Certification Gap Analysis for Normal-Category and Large Hydrogen-Powered Airplanes

Abstract

The transition to hydrogen as an aviation fuel, as outlined in current decarbonization roadmaps, is expected to result in the entry into service of hydrogen-powered aircraft in 2035. To achieve this evolution, certification regulations are key enablers. Due to the disruptive nature of hydrogen aircraft technologies and their associated hazards, it is essential to assess the maturity of the existing regulatory framework for certification to ensure its availability when manufacturers apply for aircraft certification. This paper presents the work conducted under the Clean Aviation CONCERTO project to advance certification readiness by comprehensively identifying gaps in the current European regulations. Generic methodologies were developed for regulatory gap and risk analyses and applied to a hydrogen turbine aircraft with non-propulsive fuel cells as the APU. The gap analysis, conducted on certification specifications for large and normal-category airplanes as well as engines, confirmed the overall adequacy of many existing requirements. However, important gaps exist to appropriately address hydrogen hazards particularly concerning fire and explosion, hydrogen storage and fuel systems, crashworthiness, and occupant survivability. The paper concludes by identifying critical areas for certification and highlighting the need for complementary hydrogen phenomenology data, which are key to guiding future research and regulatory efforts for certification readiness maturation.

1. Introduction

As part of its roadmap to achieve carbon neutrality by 2050, the European Union Clean Aviation Strategic Research and Innovation Agenda (SRIA) [1] identifies hydrogen as a promising carbon-free alternative to replace fossil fuels. To meet this target, the SRIA envisions the entry into service of hydrogen-powered aircraft by 2035, thus implying that aircraft and engines are certified in compliance with safety and environmental protection regulations prior to this commercial deployment. As highlighted in the SRIA, it is therefore essential to ensure that certification regulations evolve to support innovation for decarbonization of aviation, so they are ready when manufacturers apply for aircraft type certification. Considering the 3-to-5-year duration (depending on product to be certified) of a certification process, it is crucial to identify today the necessary regulatory developments that are needed to meet this ambitious 2035 target.

The roadmaps established by the European Union Aviation Safety Agency (EASA) [2] and the United States Federal Aviation Administration (FAA) [3] underscore the challenges of developing the right certification approach for hydrogen aircraft and engines. These challenges arise from the complexity of integrating hydrogen as a fuel and the need to gain a comprehensive understanding of hydrogen-related hazards. Acquiring this knowledge is crucial to understand how the regulation should adapt and to ensure that these disruptive aircraft will demonstrate safety performance equivalent to that of conventional aircraft. This effort must be undertaken alongside the development and maturation of hydrogen technologies, and with limited in-service experience.

Hydrogen aircraft, either utilized through direct combustion in a turbine or chemical reaction in fuel cells to generate electricity, is not a novel concept in the aviation industry. The safety aspects of hydrogen integration in aircraft and engines have been a major common concern for various past and ongoing research studies since the 1950s. Brewer [4,5] conducted some initial safety assessments of aircraft concepts, focusing on leaks and fire detection, crash hazards, and passenger exposure to cryogenic fuel. These studies focused on safety topics that remain key today but did not investigate the relevancy of certification requirements that were in force at this time. In 2000–2003, the European project Cryoplane analyzed the risks associated with liquid hydrogen and evaluated the relevance of certification procedures and airworthiness regulations. The project concluded in the certifiability of a hydrogen-powered large airplane using amended certification regulations, without further publicly available data [6]. More recently, Benson et al. performed a preliminary hazard analysis for hydrogen technologies, identifying the major hazards that must be addressed in hydrogen aircraft design [7]. They also highlighted the gaps in the existing knowledge that prevent a solid and credible safety assessment. This research did not extend to certification aspects. Review studies on liquid hydrogen aircraft technologies have synthesized safety aspects that are key to address in certification requirements and emphasize without further developments that certification is one of the most critical aspects for future entry into service, with major unknowns still existing [8,9]. Spencer in [10] evaluated certification considerations for a large hydrogen airplane, with a focus on flammability, ignition energy, cryogenic states, and crashworthiness, and provided some useful initial orientations for regulatory updates. In 2019, the FAA Energy Supply Device Aviation Rulemaking Committee published a report that included safety findings, regulatory gap analysis, and rulemaking recommendations limited to hydrogen fuel cells used as a secondary electrical power source in aircraft [11].

This current state of the research indicates that the hazards associated with the integration of hydrogen technologies into aircraft and engine designs are well studied and are relevant inputs for regulatory assessments. However, while the certification aspects and the timely availability of certification requirements are acknowledged in the literature as a critical milestone for enabling the entry into service of hydrogen aircraft, it is determined that there is currently no comprehensive evaluation of the adequacy and relevance of the existing regulatory framework for certification of a hydrogen-powered aircraft and engine. This research thus addresses this gap in the scientific and aviation community.

As part of the Clean Aviation Joint Undertaking program, the EU-funded CONCERTO project (Construction Of Novel CERTification methOds and means of compliance for disruptive technologies) aims to develop technical data that will constitute draft regulatory material and preliminary descriptions of means of compliance for future breakthrough innovations [12]. This paper presents the work conducted within this project to identify and substantiate the gaps existing in the current European certification regulations with respect to certification of hydrogen large and normal-category airplanes, as well as engines. It also aims to categorize, through a regulatory risk assessment, the critical areas for certification to help prioritize the necessary future rulemaking activities and the research efforts needed to gain the required knowledge to establish appropriate safety rules.

The paper hereafter is organized as follows. Section 2 outlines the methodologies developed for conducting a regulatory gap analysis and a regulatory risk assessment. Section 3 elaborates on the main gaps and the critical areas for certification determined through these analyses for the hydrogen-powered aircraft defined within the CONCERTO project. Finally, results are discussed in Section 4, along with conclusions and plans for future work.

2. Methodology for Regulatory Gap and Risk Analyses

A comprehensive understanding of the gaps in the existing regulatory framework and an assessment of their criticality are essential for establishing appropriate safety objectives and developing regulations for the certification of hydrogen-powered aircraft. This study, conducted within the frame of the CONCERTO project, investigates levels two (CRL2) and three (CRL3) on the Certification Readiness Level (CRL) scale [13], building upon the outcomes of the CRL1 activities detailed in [14].

