Ask who certifies a new airliner in the United States and almost everybody answers: the FAA. It is a reasonable answer. For the overwhelming majority of the individual findings that add up to a certification, it is also wrong.

The signature on most compliance findings belongs to a private individual — very often an engineer employed by the company whose design is being approved. This is not a loophole and it is not a scandal. It is written into federal statute, has been for decades, and the agency could not function without it. In 2018, according to FAA figures cited by the Department of Transportation’s Inspector General, designated organisations at four American aircraft manufacturers approved about 94 per cent of the certification activities for their own company’s aircraft.

The system has initials: DER, DAR, DPE, ODA. They are not interchangeable, the differences are the whole subject, and in December 2020 Congress rewrote a piece of the statute because of what happened when one of them was leaned on too hard.

The Statute Says “Qualified Private Person”

Section 44702 of Title 49 of the United States Code is the provision that lets the FAA issue airworthiness and type certificates. Subsection (d) is the one almost nobody reads. Subject to regulations, supervision and review that the Administrator may prescribe, the Administrator may delegate to a qualified private person, or to an employee under the supervision of that person, a matter related to the examination, testing and inspection necessary to issue a certificate — and to issuing the certificate.

Note how far that goes. It is not merely the inspection that may be handed over. It is the act of issuing the certificate itself.

The safeguards sit in the next two paragraphs and they are unusually blunt for a statute. Under 44702(d)(2) the Administrator may rescind a delegation at any time, for any reason the Administrator considers appropriate. Under 44702(d)(3) anyone affected by the action of a private person acting under the subsection may ask the Administrator to reconsider it, and the Administrator may reconsider on their own initiative at any time; if the action is found unreasonable or unwarranted, the Administrator must change, modify or reverse it.

Why does any of this exist? Arithmetic. The Inspector General’s 2021 report on the matter sets out the scale the agency is asked to supervise: the US civil aviation industry includes almost 292,000 aircraft, nearly 1,600 approved manufacturers and more than 5,400 aircraft operators. There has never been a version of the FAA with the headcount to inspect all of that itself, and Congress has never pretended otherwise.

DER, DAR, DPE: Three Initials, Three Entirely Different Jobs

Part 183 of the Federal Aviation Regulations is titled Representatives of the Administrator, and its opening section is refreshingly direct about what the whole thing is: the part describes the requirements for designating private persons to act as representatives of the Administrator in examining, inspecting and testing persons and aircraft for the purpose of issuing airman, operating and aircraft certificates.

Subpart C then lists the individual flavours: Aviation Medical Examiners, pilot examiners, technical personnel examiners, designated aircraft maintenance inspectors, designated engineering representatives, designated manufacturing inspection representatives and Designated Airworthiness Representatives. The three that come up constantly, and are constantly confused, are the last of those plus the first two of the engineering and pilot kind.

The DER — designated engineering representative — approves data. Section 183.29 breaks the role into nine separate categories: structural, power plant, systems and equipment, radio, engine, propeller, flight analyst, flight test pilot and acoustical. A structural DER may approve structural engineering information within limits prescribed by, and under the general supervision of, the Administrator, whenever the representative determines that the information complies with the applicable regulations. A power plant DER does the same for power plant installations, a radio DER for radio equipment, and so on down the list.

Four words in that formula carry the entire system: whenever the representative determines. The finding is the representative’s to make. The FAA sets the limits and supervises generally; it does not re-do the work.

The DAR — Designated Airworthiness Representative — issues certificates. Under 183.33 a DAR performs examination, inspection and testing services necessary to issue certificates, and issues those certificates, within limits set by the Administrator. A DAR may charge a fee for the service. The question a DAR answers is not whether a design is compliant but whether a particular aircraft in front of them conforms and is airworthy.

The DPE — pilot examiner — has nothing to do with aircraft at all. Section 183.23 lets a pilot examiner accept applications for flight tests and conduct those tests under the general supervision of the appropriate local Flight Standards Inspector. This is the person who sits beside a candidate on a checkride.

The shortest way to hold the three apart: a DER signs the paper that says the design complies. A DAR signs the paper that says the aeronave is airworthy. A DPE signs the paper that says the pilot is qualified. Three different objects, three different designations, and no overlap in authority between them.

Then the FAA Stopped Approving the Individuals

Everything above describes designees the FAA picks one at a time. In 2005 the agency created a second model, and in 2009 it finished implementing it. Applications for an Organization Designation Authorization could be filed from 14 November 2006, and Subpart D of Part 183 describes an ODA as something that allows an organisation to perform specified functions on behalf of the Administrator relating to engineering, manufacturing, operations, airworthiness or maintenance.

