The cyber threat to aviation

About this document

This report is part of a series of cyber threat assessments focused on Canada’s critical infrastructure. It is intended for leaders in the aviation sector, cybersecurity professionals with aviation infrastructure to protect, and the general reader with an interest in the aviation sector’s cyber security. For guidance on technical mitigation of these threats, contact the Canadian Centre for Cyber Security (the Cyber Centre).

This assessment is Unclassified//TLP:CLEAR. TLP:CLEAR is used when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information, see Traffic Light Protocol.

Contact

For follow-up questions or issues, contact the Cyber Centre by email at contact@cyber.gc.ca.

Assessment base and methodology

The key judgements in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgements are based on the knowledge and expertise in cyber security of the Cyber Centre. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly”, “likely”, and “very likely” to convey probability.

The assessments and analysis are based on information available as of May 31, 2026.

Estimative language

The chart below matches estimative language with appropriate percentages. these percentages are not derived via statistical analysis, but are based on logic, available information, prior judgements, and methods that increase the accuracy of estimates.

Long description - Estimative language chart

• 1 to 9% Almost no chance
• 10 to 24% Very unlikely/very improbable
• 25 to 39% Unlikely/improbable
• 40 to 59% Roughly even chance
• 60 to 74% Likely/probably
• 75 to 89% Very likely/very probable
• 90 to 99% Almost certainly

Key judgements

• We assess that medium- and high-sophistication threat actors will very likely continue exploiting the aviation sector’s digital supply chains to access client networks. Cyber threat actors use supply chain compromises to exploit trusted supplier relationships to bypass security controls, evade detection, and to gain access to multiple customer organizations through the compromise of a single supplier.
• We assess that financially motivated cybercriminals are the most likely cyber threat to affect aviation. Airports and airlines are attractive targets because they operate high-consequence systems that affect traveller safety and hold large volumes of sensitive personal and business information. We assess that ransomware will almost certainly continue to be the most likely disruptive cyber threat to affect Canadian aviation organizations.
• We assess that non-state cyber threat actors (hacktivists) will almost certainly continue targeting the Canadian aviation sector. Hacktivist activity often correlates with periods of heightened geopolitical tension and leverages low-sophistication, high‑visibility tactics such as distributed denial‑of‑service (DDoS) attacks and website defacement. A growing number of non-state actors are actively targeting and attempting to disrupt internet-connected operational technology systems (OT), including those used at Canadian airports.
• We assess that state-sponsored cyber threat actors are very likely targeting critical infrastructure networks in Canada and allied countries to pre-position for possible future disruptive or destructive cyber operations. We assess that there is an even chance that state-sponsored actors have developed pre-positioned access to Canadian airport systems, such as air traffic control networks. We assess that state-sponsored cyber threat actors would likely only intentionally disrupt Canadian aviation infrastructure during periods of heightened geopolitical tension, crisis, or open conflict between states.
• We assess that state-sponsored cyber actors are likely to target Canada’s airports, airlines, and associated logistics networks for espionage, with a focus on bulk data collection and monitoring of individuals and sensitive supply chains to advance their national strategic objectives.

Introduction

Canada’s aviation sector is a critical pillar of national infrastructure, underpinning Canada’s economic prosperity and enabling national and global connectivity. Canada’s aviation sector connects geographically dispersed communities, enables international trade, and serves as a key gateway for global tourism.^{Footnote 1} At the core of this system is NAV CANADA, which manages more than 18 million square kilometres of Canadian and North Atlantic airspace and directs air traffic through an extensive network of area control centres across the country.^{Footnote 2} The aviation sector’s economic impact is significant. In 2024 alone, airports across Canada supported 435,800 jobs, generated CAD 32.9 billion in wages, contributed CAD 49.6 billion to gross domestic product (GDP), and drove a total of CAD 123.5 billion in economic output.^{Footnote 3}

The aviation sector’s cyber security is only as strong as its weakest digital link. The sector is a highly interconnected ecosystem of airlines, airports, air traffic control, and third‑party providers, presenting a broad and complex attack surface spanning both ground infrastructure and airborne operations. Disruptions within this system can quickly create cascading logistical bottlenecks, allowing a single cyber incident to escalate into widespread operational impacts, resulting in flight cancellations, significant financial losses, and diminished public trust.