The criteria required to validate CRL2 and CRL3 gates in the context of certifiability evaluation of disruptive technologies or products are defined in a methodological manner in [13]. CRL2 focuses on validating the concept of operations established in CRL1 for a given technology or product and defining the associated safety objectives. This stage seeks to determine the technical scope for safety and certifiability assessments, identify novel threats and risks that emerge from the introduction of disruptive technologies, and then define and agree with a certification authority the product-level safety objectives to achieve. CRL3 evaluates the applicability and relevance of the existing regulatory framework for future certification of the given product. This involves conducting a regulatory gap analysis and a regulatory risk analysis for the product and its concept of operations, as defined in CRL1 and CRL2, while adhering to the perimeter and safety objectives established in CRL2. The following sections provide a detailed exploration of the CRL3 activities and methodology that were developed in this study for hydrogen-powered aircraft.

The overall workflow of the methodology is presented in Figure 1. Although depicted as a linear process, the highly disruptive nature of this aircraft concept necessitates multiple iterations between CRL1, CRL2, and CRL3 to refine the outputs at each level. These iterations were essential to incorporate the current state-of-the-art knowledge on hydrogen technologies for aviation. Within the CONCERTO project, experts from industry and academia, in collaboration with EASA specialists, contributed to the analyses and the development of the outputs and conclusions.

2.1. Definition of the Technical Perimeter for Safety and Certifiability Assessments

The definition of the technical perimeter for safety and certifiability assessments involves two steps. First, it consists in characterizing the disruptive product and technologies in a manner that is sufficiently detailed to determine the associated safety and environmental protection hazards and to evaluate the relevance of the existing certification requirements to address those hazards. Second, it entails precisely defining the regulatory framework relevant to certifying the disruptive product and technologies, meaning the appropriate selection of the regulatory material that would be applicable for future certification. It typically consists of airworthiness and certification laws and procedures (e.g., EASA Basic Regulation, EASA Part 21, and USA 14 CFR Part 21), airworthiness certification codes (e.g., EASA certification specification), and Acceptable Means of Compliance (AMC), interpretative material, and standards. This selection process is critical as it underpins the consistency and completeness of the subsequent regulatory gap and analyses. Moreover, it establishes the current safety, regulatory, and standardization baseline, comprising certification requirements and underlying assumptions, that provides the high level of safety achieved nowadays in the aviation industry. This legacy, developed and upgraded through decades of experience in designing and certifying aeronautical products, serves as a foundational reference for evaluating the certifiability of disruptive products through the analysis of existing prescriptive or performance-based requirements or the safety intent of those requirements.

At this stage, depending on the disruptive technologies to be investigated, the selection can be further refined to focus on some specific technical disciplines or areas of expertise, for example through EASA Certification Panels [15].

2.2. Methodology for Regulatory Gap Analysis

The methodology, developed in the frame of this work under the CONCERTO project, to conduct a regulatory gap analysis is detailed in [16]. The analysis proceeds with an assessment of existing certification requirements. Each requirement is prescribed by an authority to address—either independently or in combination with other requirements—given safety hazards and then to require a given level of safety. The comprehensive set of applicable requirements for an aircraft or engine, known as certification specifications, serve to demonstrate compliance with the overall safety objective mandated in aviation law. For instance, EASA CS-25 is the collection of certification requirements that large airplanes must meet to satisfy the safety objective of European aviation law. These existing certification specifications represent the current state of the art for the safety of aircraft and engines, assuming the existing state of knowledge of technologies, design practices, and associated hazards. Hydrogen aircraft and turbines will have to demonstrate a level of safety that is at least equivalent to that demonstrated today for conventional aircraft and engines as defined by today’s certification specifications. This will necessitate certification requirements that effectively address all hazards related to the design of hydrogen products.

Hydrogen technologies challenge the current state of the art and state of knowledge by introducing novel systems, architectures and integration solutions, and related hazards. Consequently, the gap analysis aims to qualitatively project a safety state of the art for hydrogen aircraft and engines by assessing the adequacy and effectiveness of each existing requirement in prescribing the expected level of safety. The difference between how an existing requirement addresses hydrogen hazards and how it should address them to meet the expected level of safety is termed a regulatory gap.

Each requirement within the scope of the regulatory framework selected in Section 2.1 is evaluated against a multi-faceted generic criterion: its relevance in addressing the hazards introduced by hydrogen, within the perimeter covered by the requirement. For instance, CS-E 670 is a requirement that addresses hazards associated with the presence of liquid or solid contamination in the engine fuel supply, ensuring that engine malfunctioning will not occur as a result of this cause. While the current wording of requirement reflects the state of the art for fossil fuel technology, the gap analysis will assess whether it remains suitable for hydrogen fuel. It will also identify and substantiate any necessary modifications to ensure the requirement effectively upholds the safety objective of preventing hydrogen engine malfunctions due to fuel contamination.

As shown in Figure 2, this analysis is performed with respect to hydrogen properties and hazards, and to the technical perimeter defined in Section 2.1.

Each requirement is evaluated based on expert engineering judgment involving airworthiness and certification experts from aircraft and engine manufacturers, the EASA, and academia. The template document proposed in [13] is used to support the analysis. A typical evaluation involves assessing the validity of the safety intent, the explicit or implicit assumptions, and the means of mitigation underlying the requirement. It also examines the requirement’s relevance to soundly address the hazards or failure conditions targeted by the requirement. Then, it also comments on the availability of the necessary knowledge on hydrogen phenomenology to properly conduct and conclude the evaluation. As a result, we determine the overall relevance of the requirement, and of related AMC or interpretative material or standards if any, using the following qualitative classification: no gap, minor revision, major revision, analysis pending, not applicable to hydrogen aircraft, and new requirement needed. Any identified gaps are substantiated. When the evaluation cannot be conclusive due to insufficient hydrogen phenomenology knowledge, the substantiation outlines the further investigations or research activities required to advance the CRL3 maturation.

The compilation of the aforementioned conclusions and substantiations for each requirement forms the final output of the regulatory gap analysis. This comprehensive summary provides all stakeholders, including certification authorities, with a holistic view of the maturity of the existing regulatory framework in relation to the future certification of a hydrogen aircraft concept as defined within the technical perimeter defined in Section 2.1.

2.3. Methodology for Regulatory Risk Analysis

The methodology developed in this work is designed to conduct a regulatory risk analysis for each identified gap or group of gaps from the regulatory gap analysis. Its objective is to classify these gaps based on the estimated effort required to address them in future rulemaking activities. This analysis aims to help prioritize future rulemaking tasks by identifying critical areas essential for the certification of hydrogen aircraft. To perform the risk analysis, gaps are grouped within technical areas where multiple requirements are coherently impacted.