Three definitions carry the change. The ODA is the authorisation itself. The ODA Holder is the organisation named in a Letter of Designation. And an ODA Unit is, in the regulation’s own words, an identifiable group of two or more individuals within the ODA Holder’s organization that performs the authorised functions.

Within the holder’s organisation. That phrase is the structural shift, and it is the entire argument compressed into four words. The Inspector General spelled out what it replaced: under the previous organisational delegation systems the FAA was responsible for approving the individual designees who would work on its behalf. In the ODA model the organisation is authorised to perform the functions using company-appointed personnel, called unit members, overseen by a company employee called the ODA administrator. The FAA’s job becomes supervising the organisation’s processes and procedures rather than vetting the people.

Section 183.49 sets the outer edge: the Administrator may delegate any function determined appropriate under 49 U.S.C. 44702(d), consistent with the holder’s qualifications, and under the general supervision of the Administrator a unit may perform only those functions, subject to the limitations, listed in the holder’s approved procedures manual. The manual, not the regulation, is where the real boundary of any particular ODA is drawn.

What the Agency Keeps for Itself

Delegation is not abdication, and Part 183 says so in two places that matter. Section 183.55(b) is the handbrake: no ODA unit member may issue a certificate, authorisation or other approval until any findings reserved for the Administrator have been made. The FAA decides, project by project, which findings it is keeping. Novel designs, significant design changes and critical compliance activities are the usual candidates, and the agency has always maintained that inherently governmental functions — regulatory exemptions, for one — never go out at all.

Section 183.57 then lists what the holder owes. It must comply with its approved manual, give unit members sufficient authority to do the delegated work, cooperate with FAA oversight, and notify the Administrator within 48 hours of any change affecting its ability to meet the part. And, in paragraph (c), it must ensure that no conflicting non-ODA duties or other interference affects the performance of authorised functions by unit members.

That interference clause was in the rulebook the entire time. What it lacked, until the end of 2020, was a consequence.

What “Eventually Delegated” Meant on the 737 MAX

The Inspector General’s February 2021 report put numbers on a process that had previously been described only in adjectives. Working from Boeing’s own data, it found that at the start of the 737 MAX programme the FAA delegated 32 per cent of the detailed certification plans — 28 of 87 — to the Boeing ODA for approval.

By November 2016 that figure was 87 per cent: 79 of 91 plans, including, in the report’s own phrasing, the flight controls and stabiliser plans containing MCAS. A footnote finishes the sentence. Between November 2016 and March 2017, the FAA eventually delegated all 91.

The report is careful to record the agency’s explanation, and it is not an unreasonable one: FAA managers told the auditors that delegation typically increases over the life of a programme as systems mature and the agency gains confidence through its early involvement. The same report also notes that the FAA can delegate individual deliverables inside a plan it has kept for itself, and that the MAX programme ran to more than 1,700 deliverables. The headline percentage is therefore the floor of the delegation, not the ceiling.

In September 2020 the House Committee on Transportation and Infrastructure published its final report on the MAX after an 18-month investigation. One of its five central themes was named, bluntly, Conflicted Representation: the committee concluded that the FAA’s oversight structure with respect to Boeing created inherent conflicts of interest, and documented instances in which Boeing employees authorised to perform work on the FAA’s behalf failed to alert the agency to potential safety or certification issues.

One number from that investigation went on to change the statute. Boeing’s internal test data showed that a Boeing test pilot took more than ten seconds to diagnose and respond to uncommanded MCAS activation in a simulator — a condition the pilot described as catastrophic. Federal guidelines assume a pilot responds to that condition within four seconds.

A human-factors assumption, inside a system safety assessment, inside a certification plan that had been delegated. Hold that shape in mind for the next section.

“On behalf of the families of the victims of both crashes, as well as anyone who steps on a plane expecting to arrive at their destination safely, we are making this report public to put a spotlight not only on the broken safety culture at Boeing but also the gaps in the regulatory system at the FAA that allowed this fatally-flawed plane into service.”

Peter DeFazio — Chair of the House Committee on Transportation and Infrastructure, statement of 16 September 2020

Vox’s explainer on MCAS and the certification decisions behind it, one of the most-watched accounts of the accident sequence.

The Law Changed, and the Change Is Shaped Like MCAS

The Aircraft Certification, Safety, and Accountability Act was enacted on 27 December 2020 as Division V of Public Law 116-260. It carries, by the FAA’s own count at the time, more than a hundred separate requirements. One of them amended 49 U.S.C. 44702 itself, and it is the most precisely aimed sentence in the whole Act.