Digitalization in the aviation sector broadens the attack surface

The aviation sector is undergoing digital transformation to improve efficiency and keep pace with global travel demand, which is expected to more than double from 2025 levels by 2050.^{Footnote 4} This evolution is driving greater connectivity and data generation as modern technologies are increasingly integrated with legacy systems and operational technology (OT), enhancing safety, productivity, and decision-making across operations. While increased connectivity enables real-time data sharing, better coordination, and stronger situational awareness, it also expands the aviation sector’s cyber threat surface. As a result, aviation systems are becoming more exposed to cyber threats, increasing the risk of incidents with significant operational, economic, public safety, and national security impacts.

Artificial intelligence (AI) is a key technology being used to support the aviation sector’s digital transformation, enabling organizations to automate processes, improve decision-making, and extract operational insights at scale. Across the sector, AI is being used to optimize flight and ground crew operations, modernize maintenance practices, and enhance the passenger experience (see Annex for examples). However, as AI becomes increasingly embedded in critical aviation functions, it expands the sector’s reliance on digital systems and data transfer within and between aviation organizations and service providers, creating new opportunities for cyber threat actors to disrupt operations, compromise systems, or manipulate data.

Digitalized systems across the passenger journey

Long description - Digitalized systems across the passenger journey

A cross-sectional floor plan of an airport, with digitalized system service points labelled. Digitalized processes are found at these points: Public Wi-Fi, Baggage handling systems, Airline kiosks, Flight information displays, Security screening, Boarding systems, and In-flight entertainment systems.

The passenger journey illustrates the extent of aviation’s digital dependence. From ticket booking and check-in kiosks to OT systems including baggage handling and gate controls, each stage relies on interconnected digital technologies. Some airports are also adopting biometric solutions; for example, Vancouver International Airport’s (YVR) Digital ID program enables eligible travellers on select flights to use facial recognition for security screening and boarding without presenting physical identification or boarding passes.^{Footnote 5}

In-flight operations depend on digital flight management systems, air traffic control, and connected services such as in-flight entertainment, while gate operations and baggage claim continue the digital chain upon arrival.

Digital dependencies and the threat to third-party service providers

The aviation sector relies on an interconnected network of third-party service providers for key functions, expanding its attack surface beyond any single organization. We assess that medium- and high-sophistication threat actors will very likely continue exploiting the aviation sector’s digital supply chains to access client networks. Cyber threat actors use supply chain compromises to exploit trusted supplier relationships to bypass security controls, evade detection, and to gain access to multiple customer organizations through the compromise of a single supplier.

Supplier relationships that involve remote access to client networks or continuous data exchange further increase opportunities for compromise; this includes cloud and managed service providers, software-as-a-service platforms, and vendors supporting digitally integrated OT systems.^{Footnote 6} For example, in October 2025, cyber threat actors compromised a widely used cloud‑based service provider for airports, gaining access to public address systems at airports in Windsor, Kelowna, and Victoria. The actors were able to broadcast unauthorized political messages and briefly delay flights in Kelowna. No operational impacts were reported at the other locations. An airport in Harrisburg, Pennsylvania, was also affected, demonstrating how threat actors can exploit access to a single supplier to affect multiple client organizations.^{Footnote 7}

The impacts of cyber compromise or disruption affecting suppliers are amplified when the supplier provides critical digital services to a large proportion of organizations across industries, or to a large proportion of organizations within a particular sector. This risk was illustrated in July 2024, when a faulty update to CrowdStrike’s Falcon software caused widespread Windows system failures affecting aviation operations internationally. Delta Airlines alone cancelled over 7,000 flights, affecting approximately 1.4 million passengers.^{Footnote 8} While not the result of cyber threat activity, the incident demonstrates how disruptions to widely used suppliers can rapidly translate into significant operational, economic, and public impacts.