The 3 × 3 risk matrix shown in Figure 3 is proposed as the tool to assess and rank the level of risk associated with each identified technical area. This matrix relies on two inputs. The first input is the estimated extent of revision required to fill the gaps existing in each area, categorized as minor, major, or significant. The second input is the estimated availability of accurate data on hydrogen, which is ranked as poor, medium, or high. This second criterion reflects the current level of knowledge about hydrogen-related threats to fully characterize a safety objective and fill regulatory and standardization gaps in each area. The assessment is conducted qualitatively, relying on expert engineering judgment. The intersection of these two inputs within the matrix determines the overall risk level for each area. Ranking the level of risk of each area then allows the identification of critical areas for certification.

3. Results

This section first describes the technical and regulatory perimeter of the assessments. It then presents the detailed outcomes of the regulatory gap analysis, including the identification of hydrogen phenomenology data that must be completed to advance in the certification maturity scale. Finally, the results of the regulatory risk analysis are presented, highlighting the identified critical areas for certification.

The thermophysical properties and hazards of hydrogen, as detailed in [16] and further supported by an abundant literature, are utilized as inputs for applying the methodology.

3.1. Technical Perimeter for Safety and Certifiability Assessments

The hydrogen-powered aircraft generic concept considered in this study is summarized in Figure 4, with a comprehensive description and the rationale for its development provided in [14]. The concept envisions a conventional tube-and-wing architecture, incorporating liquid hydrogen storage in the aft fuselage. Hydrogen is distributed in a liquid form to two underwing hydrogen-burning turbofan engines, with phase transition occurring within the nacelles. Additionally, the design includes a fuel cell system serving as the sole auxiliary power unit.

This concept establishes the aircraft architecture, system and component configuration, and their integration at the aircraft level, as well as the concept of operations for a hydrogen aircraft. The safety by design approach retained for the generic concept relies on sensing and monitoring devices, pressure control loops, safety sensors, or structural health monitoring (SHM). To address uncertainty related to the knowledge and maturity of hydrogen technologies, it also identifies technical assumptions that set boundaries for the regulatory gap and risk analyses. Notably, this study does not explore the following technical solutions: gaseous hydrogen storage, cryo-compressed hydrogen storage, underwing fuel storage solutions, and fuel cells for electric propulsion.

The scope of the regulatory framework examined in this work is outlined in

Table 1. Perimeter of the investigated regulatory framework.

Selected EASA CS	CS Amendment	EASA Certification Panels Investigated
CS-25 for Large Airplanes [19]	27	3, 5, 7, 11
CS-E for Engines [20]	7	19
CS-23 for Normal-Category Airplanes [21]	6	-
CS-CO2 for Airplace CO2 Emissions [22]	2	9 (through 19)
CS-34 for Aircraft Engine Emissions and Fuel Venting [23]	4	9 (through 19)

. The analyses center on the European regulatory framework for certification governed by the European Basic Regulation (EU) No 2018/1139 [17], Regulation (EU) No 748/2012 for Initial Airworthiness and Environmental Protection [18], and the EASA certification specifications (CSs). Within this scope, requirements, AMC, and standards—where existing and relevant—are analyzed.

Throughout the rest of this paper, any reference to CSs pertains to the amendment specified in Table 1. For ease of readability, the amendment will not be repeated.

As presented, the generic concept answers to the definition of a large airplane. Therefore, CS-25 and CS-E, which prescribe certification requirements, respectively, for large airplanes and for engines, are selected.

Given the threats and hazards associated with hydrogen as a fuel, the CS-25 analysis prioritizes the following technical areas of expertise where significant regulatory gaps are anticipated: Structure and Material, Electrical Systems (including electrical wiring and interconnection systems, and fuel cells), Powerplant Installation and Fuel System, and Cabin Safety and Occupant Protection. These areas correspond to EASA certification panels 3, 5, 7, and 11, respectively. The corresponding CS-25 subparts and sections are listed in

Table 2. Synthesis of CS-25 subparts and sections analyzed.

CS-25 Subpart	Sections	Coverage of the Gap Analysis *
A—General	-	×
B—Flight	all	o
C—Structure	all	×
D—Design and Construction	General	×
	Control Surfaces	o
	Control Systems	o
	Landing Gear	o
	Personnel and Cargo Accommodations	(×)
	Emergency Provisions	(×)
	Ventilation and Heating	(×)
	Pressurization	(×)
	Fire Protection	×
	Miscellaneous	(×)
E—Powerplant	General	×
	Fuel System	×
	Fuel System Components	×
	Oil System	o
	Cooling	o
	Air Intake System	(×)
	Exhaust System	×
	Powerplant Controls and Accessories	×
	Powerplant Fire Protection	×
F—Equipment	General	(×)
	Instrument Installation	(×)
	Electrical Systems and Equipment	(×)
	Lights	(×)
	Safety Equipment	o
	Miscellaneous Equipment	(×)
G—Operating Limitations and Information	General	o
	Operating Limitations	(×)
	Marking and Placards	(×)
	Airplane Flight Manual	×
	Supplemental Information	(×)
H—Electrical Wiring Interconnection Systems	-	$\times$
J—Auxiliary Power Unit Installations	all	o

* ×: fully analyzed; (×): partially analyzed; o: not analyzed.

, representing 53% of requirements prescribed in this CS.

The regulatory perimeter for the analyses is limited to certification of the design (i.e., initial airworthiness) and does not consider typically continuing airworthiness, operations, airport, air traffic management, or rules of the air regulations.

3.2. Regulatory Gap Analysis

3.2.1. Results for CS-25 for Large Airplanes

For Certification Panel 3—Structure and Material, the majority of the current certification requirements (over 90%) are adequate to address the structural aspects of the hydrogen aircraft concept, as they set safety objectives that are independent of design solutions. The following gaps are identified:

