AI can choose which image to downlink, detect an equipment anomaly or rank a possible conjunction. It cannot change orbital mechanics, grant spectrum rights or turn an uncertain collision message into an authorised manoeuvre.
The safe pattern is sense → infer → constrain → authorise → command → confirm. Every automated function needs a mission boundary, independent limits, evidence for degraded conditions and a known safe mode.
The source and rule review for this guide was current to 31 July 2026. UK licensing depends on the activity, operator, location and applicable Act. The Civil Aviation Authority regulates orbital and other spaceflight activities under the Space Industry Act 2018 and Outer Space Act 1986 routes; Ofcom spectrum and Earth-station permissions are separate. International obligations, launch-state, export-control, national-security, data and contractual requirements may also apply. Discuss a novel mission with the relevant authorities early.
Split “Space AI” Into Distinct Decisions
A cloud model that labels satellite images and flight software that commands an actuator are not the same risk class.
| Use case | AI may support | Authority that stays outside the model | Core evidence |
|---|---|---|---|
| Mission planning | Schedule payload, downlink and power use | Licensed mission rules, spacecraft constraints and operations lead | Ephemeris, power, thermal, storage, contacts and mission priorities |
| Onboard autonomy | Detect events and select a bounded response | Independent flight limits, command authentication and safe mode | Hardware-in-loop, fault injection and in-orbit telemetry |
| Conjunction support | Rank alerts and compare manoeuvre options | Operator decision, counterpart coordination and licence obligations | Track covariance, screening messages, propulsion and mission geometry |
| Earth observation | Detect or estimate features from imagery | Product owner, domain expert and downstream decision process | Sensor metadata, ground truth, coverage and uncertainty |
| Predictive maintenance | Prioritise engineering investigation | Engineering disposition and change control | Telemetry quality, known faults and subsystem context |
| Astronomy | Find candidates in large scientific datasets | Reproducible analysis and independent scientific confirmation | Calibrated instruments, selection function and follow-up |
For every output, preserve the input issue time, spacecraft and payload identity, reference frame, model and software versions, confidence, applicable mission mode, recommendation, authorised decision and actual outcome.
The government’s orbital-operation rules overview, reviewed in July 2026, maps CAA licensing, legislation, liability, spectrum and technical requirements. A licence application can require technical, radio-frequency, financial and national-security evidence. An AI prototype is one component of that system, not a substitute for the route.
Define the Autonomous Function as a State Machine
“The satellite decides” is not an assurance argument. List states, permitted transitions and the authority for each command.
A bounded imaging example might allow the model to:
- classify whether cloud obscures a target;
- choose among pre-approved targets inside a time window;
- adjust compression within a verified range;
- defer low-value data when storage is constrained; and
- request, but not execute, a new attitude profile.
It should not silently alter orbit, disable protection, rewrite its own limits or install an unapproved model.
Specify:
- mission phase and orbital region;
- sensors, calibration status and valid ranges;
- processor, memory, power and thermal budgets;
- maximum command rate and actuator envelope;
- ground-contact assumptions and communications loss;
- radiation upset, clock and position failure behaviour;
- safe mode and independent entry triggers;
- prohibited actions; and
- how configuration is authenticated and rolled back.
Test the compiled flight configuration on representative hardware. Use unit, software-in-loop, processor-in-loop and hardware-in-loop evidence, then end-to-end mission rehearsals. Inject corrupted sensor frames, stale ephemerides, unavailable ground stations, memory pressure, processor resets and contradictory subsystem flags.
The CAA’s current CAP2210 orbital-operator guidance was issued in its third edition in March 2026 and includes model licence terms, conditions and reporting requirements. Build configuration control and incident evidence so the operator can meet the actual licence, not a generic launch checklist.
Make Safe Mode Independent and Boring
The minimum-risk state should preserve power, thermal control, communications and attitude within the mission’s design. It must remain reachable if the AI process crashes, consumes excessive resources or produces an invalid command.
Use independent checks for command syntax, spacecraft state, time, magnitude, rate and conflict. A watchdog should be able to stop and restart the autonomy function without relying on it. Keep deterministic safing logic small enough to analyse and test.
Practise:
- model unavailable while the spacecraft is healthy;
- sensor or telemetry stale;
- autonomy output outside the current mode;
- ground contact missed;
- multiple subsystem alarms;
- update rejected or only partly installed; and
- ground command conflicts with an onboard proposal.
Measure safe-mode entry success, time to stable telemetry, false safing, recovery time and operator workload. Do not optimise these events away to improve availability statistics.
For aviation systems operating below orbital space, our AI aviation safety guide covers the distinct CAA and air-traffic context.
Treat Conjunction Alerts as Probabilistic Evidence
Conjunction data can change as observations improve. A close-approach distance without covariance, epoch and source is not enough to make a manoeuvre decision.
The decision record should contain:
- screening source and message versions;
- object identities and uncertainty;
- time of closest approach and reference frame;
- collision probability and sensitivity to assumptions;
- tracking quality and expected updates;
- manoeuvre options, propulsion and attitude constraints;
- effect on payload, ground contacts and later conjunctions;
- coordination attempts with the other operator; and
- final decision and post-event reconstruction.