Positioning, navigation, and timing (PNT) signal interference

We assess that it is unlikely that civilian aviation operations within Canada will be intentionally disrupted by positioning, navigation, and timing (PNT) interference over the next two years. PNT services, including Global Navigation Satellite Systems (GNSS), enable precise navigation and timing but are vulnerable to interference that can degrade both the availability and integrity of PNT data. Techniques such as jamming, where satellite signals are blocked or overwhelmed, and spoofing, where false positioning data is transmitted, can disrupt air operations by degrading situational awareness. This increases the potential for navigation errors, airspace incursions, and, in extreme cases, collisions.^{Footnote 9}

There has been a notable increase in internationally reported PNT interference incidents affecting civilian aviation operations in recent years.^{Footnote 10} Some reported incidents are likely incidental effects of military electronic warfare measures. In 2024, Transport Canada issued an alert highlighting a significant rise in GPS/GNSS interference, particularly in and around conflict zones.^{Footnote 11} Similarly, the International Civil Aviation Organization (ICAO) has warned that PNT disruptions are increasing in frequency, intensity, and sophistication. ICAO attributes these disruptions to both state and non-state actors. It also notes that affected systems may not fully recover during flight, increasing operational complexity and workload for flight crews and air traffic controllers.^{Footnote 12} Notwithstanding these global trends, the Cyber Centre is unaware of any intentional PNT interference within Canada to date that has resulted in impacts to aviation operations or safety.

Generative AI is enhancing social engineering attacks

Cyber threat actors are using generative AI (GenAI) capabilities in social-engineering attacks to more convincingly deceive targets into disclosing sensitive information, authorizing fraudulent transactions, or interacting with malicious links or files.^{Footnote 13} GenAI allows threat actors to create text, audio, and visual content, including deepfakes that convincingly impersonate trusted individuals. For example, AI-enabled voice phishing (“vishing”) uses voice cloning technology to replicate an individual’s voice using only brief audio samples. Threat actors use these capabilities to conduct highly realistic scam calls, posing as banks, government agencies, or technical support personnel to convince victims to share credentials or authorize payments to attacker-controlled accounts.^{Footnote 14}

Cybercriminal groups such as Scattered Spider have used these techniques to impersonate employees or executives to convince help desk staff to reset passwords or multi-factor authentication (MFA) settings, allowing them to access corporate networks.^{Footnote 15} Once inside, Scattered Spider steals sensitive data for extortion or deploys ransomware. The Canadian Centre for Cyber Security and partners issued a joint advisory in June 2025 alerting the aviation industry about Scattered Spider's targeting of airlines and their third-party information technology (IT) providers following similar incidents impacting Qantas Airlines, WestJet, Hawaiian Airlines, and Air France-KLM.^{Footnote 16}

The threat from cybercriminals

We assess that financially motivated cybercriminals are the most likely cyber threat to affect the aviation sector. Airports and airlines are attractive targets because they operate high-consequence systems that affect the continuity and safety of aviation operations and hold large volumes of sensitive personal and business information, including passports and travel documents. Stolen information can be sold on the dark web or used for fraud and identity theft. The aviation sector is an attractive target for extortion by ransomware actors because the sector is perceived as being willing to pay large ransoms to avoid disruptions to critical operations that may lead to flight delays or cancellations, financial loss, or reputational damage. Most cybercriminal activity against the aviation sector is almost certainly opportunistic, driven by actors’ ability to obtain network access rather than deliberate targeting of aviation organizations.^{Footnote 17}