• Interaction of systems and structures (25.302 and CS-25 Appendix K [19]): These requirements address systems that affect structural performance, either directly or as a result of a failure or malfunction, establishing criteria adapted to flight control systems, autopilots, stability augmentation systems, load alleviation systems, flutter control systems, and fuel management systems. The structural integrity of hydrogen tanks relies on systems for pressure control, safety pressure relief, and safety sensors (e.g., pressure, structural health monitoring, acoustic sensing, leak detection, and hydrogen concentration sensing). As failure or malfunction of these systems could directly affect the structural performance of the tanks, the principles established in 25.302 and CS-25 Appendix K remain relevant for these specific systems, but the current requirements are not written to address these types of interaction of systems and structures. With the existing content of Appendix K being still valid for hydrogen aircraft, a new section is then needed to define its applicability to specific hydrogen systems, the acceptable safety objectives for those systems’ reliability, and the corresponding structural safety factors as a function of system reliability.
• Strength and deformation (25.305): Deformation of the structure under loading can lead to hydrogen effects, typically leaks, which are intensified by the small size of hydrogen molecules. Considering the potentially catastrophic consequences of hydrogen leaks and accumulation, 25.305 presents a gap in addressing the detrimental leaks or hydrogen effects that can result from structural deformation and loads.
• Pressurized compartment loads (25.365): This requirement, which prescribes structural safety factors for these compartments, does not assume the case of pressurized hydrogen tanks. A gap is then identified in addressing hydrogen tank pressure vessels and related loading.
• Emergency landing conditions and structural ditching provisions (25.561, 25.562, and 25.563): The safety intent of each requirement remains valid for hydrogen aircraft, with the objective to provide occupants with at least the same level of survivability compared to the one provided by current requirements. Hydrogen aircraft airframes present disruptions compared to traditional architecture with respect to the location of the tanks in the aft fuselage. This new location requires special attention to the structural robustness and crashworthiness performance of tanks in emergency landing conditions to prevent detrimental effects. Given the potentially catastrophic consequences of hydrogen leaks in emergency landing conditions, especially post-crash fires and explosions with behaviors that significantly differ from fossil fuel ones and exposure of occupants to cryogenic temperatures, it is determined that the relevance of those requirements must be evaluated through the establishment of aircraft-level crashworthiness, ditching, and occupant survivability safety objectives adapted to hydrogen aircraft, this evaluation being highly linked to design solutions.
• Damage tolerance and fatigue evaluation of structure (25.571): The requirement is adequate to address the effects of exposure to hydrogen and hydrogen environment on structural durability. However, it is determined that guidance and criteria are missing to adequately evaluate these effects, typically covering thermocycling fatigue, material embrittlement, environmental damage, or aging effects, for structural elements exposed to this environment in normal conditions or as a result of failure or malfunction, and to define damage detectability criteria especially for tanks where novel inspection techniques (e.g., SHM) are envisioned due to the design characteristics of the tanks [14]. Additionally, as hydrogen aircraft operations necessitate that a given quantity of liquid hydrogen is present inside the tanks during ground phases (e.g., turnaround time and night stop), the physics of hydrogen storage leads to pressure variations inside the tanks during those phases [24]. Structural elements of tanks are then exposed to pressure load variations when on the ground, thus affecting the definition of their loading spectra. Guidance is then needed to define tank usage parameters (e.g., tank cycles, filling cycles, and operating hours) that account for ground phases in addition to flight phases.
• Material provisions (25.603, 25.605, 25.609, 25.613, and 25.621): These requirements that address materials, fabrication methods, protection of the structure, material strength properties and material design values, and casting factors are valid for hydrogen aircraft. It is however identified that material standards that adequately cover hydrogen environments are needed for the purpose of compliance demonstration to these requirements. The standards will have to address topics such as the determination of material properties for hydrogen installations (e.g., tank, components, and pipes), the selection of materials (existing or new ones), the definition of test protocols, and rules for results extrapolation (for example, when tests are not conducted in a fully hydrogen-representative environment).
• Bird strike (25.631): The requirement is valid for hydrogen aircraft. However, as the consequences of bird impacts on exposed hydrogen installation can present new hazards with respect to existing ones (e.g., in-flight fire), guidance may be required to define acceptable criteria for hydrogen system protection.

For Certification Panel 5—Electrical Systems, the majority of the current certification requirements (85%) are deemed adequate to address the electrical aspects of the hydrogen aircraft concept. The following gaps are identified:

• Electrical systems and equipment section (25.1351, 25.1553, and 25.1357): These requirements, which address electrical system capacity, electrical power generation, external power, installation of electrical components, and circuit protective devices for non-propulsive use of electrical power, are sufficiently generic to remain valid for hydrogen aircraft. However, they lack provisions to address the specific hazards of hydrogen fuel cells as an electrical power source and to ensure their safe de-energization during the required rapid disconnection of a power source [11].
• Subpart-H electrical wiring interconnection systems (EWIS): The safety intents of this subpart in preventing hazards, typically in-flight smoke and fires, that could result from EWIS degradations or failure remain fully valid for hydrogen aircraft, and the existing requirements are deemed generally adequate. However, it has been determined that complementary provisions are necessary. Indeed, the requirements and AMC do not account for the hydrogen system’s components and related safety devices (e.g., sensors, ventilation system, and pressure relief valves), their installation, and their exposure to hydrogen environment. For system separation (25.1707), the current examples given in the requirement must be expanded to include specific threats such as the effects on EWIS of exposure to cryogenic temperature and to gaseous or liquid hydrogen, as well as the protection of EWIS components to prevent their degradation, with appropriate criteria for separation between EWIS and hydrogen components. For fire protection (25.1713), the AMC needs revision to consider hydrogen flame characteristics, including defining hydrogen fire resistance criteria, updating CS-25 Appendix F [19] to reflect hydrogen-specific testing conditions, and potentially redefining fire zones, as detailed in the Panel 7 analysis. Finally, provisions related to the installation of EWIS should be extended to cover the use of explosion-proof components, robust leak detection systems, and additional safety measures in areas prone to hydrogen gas accumulation.
• Lightning, electrical bonding, protection against static electricity, and fuel system lightning protection (25.581, 25.899, and 25.954): Energy transfer from these phenomena could be an ignition source for a hydrogen flammable atmosphere, which has a significantly lower minimum ignition energy compared to a fossil fuel flammable atmosphere, which is currently assumed in the requirements [16]. However, the existing requirements and methodologies for compliance demonstration and protection are sufficiently generic to remain valid for hydrogen aircraft. Nevertheless, it has been determined that the current AMC assumes fossil fuels and would need to be revised to address safety hazards associated with a hydrogen flammable atmosphere and the related minimum ignition energy. Key updates should include characteristics of a hydrogen flammable atmosphere, electrical properties of storage and distribution systems and components, hazards associated with the accumulation of static charges, and induced voltage in hydrogen fuel systems such as pipes.