AI may cluster messages, flag inconsistent identities or compare approved options. It must preserve source uncertainty and never suppress a high-consequence alert because a classifier considers it “probably routine”.
ESA’s Space Environment Statistics page identifies its tenth environment report as released in May 2026 and provides a dated view of tracked objects and modelled debris. The important operational lesson is not one headline count: tracked catalogues are incomplete and orbital debris management is a lifecycle responsibility.
The CAA’s end-of-life guidance requires an end-of-life plan in orbital licence applications and, at this cutoff, provides temporary conditions for applications submitted after 31 January 2026. Verify which licence terms apply to the mission. Preserve disposal fuel, passivation functions and ground capability; do not spend the margin merely because an optimiser finds more payload opportunities.
Ground Earth-Observation Claims
Satellite imagery is a measurement shaped by sensor, orbit, angle, atmosphere, processing and time. A model turns that measurement into an inference.
Create a product card:
| Field | What to publish |
|---|---|
| Observation | Sensor, band, resolution, acquisition time, geometry and processing level |
| Coverage | Geography, season, cloud, revisit and missing-data policy |
| Target | Exact class or quantity and operational definition |
| Ground truth | Source, date, sampling method, accuracy and independence |
| Performance | Per-class and per-region errors, calibration and minimum detectable feature |
| Limitations | Conditions, places and decisions for which the output is not validated |
| Provenance | Model, training data, licence, human review and correction history |
Split evaluation by geography and acquisition date. Random image tiles from one scene create leakage. Test different landscapes, seasons, sensors and processing baselines. Report missed events and false alarms per meaningful area or decision, not only pixel accuracy.
Use field, administrative or trusted reference evidence that matches the target. A “flood extent” label from another automated product is not independent validation. Keep an unresolved class for cloud, shadow, mixed pixels and unfamiliar terrain.
The UK Space Agency’s Earth Observation collection explains the measurement role of optical, radar, altimeter and atmospheric instruments. The government’s geospatial ethics guidance adds questions about confidentiality, bias, inclusion and responsible presentation. Apply those controls when an EO product can affect communities, property or enforcement.
Do not infer an identifiable person’s activity, a protected characteristic or wrongdoing from location patterns without a specific lawful and validated route. Aggregate or reduce resolution when the decision does not need individual detail. Our UK AI privacy guide covers the wider assessment.
Keep Astronomy Reproducible
Anomaly detection can surface unusual transients or spectra, but it also surfaces calibration errors, cosmic rays, processing changes and selection bias.
Version raw and calibrated data, pipeline, catalogue and model. Publish the selection function: which objects could have been found under which observing conditions. Hold out complete observing runs or sky regions, and follow candidates with independent instruments or methods.
Report candidate yield, confirmed discoveries, known-object recovery, false positives and review time. Do not call a cluster a new class until the scientific evidence supports that interpretation. Preserve negative and ambiguous follow-up so the next model is not trained only on exciting examples.
Secure the Ground-to-Space Chain
The attack surface includes supplier code, build systems, mission planning, ground stations, cloud processing, radio links, credentials and the spacecraft. Establish an asset and trust-boundary map; sign software and model artefacts; separate development from commanding; use least privilege and dual control for consequential commands; monitor anomalies; and retain offline recovery.
NCSC secure design principles organise controls around context, making compromise and disruption difficult, detecting compromise and reducing its impact. Apply them through the full mission and supplier lifecycle.
Test replayed telemetry, spoofed time or position, corrupted model files, unauthorised schedule changes and unavailable cloud services. The spacecraft must reject an invalid command and the operator must be able to reconstruct what happened. See our AI cybersecurity guide for response design.
Set Measurable Release Gates
Release a named function in a named mission mode only when:
| Gate | Minimum release evidence |
|---|---|
| Regulatory map | CAA Act/licence route, licence conditions, Ofcom spectrum and other mission obligations owned and current |
| Autonomy boundary | States, permitted transitions, command envelope, prohibited actions and independent checks documented |
| Verification | Software, processor and hardware-in-loop suites pass all critical nominal and injected-fault scenarios |
| Safe mode | Every tested model, sensor, power, memory and communications failure reaches the defined safe state |
| Conjunction support | Source uncertainty preserved; no critical message suppressed; manoeuvre authority and coordination rehearsed |
| EO validity | Geographic/time holdouts pass pre-agreed class, miss, false-alert and calibration thresholds |
| End of life | Disposal, passivation, fuel margin, communications and applicable licence evidence protected |
| Cyber | Signed builds, command authority, ground separation, logging, response and known-good recovery demonstrated |
| Human operations | Workload, alerts, escalation, handover and incident reporting pass end-to-end rehearsals |
| Change control | Model/data/software changes cannot reach flight or production without impact review and rollback |
Monitor invalid-command rejections, safe-mode events, resource margin, missed contacts, operator interventions, conjunction alert changes, EO drift by region and season, scientific confirmation rate, cyber alerts and end-of-life margin. Pause when the system leaves its validated state or an independent protection is unavailable.
Space AI is valuable when it spends scarce bandwidth and attention well. Its credibility comes from restraint: a bounded command, a reproducible inference, a preserved uncertainty and a spacecraft that remains safe when the clever component stops.
