By Maxime Warnier, CTO at MetSafe
The aviation industry is watching Artificial Intelligence and particularly the rise of Large Language Models (LLM) with a mix of fascination and anxiety. Since ChatGPT made conversational AI mainstream, the question is no longer whether LLMs will find their way into Air Traffic Control (ATC) environments, it is how, at what pace, and with what safeguards. The hype is loud. The operational reality is more nuanced.
Explored use cases range from controller support to briefing summarisation and post-operational analysis, always with the same ambition: let the human decide, let AI handle retrieval. It sounds compelling, but moving from demo mode to a trustworthy tool is where most projects hit a wall.
Building on MetSafe’s core expertise in delivering operational weather data via API, we wanted to bridge this gap. Through ChatMET, a SESAR-funded initiative, we built a natural language interface directly on top of our meteorological data layer. Having worked through this transition, here is what we believe the industry needs to understand.
The hallucination trap: Why naive approaches fail
The first instinct when discovering LLMs is to use them directly: ask a question, get an answer. This works for drafting or summarising, but breaks down on factual, data-critical queries.
LLMs do not retrieve information, they generate statistically plausible text from training patterns. Asked about something outside that data, they rarely say “I don’t know”; they fabricate a confident answer instead. This is hallucination, and it happens when you skip the architecture question and go straight to the model.
The picture is evolving, though. Frontier models are increasingly flagging uncertainty, and the industry is moving towards RAG (Retrieval-Augmented Generation) and agentic architectures. Here, the LLM dispatches queries to authoritative sources and reasons over the results rather than recalling facts from training. That’s the direction we validated in ChatMET.
Architecture to constrain the AI
When building LLM-based tools, the specific model you choose matters far less than the architecture you build around it.
The approach that worked for us is to constrain the LLM’s role entirely. Rather than asking the model to produce answers, you use it exclusively as a translator. It interprets the user’s natural language input and converts it into a structured, deterministic call to an authoritative data system.
This creates traceability. Every piece of information shown to the user can be traced back to a specific, auditable query against a validated source.
Any LLM integration in ATC that cannot provide this kind of end-to-end traceability should not be presenting outputs to operational users as factual. This needs to become an industry baseline, not an optional design choice.
Smaller, specialised models running on-premise are the realistic path forward
There is a natural instinct to reach for the biggest, most capable frontier models available. However, practical experience suggests that the opposite approach is often correct. A much smaller model, deployed on-premise, can match leading commercial offerings once invested in rigorous prompt engineering.
Relying on cloud-based frontier models introduces severe operational risks such as unpredictable latency, third-party dependency and compliance issues around data control. More importantly, outsourcing critical data to external providers fundamentally threatens technological sovereignty. It also creates a significant challenge when trying to certify systems. Shifting to smaller, local models resolves these hurdles while offering massive gains in hardware cost and computational efficiency.
This focus on resource management also forces a necessary reality check. We must constantly challenge AI-based solutions against traditional algorithms, which often remain far more predictable and efficient for standard operational tasks.
Trust is the prerequisite for adoption
The ATC community has rigorous traditions around system validation and change management. These traditions need to be applied to LLM components with the same discipline, even when the probabilistic nature of these models makes that harder than validating conventional software. Ultimately, whether an LLM-based tool gets adopted operationally is not about what it can do, it is whether people trust it enough to act on it.
This is where the interface becomes the whole point. The model acts as the engine, dynamically adapting the interface outside the chat window: pointing to a map, building a graph, or isolating key numbers as the situation demands. By making this visual experience entirely traceable back to original sources, we replace black-box outputs with clear, verifiable answers. In safety-critical environments, a transparent interface is what transforms an AI assistant into a trusted partner.
LLMs will play a real role in the future of ATC. But they will earn that role only if the industry approaches integration with the same rigor it applies to every other safety-critical system. The technology is ready to be useful. The question is whether we are ready to deploy it responsibly.