The requirements covered through the Certification Panel 7—Powerplant Installation and Fuel System are significantly impacted by the introduction of hydrogen as a fuel and the hydrogen turbine and related powerplant installation. The existing requirements mainly assume liquid fossil fuel and its fire and explosion behavior, fuel storage mostly in the wings, and fuel systems and powerplants designed and adapted to this fuel technology. Hydrogen substantially challenges these assumptions, leading to the following significant gaps:

• Fire and explosion prevention and protection: Fire and explosion are regarded as a key safety issue for hydrogen aircraft. The gap analysis assumes that hydrogen aircraft must maintain the level of safety achieved by circa 70 years of regulatory advancements. Current certification requirements provide the expected level of safety through a multi-faceted approach. The safety strategies in place are built upon different degrees of prevention and protection that have improved over the years through a large field experience and a strongly documented understanding of liquid fossil fuel fire and explosion hazards, with different well-proven technologies that are relied on as mitigation means. They notably rely on minimization of flammable fluid atmosphere ignition risk (25.863), fuel tank explosion prevention (25.981) and venting (25.975), aircraft fire zoning with specific criteria for designated fire zones (25.1181), nacelle areas (25.1182), and flammable fluids and flammable-fluid-carrying components (25.1182 and 25.1183). They also rely on drainage and ventilation of fire zones (25.1187), firewalls (25.1191), fire extinguisher systems (25.1195, 25.1197, 25.1199, and 25.1201), fuel shut-off means (25.1189), fire detectors (25.1203), and fire protection of systems (25.865, 25.867, and 25.869). While the safety intent of these strategies remains valid, the unique properties of hydrogen introduce new regulatory challenges. These include addressing the creation of a flammable atmosphere (e.g., high diffusivity, wide flammability range of an air–hydrogen mixture, and propensity to leak due to the small molecular size), the ignition of this atmosphere (low minimum ignition energy leading to more potential ignition sources compared to fossil fuel vapors [11] and autoignition temperature), the dynamics of subsequent fire or explosion (e.g., heat flux, flame temperature, burning velocity, fire duration, plume patterns, quenching gap, and deflagration-to-detonation transition), and the current lack of effective extinguishing solutions and reduced fire suppressibility options compared to fossil fuels [11,25] that may require alternate means of mitigation for fire management. Major gaps have therefore been identified in existing requirements and AMC. Addressing these gaps will require a paradigm shift to develop hydrogen-specific fire and explosion prevention and protection strategies, and then in the formulation of appropriate certification requirements. These strategies shall also consider the potential presence of other-than-hydrogen flammable substances on board. Bridging these gaps will necessitate complementary phenomenology knowledge, as outlined in Section 3.2.5. The criticality of this topic for hydrogen aircraft is also shared by the EASA and the FAA, as presented during the EASA Certification Roadmap on H2—International Workshop 2024 [2], the joint-authorities Hydrogen Fire & Explosion Research Steering Group [26], and the recent FAA Hydrogen-Fueled Aircraft Safety and Certification Roadmap [3].
• Fuel system and fuel system components sections (Subpart E—Powerplant): The existing requirements and AMC mainly assume liquid fossil fuels and the associated fuel system and components. These requirements thus aim to address hazards related to this fuel technology, dealing with fuel distribution from tanks to engines: fuel flow, fuel system functions and components (typically pumps, lines, filters, and drains), lightning protection, and hot weather operation. They do not account for hydrogen flow characteristics, or for hydrogen fuel systems and components, their installation, operating characteristics, and failure modes that differ from fossil fuel systems (e.g., cryogenic fuel pumping, leak detector, and cavitation hazard). It is therefore determined that requirements and AMC should be amended with required critical parameters for hydrogen fuel distribution to engines and fuel cells in cryogenic liquid and gaseous forms including in hot weather operation and with acceptable contamination thresholds to address risks, typically engine flameout, resulting from air or other contaminants ingress. Revision is also necessary to define safety criteria for hydrogen-specific functions that—depending on design solutions—could be introduced into the fuel system, for example liquid-to-gaseous phase transition or pressure relief mechanisms. Then, the methodology defined in AMC 25.952 for lightning protection of the fuel system is relevant to address hydrogen hazards. However, the technical provisions of this AMC should be updated to include hydrogen flammable atmosphere characteristics and storage and distribution systems, including new materials and a vacuum layer for thermal insulation that could influence the effectiveness of protection, venting lines that may be exposed to direct lightning, fuel cells, and effects of lightning on the compartment—possibly difficult to access—where hydrogen accumulation is possible. Finally, the requirement for fuel jettisoning (25.1001), which currently aims to ensure minimum aircraft flight performance in abnormal conditions through fuel release in the atmosphere, needs to be re-evaluated in line with the aircraft-level safety objectives of hydrogen emergency release that are not sufficiently mature at this stage.
• Fuel tank (Subpart E—Powerplant): The existing requirements (25.963 to 25.977) are primarily written for fuel tanks and associated safety devices with fossil fuels stored at ambient temperature. Liquid hydrogen tanks introduce significantly different design considerations such as cryogenic storage with two-phase hydrogen equilibrium, thermal insulation, boil-off and pressure control in flight and on the ground, adapted refueling/defueling solutions, and inerting procedures. In this work, the reference architecture involves a non-integral, double-walled tank with a combination of foam and multi-layer insulation techniques, installed in the aft fuselage [14]. While the safety intents of existing requirements remain valid, major gaps are identified with respect to thermal loads and cycling, acceptable hazardous quantities of leakage, fuel tank interior inspectability, applicable test conditions (25.965), isolation from the occupant compartment (25.967), avoidance of hydrogen accumulation, tank ullage control and phase-equilibrium management, determination of unusable liquid hydrogen quantity that shall be in the tanks (25.955) [24], hydrogen contamination in the tank (25.971), fuel tank filler connection and pressure refueling (e.g., pressure and temperature control, inerting process before refueling, and protection of service personnel), hydrogen venting as part of the pressure control system, and safe release of hydrogen including flame arrestor and icing prevention.

