Lifecycle stage — Build
The single hardest gate between a working AI prototype and a deployed safety-critical machine is the safety case — the structured argument, backed by evidence, that the system is acceptably safe. Machine learning breaks the assumptions traditional functional-safety processes were built on: there is no line-by-line specification to trace, the behaviour is statistical, and notified bodies will not accept an undocumented model in a vehicle, an aircraft system, or an industrial line. Safety-case and certification-evidence engineering is the capability of producing that argument and that evidence trail — hazard analysis, risk assessment, ASIL/DAL/SIL decomposition, assurance-case construction, and verification-and-validation traceability — mapped to the standard that governs your domain. This is the sharpest line between a physical-AI specialist and a generalist AI consultant, and it is every safety-critical vertical's number-one blocker. To be explicit about the boundary: a notified body assigns the actual safety rating and certifies the system. I engineer the safety case and the evidence they assess — I do not issue certifications.
ML breaks traditional V&V. Functional-safety standards assume a specification you can trace test-by-test; a learned model has none. The assurance argument has to be reconstructed for statistical behaviour, and most teams do not have the method to do it.
Notified bodies reject undocumented ML. A model that performs well in validation but arrives without a hazard analysis, a requirements decomposition, and a traceable evidence trail will not pass conformity assessment — performance is necessary but nowhere near sufficient.
The evidence has to be engineered from the start, not assembled at the end. Retrofitting a safety case onto a system that was not built to produce evidence is the most expensive way to discover what the standard required.
Mapped to the standard that governs your domain — ISO 26262 (automotive), DO-178C/EASA (aerospace), IEC 61508 (industrial), ISO 13482 (service robots) — and scoped to a defined system function.
Run the HARA (or domain equivalent): identify hazards, assess exposure/controllability/severity, and derive the risk classification questions a notified body will ask — without pre-empting the rating they assign.
Decompose safety goals into functional and technical safety requirements allocated across the architecture, including the ML element and its safety mechanisms, monitors, and fallbacks.
Build the structured assurance argument (e.g. GSN) linking claims to evidence, making the safety reasoning explicit and reviewable rather than implicit and asserted.
Define and assemble the verification-and-validation evidence and the traceability matrix from requirement to test, so the technical file is complete and audit-ready.
Automotive OEMs and Tier-1s (ISO 26262), aerospace and defence primes (DO-178C/EASA), industrial and robotics integrators (IEC 61508, ISO 10218/13482), and energy operators deploying ML in functions where a safety incident is a regulatory and liability event — not a bug ticket. For teams who have a working model and now have to prove it is safe.
No. A notified body or accredited assessor assigns the safety rating and certifies the system. I engineer the safety case and the evidence trail they assess — the hazard analysis, the requirements decomposition, the assurance case, and the V&V traceability. Claiming otherwise would be dishonest, and a notified body would catch it.
Whichever governs your domain — ISO 26262 for automotive, DO-178C/EASA for aerospace, IEC 61508 for industrial functional safety, ISO 10218/13482 for robots. The first step of the engagement establishes the applicable standard and the system boundary.
EU AI Act compliance is about the regulation's governance and documentation obligations. Functional-safety certification is a separate, older, and deeper regime about the physical safety of the machine. A safety-critical AI system usually needs both; this service is the functional-safety half.
Explore other services that complement this offering
30 minutes. I diagnose your situation, tell you honestly whether this service fits — and if it doesn't, what does.