator answers for
Failure modes
Where each failure originates in the agent
Seven failure modes, each pinned to the stage where it surfaces first.
Agent lifecycle
Direction of processing →
01 · Retrieval
1 mode
- JY-03
Stale hazard read
The risk register read is not the one now in force.
Stage gathers
The hazards, the controls, the clocks and the dates
02 · Reasoning
2 modes
- JY-04
Control asserted, not shown
A control is called current without its output.
- JY-06
Lapsed control read as live
A control past relevance still carries the package.
Stage proposes
The hazards, their controls and completeness
03 · Tool / write
2 modes
- JY-02
Thin package passed forward
A package moves on without the safety read.
- JY-05
Bound to the wrong control
An output is filed against the wrong hazard.
Stage writes
Only where write access and approval policy allow it
04 · Output
1 mode
- JY-01
Signed, evidence unrecorded
The package shows a signature but not what supported it.
Stage returns
The package an executive signs and the FAA reads
05 · Change / Version
1 mode
- JY-07
Silent clock regression
A configuration change moves the clock, not the record.
Stage tracks
Model, prompt, part 5 rules and package fields
- Sev-1 · a policy signed on no evidence
- Sev-2 · wrong evidence reaches the package
- Sev-3 · source degrades, package unsigned
Affected slices
Flight operations hazards absorb the corrections
A control-level currency figure can read clean while flight operations hazards carry most of the rework. Nestack reports the correction rate by hazard class, not only in total.
Slice performance — reported separately, not only in aggregate
Illustrative example| Slice | Failure rate | Lift | Lift vs. threshold | Status |
|---|---|---|---|---|
| Flight operations hazards | 10.0% | 3.6× | Review | |
| Maintenance and airworthiness | 7.2% | 2.6× | Review | |
| Ground and ramp operations | 4.5% | 1.6× | Watch | |
| Training and communication records | 1.9% | 0.7× | Normal |
Bar: correction-rate lift vs. training-record baseline · scale 0–4.0× · tick marks the 2.0× review threshold
2 of 4 slices over threshold
Evidence-linked improvement
What a lapsed control costs
A loop ends when the stale control has become a case the next release must pass. That suite is what the next declaration built is measured against.
Improvement cycle · five stages
Switchback — the path turns at Improve and returns at Learn
- 01
Detect
Correction rate rises on flight operations hazards.
- 02
Diagnose
The safety policy signed once, for a hazard register that has moved on since, is read back until one cause remains.
- 03
Improve
Number the change; the hazards that drove it are filed underneath it.
- 04
Verify
Each touched hazard case is run once more, and one red holds it back.
- 05
Learn
It stays on as a standing test, and the retention rules move alongside it.
Learn → Detect
The return edge. The next assurance year is measured against a suite one case longer.
Typical build scope
Twelve workstreams across six weeks
The build scope read against the delivery timeline. Week structure follows the six-week plan — discovery, sources, package assembly, evaluation, integration, then production validation and handover.
Workstream
Week 1Week 2Week 3Week 4Week 5Week 6
- 01Hazard-register and automation-boundary discovery.Week 1
- 02Occurrence, risk and training sources.Week 1, Week 2
- 03Hazard-to-control and retention-clock mapping.Week 1, Week 2
- 04Hazard and control ingestion.Week 2
- 05Hazard, control and clock binding.Week 2, Week 3
- 06Completeness scoring and review routing.Week 3
- 07Accountable executive signing workflow.Week 3, Week 4
- 08Safety and training-system integration.Week 5
- 09Assurance and retention cases.Week 4, Week 5
- 10Guardrails and executive controls.Week 4
- 11Policy-trail instrumentation.Week 5, Week 6
- 12Deployment, documentation and Agent Care handover.Week 6
12 workstreams · 6 weeks · bar shows the weeks a workstream is active — several run in parallel
Final scope and sequence confirmed in discovery
Engagement tiers
What each tier includes
Rows are the capabilities named in each tier's scope. Higher tiers include everything below them.
| Capability✓ in scope · — not at this tier | PilotOne certificate, one year | ProductionProduction assurance workflow | AdvancedMultiple certificates / entities |
|---|---|---|---|
| Introduced at Pilot | |||
| Package assembly to your hazards | ✓ | ✓ | ✓ |
| Accountable executive release | ✓ | ✓ | ✓ |
| Hazard-register baseline | ✓ | ✓ | ✓ |
| Introduced at Production | |||
| Reporting by control | — | ✓ | ✓ |
| Signing workflow in your systems | — | ✓ | ✓ |
| Approved write-back | — | ✓ | ✓ |
| Occurrence-report integration | — | ✓ | ✓ |
| Introduced at Advanced | |||
| Multi-certificate groups | — | — | ✓ |
| Cross-subpart evidence packs | — | — | ✓ |
| Large hazard registers | — | — | ✓ |
| Multi-clock retention controls | — | — | ✓ |
| Build price | From $5,000 | From $8,000 | Custom quote |
- Final build price
- Confirmed after discovery based on integrations, workflow complexity, reporting volume, approval controls and deployment requirements.
- Separate from build
- Build pricing is separate from recurring Agent Care, which covers managed monitoring, evaluations, incidents and verified improvements after launch.
What we need from you
What you bring, and what we build with it
Each input maps to a piece of build scope and a week in the delivery timeline.
You bring
We build with it
01Your certificates and the operations under each
→Hazard-register mapping and evidence capture
Week 102Representative occurrence, risk and training records
→Record binding, clock logic and the package baseline
Week 203Your risk acceptance criteria under subpart C
→Hazard mapping, control binding and the automation boundary
Week 104Access to relevant APIs, feeds or exports
→Reporting, risk and training-source assessment, then integration setup
Week 205Declarations you would not want audited
→Retention cases and the evaluation run
Week 406What no safety policy may prove
→Completeness scoring, review routing, guardrails and release controls
Week 307An accountable executive designated under 14 CFR 5.25(a)
→Signing workflow, then pilot and production validation
Weeks 5–6
Nothing else is required
Deployment, documentation and Agent Care handover are ours.
Delivery timeline
Four phases across six weeks
Each width is the time a phase truly takes and not a layout choice, so week five holds two of them.
Phase
W1
W2
W3
W4
W5
W6
- DiscoveryW1
- BuildW2 – W3
- EvaluateW4 – W5
- Pilot & LaunchW5 – W6
Week focus
W1SMS workflow discovery, hazard mapping and the automation boundary
W2Source integration and the control-currency baseline
W3Package assembly, retention logic and release controls
W4Evaluation suite, relevance cases and failure-mode testing
W5Records integration, pilot packages and targeted corrections
W6One assurance year run under the accountable executive, then Agent Care handover
- Reading the band
- Each bar covers only the weeks its own work is named for. Week five takes a pair because the work does.
- At the end of W6
- When the safety record validates, Agent Care takes the agent on.
- Duration
- Six-week plan shown · typical delivery 4–6 weeks depending on scope confirmed in discovery.
Next step · Travel & Hospitality AI agent
Build an SMS agent around the policy your accountable executive has to sign.
Show us one hazard and the control raised against it. The accountable executive of 14 CFR 5.25(b)(2) develops and signs the safety policy, and may hand that to nobody. Part 135 and 91.147 operators declare compliance by 28 May 2027; part 121 fell due on 28 May 2025.
- Typical delivery
- 4–6 weeks
- Deployment
- Your hazards
- Named executive
- One signature
- After launch
- Agent Care available
Nestack Agents · Aviation SMS
AGT-TH-16 · Agent Care available after launch