For Certification Panel 11—Cabin Safety and Occupant Protection, half of the current certification requirements are considered adequate for hydrogen aircraft concept. Gaps are mostly related to aircraft emergency response capabilities considering hydrogen environment, protection of the occupants against fire and explosion, crashworthiness, and emergency evacuation:

• Ditching (25.801): The safety intent of the current requirements remains valid for hydrogen aircraft. The safety effects of hydrogen and hydrogen system behavior in ditching situations are not addressed in the literature and require further research to determine appropriate certification criteria. This includes evaluating the potential risks associated with hydrogen release, cryogenic temperature effects when in contact with water, and system integrity under water impact.
• Emergency evacuation and emergency exits (25.803, 25.807, and 25.809): The safety intent, which is to allow a rapid evacuation of occupants in survivable crash landing scenarios, is obviously valid for hydrogen aircraft. The aircraft emergency response capabilities and the way to demonstrate compliance to certification requirements nevertheless has to be investigated to account for expected hazards arising from hydrogen post-crash fire situations and emergency landing conditions as discussed in Panel 3. This will require additional research as discussed in Section 3.2.5. Due to the placement of the tanks in the aft fuselage, requirements concerning emergency exits and their arrangement need to be adjusted.
• Ventilation (25.831): The requirement addressing ventilation and air quality in crew and passenger compartments remains valid for hydrogen aircraft. However, while hydrogen is not a toxic gas, its presence in these compartments could alter the breathable air composition (oxygen displacement), potentially leading to hazardous conditions. To address this, the requirement should be complemented to account for the potential ingress of hydrogen.
• Compartment interiors and thermal/acoustic insulation materials (25.853 and 25.856): These requirements are critical to preventing the spread of smoke and fire within the occupant compartments and to mitigating fire penetration and flashover scenarios. They are adequate for hydrogen aircraft. However, a gap is identified in CS-25 Appendix F, as the prescribed test procedures and criteria do not account for hydrogen flame and fire characteristics.

3.2.2. Results for CS-E for Engines

CS-E defines requirements that are generally generic and sufficiently broad to ensure that the safety objectives remain valid for hydrogen turbines. The majority of the current certification requirements (85%) are determined to be adequate. However, the following main gaps are identified:

• Engine control system (E 50): The requirement is sufficiently generic to be applicable to hydrogen turbines. However, the associated AMC needs to be revised to account for control systems and equipment specific to hydrogen engines. These include the fuel metering unit, pressure, temperature and flow rate control systems, hydrogen phase transitioning system, and integration of heat exchangers.
• Equipment (E 80): The requirement is adequate for hydrogen turbines. However, a gap is identified with respect to explosion proofness and prevention criteria that need to be emphasized for hydrogen turbines due to the increased level of risk.
• Fire protection (E 130): The safety intent of the requirement is valid for hydrogen turbines, but it is based on a strong underlying assumption about the behavior of fossil fuel fires. Since this assumption does not hold for hydrogen solutions, similarly to CS-25 Panel 7, the current regulation presents major gaps in addressing hydrogen-specific hazards. Nevertheless, the requirement remains applicable to other combustible substances that may exist in the engine design. To adequately address hydrogen-related threats, the current regulatory philosophy must be re-evaluated in line with fire and explosion prevention and protection at the aircraft level. While fire remains a concern, the risk of explosion must also be better considered. High-pressure hydrogen leaks or explosions could become the sizing cases for engine and nacelle structures. Additional gaps are also identified about increased risk of torching flames due to pressurized hydrogen in gaseous form (which could extend beyond the currently addressed scenario of engine case burn-through), prevention of leaks and ignition, ventilation as mitigation means, and criteria to define hazardous quantities of hydrogen fuel.
• Fuel system (E 560): Similarly to CS-25 Panel 7, the requirement is written for fossil fuels and associated fuel distribution systems and components. Consequently, it presents major gaps when applied to hydrogen fuel systems. Depending on design choices, hydrogen fuel conditioning and phase transition constraints may result in variations in engine–aircraft interfaces and necessitate the incorporation of new components, such as heat exchangers, in E 560. These new elements introduce additional hazards that must be addressed. Among these are hydrogen leaks, which may require dedicated requirements or AMC for leak detection system calibration and venting systems. Furthermore, hydrogen’s chemical properties introduce potential variability in the fuel’s chemical composition in the tanks, particularly regarding the para/orthohydrogen proportion, with then a need to determine engine compatibility and impacts.
• Icing conditions (E 780): The requirement applies to atmospheric environmental conditions and is valid for hydrogen turbines. It is determined that exposure to hydrogen cryogenic conditions could lead, in normal or abnormal situations, to liquefaction or solidification of air, oxygen, water vapor, or any other fluid, thus leading to new safety concerns. These threats are not addressed in the requirement; a dedicated new requirement is probably needed to specifically account for these hydrogen-related cryogenic hazards.
• Fuel venting and engine emissions (E 1010 and E 1020): These requirements remain valid for hydrogen turbines. Gaps are, however, identified and presented in Section 3.2.4.

3.2.3. Results for CS-23 for Normal-Category Airplanes

Since Amendment 5, EASA CS-23 has been a performance-based regulation that prescribes high-level safety objectives, designed to be independent of specific design solutions. Detailed requirements are defined through a set of AMC, either from CS-23 Amendment 4 [27] or industry standards accepted by the EASA. Through the full CS-23 gap analysis, it is determined that 78% of the requirements are suitable for hydrogen aircraft. The identified gaps, detailed below, align with many conclusions drawn from CS-25 and CS-E analyses. To avoid redundancy, overlapping detailed conclusions will not be repeated here.