The new paragraph (d)(4) says that with respect to a critical system design feature of a transport category airplane, the Administrator may not delegate any finding of compliance with applicable airworthiness standards, or review of any system safety assessment required for issuing a certificate, until the Administrator has reviewed and validated any underlying assumptions related to human factors. Routine tasks are excepted. A critical system design feature is defined to include any feature, including a novel or unusual one, whose failure either alone or in combination with other failures could produce catastrophic or hazardous failure conditions.

Read that against the four seconds. Congress took a human-factors assumption buried in a delegated system safety assessment and wrote it into the delegation statute as something the regulator has to check with its own eyes before it is allowed to hand anything over. It is rare for legislation to be that specific about a failure mode, and rarer still for the shape of the fix to match the shape of the accident this exactly.

“One of the first things that I did as FAA Administrator was make it clear that we are the regulator and I reset the relationship with Boeing. I said that we would continue to exert a high level of scrutiny and that continues to this day.”

Stephen M. Dickson — FAA Administrator, testimony to the House Subcommittee on Aviation, 21 October 2021

Three further changes matter to anyone trying to understand who holds the pen today. From 1 January 2022 the Administrator must approve each new individual that a design-engaged ODA holder selects, before that person may act as a unit member on the FAA’s behalf — a partial reversal of the 2005 model, with conditional designations permitted, a 30-day deadline on the FAA to approve or reject, and the agency’s power to rescind an approval at any time reinforced.

Second, a civil penalty now attaches to any supervisor at an ODA holder that manufactures transport category airplanes who interferes with a unit member’s performance of delegated functions, and unit members are required to report interference they experience or witness. Third, neither the FAA nor an ODA holder may prohibit unit members from talking to FAA personnel, in either direction.

None of this was abstract. In 2021 the FAA and Boeing signed a settlement resolving two enforcement cases, numbered 2019NM520001 and 2020NM520001, under which Boeing agreed to pay a civil penalty of 1,217,854 dollars. The recitals record the parties agreeing that any interference by Boeing management officials with the ODA’s performance of delegated functions undermines the effectiveness of the FAA’s oversight and the public’s confidence in the safety of Boeing’s products, and that preventing such interference is essential to aviation safety and to Boeing’s qualifications to continue holding that delegation of authority.

Buried in the payment section is the detail that says the most. The FAA agreed, on further investigation of the adequacy of the evidence, not to pursue one particular allegation — retaliation against an ODA unit manager for filing an undue pressure report — and reduced the penalty by 33,333 dollars accordingly. The allegation was dropped. That it existed at all, in a federal enforcement file, is the clearest picture available of what the interference clause in 183.57(c) is actually about.

A long-form account of the commercial pressures around the 737 MAX programme, made with the airline pilot and 737 type-rated instructor Petter Hornfeldt.

Nobody Is Proposing to Abolish Delegation

It is tempting to read all of this as a story about a regulator that gave too much away. That is half the story at most. The arithmetic has not changed since 1958: there is no politically or financially plausible FAA that employs enough structural, systems, propulsion and flight-test engineers to make every finding on every project across 292,000 aircraft and 1,600 manufacturers. Every serious aviation authority on earth delegates. The European system does it through Design Organisation Approvals, which rest on the same logic.

Delegation is also how ordinary, uncontroversial work gets done. When the FAA certified the 737 MAX 10 on 22 October this year, the overwhelming majority of the findings underneath that certificate were made the same way they always are.

So the question was never whether to delegate. It is narrower and more useful than that: who appoints the person making the finding, who supervises them, what the regulator refuses to hand over at all, and what happens to a manager who leans on a unit member. Between December 2020 and January 2022, the United States changed its answer to all four.

The next time you read that the FAA certified an aircraft, the sentence is true in the way that “the government built a road” is true. Somebody else was holding the pen, under rules the government wrote, with a supervisor who could take the pen back at any time for any reason considered appropriate. That is not a secret. It is 49 U.S.C. 44702(d), codified in its present form in 1994 from a delegation power Congress first granted in the Federal Aviation Act of 1958.

The aerodynamic reason MCAS was fitted in the first place, explained in a 737 simulator by a current type-rated captain.

Sources: 49 U.S.C. 44702 and 14 CFR Part 183, as published; Department of Transportation Office of Inspector General report AV2021020, “Weaknesses in FAA’s Certification and Delegation Processes Hindered Its Oversight of the 737 MAX 8”, 23 February 2021; final committee report and accompanying statements of the House Committee on Transportation and Infrastructure, 16 September 2020; the FAA–Boeing settlement agreement in cases 2019NM520001 and 2020NM520001, published by the FAA; testimony of FAA Administrator Stephen M. Dickson to the House Subcommittee on Aviation, 21 October 2021; congressional summary of the Aircraft Certification, Safety, and Accountability Act.