• Certification of normal-category airplanes (23.2005): The certification- and performance-level categorization defined in this requirement is independent from energy source or propulsion mode and remains adequate for hydrogen aircraft. However, this requirement specifies a maximum take-off mass (MTOM) upper limit of 8618 kg for a CS-23 airplane. The physics and level of maturity of hydrogen components (e.g., fuel cells, tanks, distribution system, protection, and mitigation) are such that, when compared to existing fossil fuel technologies, a significant increase in MTOM is expected for a similar airplane certification and performance levels. A gap is then identified in the current MTOM upper limit or in the classification boundary between CS-23 and CS-25 airplanes.
• Interaction of systems and structures (23.2205): Similarly to findings from the CS-25 analysis, the existing AMC does not account for systems that could affect the structural performance of the hydrogen tanks.
• Component loading conditions (23.2225): Similarly to findings from the CS-25 analysis, hydrogen tanks, particularly as structural pressure vessels, are not explicitly addressed in this requirement.
• Emergency conditions and occupant physical environment (23.2270, 23.2315, and 23.2320): Similarly to CS-25 analysis, these requirements that set overall safety objectives for occupant survivability must be adapted to consider fuel tank crashworthiness, post-crash fire scenarios, and fuel system installation and components.
• Fire protection and powerplant installation fire protection (23.2325, 23.2330, and 23.2440): Consistent with the findings from CS-25 and CS-E, current fire and explosion prevention requirements are not tailored to the specific hazards associated with hydrogen.
• Design and construction principles (23.2250): Depending on design solutions, the requirement may not fully address the proper functioning of the empennage control system, which in most cases will be run past the hydrogen storage, in case of exposure to normal or abnormal hydrogen environment (e.g., effects of low temperature). The same gap may apply to other control systems depending on hydrogen system installation.
• Materials and processes (23.2260): Similarly to CS-25 and CS-E analyses, permeability is a characteristic of materials that is not covered in the requirement and that could influence continued safe flight and landing. This gap is linked with fire and explosion requirements with respect to defining whether leakage resulting from permeability properties is acceptable under particular conditions.
• Occupant physical environment (23.2320): The safety intent of the requirement is valid for hydrogen aircraft. However, the requirement does not address the hazardous exposure of occupants to cryogenic fluid.
• Powerplant installation ice protection (23.2415): A similar gap to that identified in CS-E 780 exists concerning the liquefaction or solidification of air, oxygen, water vapor, or other fluid due to exposure to hydrogen cryogenic conditions.
• Powerplant installation, energy storage, distribution, and support systems (23.2430 and 23.2435): The safety intents of the requirements are relevant for hydrogen aircraft powerplants. However, they do not prescribe crashworthiness criteria, do not consider hydrogen venting as a safe alternative to retain energy in systems as currently required or as an alternative storage system energy jettisoning, and do not address the hydrogen refilling specificities such as purging. Significant gaps exist in the current AMC that primarily address fossil fuel technologies, systems, and hazards. They must be revisited to cover hydrogen technologies similarly to findings from CS-25 and CS-E analyses.
• Lightning and high-intensity radiated field protection (HIRF) (23.2515 and 23.2520): Similarly to CS-25 analysis, as energy from those phenomena is a potential ignition source of a hydrogen flammable atmosphere, depending on the safety objectives and requirement defined for fire and explosion prevention and protection, this requirement may need revision.
• Instruction for continued airworthiness (23.2625): The current requirement mainly points at structural inspections and structural failures. As hydrogen systems failures (e.g., pipes, tanks, components, safety devices, and structural health monitoring systems) can lead to catastrophic events (e.g., rupture, fire, and explosion), a gap is identified in the prescription of inspections that may be required for certification.

Additionally, many existing AMCs are highly prescriptive assuming fossil fuel technologies. Therefore, significant development of hydrogen- and fuel-cell-specific AMCs is anticipated, with detailed considerations extending beyond the scope of this paper.

3.2.4. Results for Environmental Protection CS-34 and CS-CO2

The analysis confirms the relevance of CS-34 and CS-CO2 but highlights the insufficiency of CS-34 in addressing all aspects of fuel vented and engine emissions. CS-34 (34.1 for fuel venting and 34.2 for engine emissions) redirects to ICAO Annex 16 Volume II [28] and ICAO Environmental Technical Manual Doc. 9501 [29] that prescribe requirements for liquid fuel venting with a process specific to kerosene engines, and for HC, CO, and NOx emissions. The operation of hydrogen aircraft and engines introduces novel emissions: hydrogen emissions from boil-off, venting, leaks, or combustion; water vapor generated during combustion or as a by-product of fuel cell operation; and potentially inerting gases, if utilized as a preventive measure to mitigate the risk of flammable atmosphere build-up or during ground operations, especially refueling.

Consequently, a potential gap is identified in the environmental protection regulatory framework concerning the incorporation of those hydrogen-related emissions, the establishment of allowable criteria, and the definition of means of compliance. Advancing phenomenology knowledge on the effects of these non-CO2 emissions is identified as a critical input to complement as necessary CS-34, and ICAO Annex 16.

3.2.5. Hydrogen Phenomenology Data

Through the gap analysis, missing or incomplete data listed in

Table 3. Missing or incomplete hydrogen (H2) phenomenology data.

Identification of Missing/Incomplete Data	Impacts
Characterization of H2 fire in an aeronautical environment (including flame propagation, flame plume, fire duration, standardized H2 flame, and definition of fire proofness and resistance)	Fire and explosion prevention and protection
	Material selection
	Fire testing standards
Characterization of post-crash fire scenarios	Emergency evacuation strategy
	Crashworthiness criteria
Characterization of H2 leaking and dispersion, build-up of flammable atmosphere, hazardous quantities, and acceptable rate(s) of leakage	Fire and explosion prevention and protection
	Leak detection criteria
	Ventilation criteria
Characterization of conditions for H2 explosion and deflagration-to-detonation transition	Fire and explosion prevention and protection
	Explosion proofness criteria
Definition of environmental conditions for H2 and cryogenic conditions	Impacts any requirement or AMC or standard where those conditions describe the environment to which a structure, a material, a component, a zone, etc., is exposed
Characterization of the effects on materials of exposure to H2 and H2 environment (e.g., embrittlement, permeability and permeation, thermal effects, sealing, degradation of material properties, degradation modes, aging effects, and effects of vacuum exposure)	Impacts any requirement or AMC or standard where those effects can affect structural durability, material protection, selection of materials, prevention of degradation, fatigue and damage tolerance evaluation, material strength properties and design values, special safety factors, SHM, and test protocols
Definition of acceptable tests and procedures to qualify equipment exposed to H2 and cryogenic environment	Testing standards
Characterization of the influence of contaminants in the hydrogen fuel system on H2 flow and definition of acceptable criteria	Impacts fuel system and engine requirements on H2 flow and filtering
Characterization of energy transfer needed to ignite an H2 flammable atmosphere (lightning, HIRF, static electricity) and induced voltage/static electricity in H2 fuel systems	Fire and explosion prevention and protection
	Lightning and static electricity protection
Characterization of the hazardous interactions between H2 systems/pipes and EWIS	Fire and explosion prevention and protection
	Installation rules
Characterization of environmental impacts of H2 and water vapor emissions	Criteria for environmental protection requirements
Safety effects in ditching conditions	Ditching requirements and emergency evacuation
Characterization of the effects of exposure to volcanic ashes of H2 turbine engines and H2 fuel system components	Aircraft, engine, and fuel cell susceptibility to such exposure
Performances of safety sensing devices (typ. pressure, temperature, fire, H2 leak and concentration, and SHM): technologies, failure modes, accuracy, and limitations	Interaction of systems and structures
	Fire and explosion prevention and protection
	Fuel quantity indication system
Performances of H2 fire extinguishing solutions	Fire and explosion prevention and protection

have been identified related to the characterization of hydrogen phenomena. These data are critical for multiple reasons related to filling the identified gap. First, they can hinder a thorough evaluation of the relevance of current requirements; their availability will allow further analysis. Then, they are essential inputs for establishing criteria within certification requirements and revising or developing AMCs that incorporate hydrogen-specific considerations. Finally, these data are necessary for the development of standards, such as material and fire standards, which are crucial for fully characterizing hydrogen behavior in the aeronautical environment.

Establishing such data is then critical to perform CRL4+ activities. They can be determined through research activities, testing programs or simulations either to complement data already available in the scientific literature such as [30,31,32] or to develop new sets of data.

3.3. Regulatory Risk Analysis and Determination of Critical Areas for Certification

From the full list of gaps identified through the gap analysis, we perform a coherent grouping in the form of technical areas to perform the regulatory risk analysis using the methodology detailed in Section 2.3 and then to determine and classify the critical areas for certification for hydrogen aircraft defined as per the generic concept presented in Section 3.1.

Table 4. Critical areas for certification of hydrogen aircraft.

Critical Areas	Level of Risk
Fire and explosion prevention and protection
Crashworthiness and occupant survivability
Hydrogen fuel system for aircraft and engine
Liquid hydrogen storage system (including interaction of systems and structures, safety devices, and monitoring devices)
Impacts of hydrogen-related emissions on environmental protection
Lightning protection of tanks and systems
Effects of hydrogen and hydrogen environment on structural durability
Fuel cell (as an electrical power source)
Effects of contaminants on hydrogen storage and fuel flow
Effects of cryogenic conditions (solidification or liquefaction of other-than-hydrogen liquids or gases)
Electrical wiring and interconnection systems

presents the resulting classification of the topmost critical areas for certification and rulemaking activities, in descending order of criticality.

The conclusions of the risk assessment are based on the inputs available at the time of this study. Timely development of the knowledge data outlined in Section 3.2.5, along with advancements in understanding hydrogen systems, components, and their integration into aircraft or engines, are critical mitigation measures to address the identified risks effectively and to ensure adequate rulemaking progress.

4. Discussion and Conclusions

The study presented in this paper has systematically assessed the applicability and relevance of existing certification requirements to hydrogen aircraft and engines, identifying key gaps and areas requiring further development. In continuation of previous works on preliminary certifiability assessment, this paper represents a significant step forward in the systematic and comprehensive assessment of the relevance of European regulations for certification. The presented results serve as a cornerstone for the certification of hydrogen-powered aircraft and turbines, guiding future regulatory and standardization efforts. The conclusions are valid for the generic concept selected for this study and for large and normal-category airplanes and turbine engines. Transposition of these conclusions to other technologies or other aircraft categories (e.g., drones and vertical-take-off-and-landing aircraft) requires further investigation not performed in this work. The main hydrogen technologies that are not covered here are gaseous storage, cryo-compressed storage, and electric propulsion powertrain utilizing fuel-cell as an electrical power source. Furthermore, the analyses are performed based on the knowledge on hydrogen-related phenomenology and technologies available at the time of the study; the results may be updated as new information becomes available and when technologies mature.

The regulatory gap analysis indicates that the existing EASA CSs remain largely relevant for the certification of the considered hydrogen-powered aircraft generic concept. Many requirements are already adequate to address the threats and hazards associated with the introduction of hydrogen as an energy source for turbine engines and non-propulsive fuel cells. However, this transition presents a significant shift from conventional fossil fuel technologies, significantly affecting a substantial number of requirements. The regulatory risk analysis identified critical areas where certification approaches and requirements adapted to hydrogen characteristics, threats, and systems are needed.

The “Fire and explosion prevention and protection” critical area significantly impacts multiple paragraphs in CS-25, CS-E, and CS-23 and associated AMCs and standards. It would be advisable to initiate an overall re-evaluation of fire and explosion prevention and protection strategies accounting for hydrogen characteristics and threats and for mature mitigation means. At present, many unknowns and uncertainties exist. Thus, future research activities are needed to elaborate this certification approach to advance hydrogen fire and explosion phenomenology knowledge and to investigate viable mitigation solutions (e.g., ventilation, leak detection techniques, fire and explosion zonings redefinition, inerting systems, and fire suppression means).

For the “Crashworthiness and occupant survivability” critical area, it is proposed to re-evaluate the aircraft emergency response capabilities accounting for the location of hydrogen tanks in the fuselage, their crashworthiness performances, and the post-crash fire scenarios resulting from hydrogen fire properties. From this aircraft-level evaluation, individual requirements could then be derived for example for tanks, emergency evacuation, and emergency exits. This work should be closely linked to the “Fire and explosion prevention and protection” critical area.

The certification of the novel “Liquid hydrogen storage system” raises multiple concerns that extend beyond structural considerations. To address these challenges without conflicting with existing practices prescribed in CS-25 and CS-23, which remain applicable to all other structural elements except the tank, future work could be the definition of a standalone regulation that fully addresses this storage system including structural elements, systems, sensing and safety devices, and pressure control systems. For structural elements, this regulatory material could cover pressure loads, interaction of systems and structures, fatigue and damage tolerance, safety pressure relief systems, failure and degradation modes, aging effects, and detectability of cracks and defects possibly through advanced techniques that will require novel certification approaches.

The “Lightning protection of tanks and systems” critical area requires the development of strategies and guidelines adapted to hydrogen new technologies, possibly with new materials and assembly processes. The objective is to mitigate the effects of energy transfer from a lightning event to a hydrogen flammable atmosphere. This work is also closely linked to the “Fire and explosion prevention and protection” critical area.

Then, future research directions are clearly identified in complementing hydrogen phenomenology data, as the availability of these data is critical on the road to develop regulatory material and standards.

For future work, these findings provide a solid foundation for CRL4 activities in the CONCERTO project, which will focus on identifying guiding principles and developing a roadmap for rulemaking and standardization efforts to address the identified gaps. They also constitute a valuable set of inputs for certification authorities involved in defining safety orientations and requirements. All in all, the work performed in the CONCERTO project for these analyses, bringing together experts from European industry, research organizations, academia, and the EASA, highlights the critical need for cooperation to prevent a chicken-and-egg dilemma between development of certification criteria and advancement of hydrogen technologies.

Finally, from a methodological perspective, the research described in this paper serves as one of the first proof of concept to test and refine the Certification Readiness Level scale. The performed activities underscore the effectiveness of the initial levels of this innovative maturity scale in structuring the certifiability evaluation of a disruptive aircraft concept, despite the numerous uncertainties surrounding this concept. Iterations between CRL1, CRL2, and CRL3 activities facilitate the development of coherent findings that will mature alongside forthcoming certification readiness activities, technological advancements, and development of to-be-certified products.