We assess that cybercrime-as-a-service (CaaS) has almost certainly lowered the technical barriers to engaging in cybercrime and reduces the time, expertise, and resources required for conducting cybercriminal activity. Cybercriminals use CaaS markets to purchase access to compromised networks, ready-to-use malicious tools, and other specialized services and infrastructure.^{Footnote 13}

Ransomware is the most likely disruptive threat to the aviation sector

We judge that ransomware will continue to be the disruptive cyber threat most likely to affect Canadian aviation organizations. Ransomware actors constantly refine their tactics and extortion methods to maximize profit. In the aviation sector, ransomware incidents can disrupt flight operations, passenger processing, baggage handling, and other critical services by restricting access to essential data, business systems, and OT systems. Many ransomware incidents now pair encryption with data theft, increasing pressure on victims through threats to sell or release stolen files.^{Footnote 18}

Recent incidents demonstrate how quickly ransomware can translate into operational disruption. In September 2025, a ransomware attack affecting Collins Aerospace’s Multi-User System Environment (MUSE), which supports airport check-in and boarding gate functions, disrupted major European hubs, including the Heathrow, Berlin Brandenburg, Brussels, and Dublin airports. Automated systems became inoperable, causing widespread delays and cancellations. Gate agents manually verified passenger information, wrote baggage tags, and coordinated gate changes using two-way radios.^{Footnote 20}

The threat from non-state actors

We assess that non-state cyber threat actors (hacktivists) will almost certainly continue targeting the Canadian aviation sector. Hacktivist activity often correlates with periods of heightened geopolitical tension and leverages low-sophistication, high‑visibility tactics like distributed denial‑of‑service (DDoS) attacks and website defacement. Some non-state actors are motivated by a mix of patriotism, ideology, or a political cause, but others opportunistically take advantage of conflicts for personal benefit or notoriety.^{Footnote 13} The impacts of non-state cyber threat activity like DDoS attacks are typically localized and short-lived.

A growing number of non-state actors are targeting and attempting to disrupt Internet-connected OT systems in Canada.^{Footnote 21} Non-state activity against OT systems is largely opportunistic based on the actor’s ability to discover vulnerable devices regardless of the organization or sector the device relates to. Non-state activity against Internet-connect OT systems may cause operational disruption and, in some cases, create dangerous conditions that implicate operator or public safety. Non-state actors frequently lack the expertise to understand the systems they access and often make exaggerated claims about the importance and nature of the system they have compromised and the effect they were able to achieve.

In October 2025, for example, pro-Hamas actors gained access to an Internet-connected supervisory fuel tank gauging system at a Canadian airport. The group claimed responsibility for the compromise in a Telegram post and provided screenshots as proof. The posts claimed the group's malware "remained active in the system" and cited Canada's "support for the Israeli entity" as motivation for the attack. Investigation into the incident revealed that the actor was able to view system information but could not interact with or control the system.^{Footnote 22}

The threat from state-sponsored actors

The importance of Canada’s airports and airlines to the nation’s economy and overall global connectivity make the aviation sector a high-value target for state-sponsored cyber threat activity. State-sponsored cyber threat actors operating on behalf of nation-states primarily use cyber threat activity to advance their geopolitical objectives. Some are capable of highly sophisticated threat activity that can be difficult to detect and attribute and can maintain persistence within compromised environments for years before being detected.^{Footnote 17} State-sponsored threat actors have targeted the aviation sector as an avenue to conduct espionage, pre-position for potential disruption, project power against adversaries, and threaten commercial and military supply chains. State-sponsored actors are increasingly targeting dual-use technologies that underpin both civilian and military activities, increasing the risk that cyber threat activity aimed at accomplishing military objectives will implicate civilian infrastructure and operations.^{Footnote 24}

Pre-positioning for possible future disruptive or destructive cyber operations:

We assess that state-sponsored cyber threat actors are very likely targeting critical infrastructure networks in Canada and allied countries to pre-position for possible future disruptive or destructive cyber operations. We assess that there is an even chance that state-sponsored actors have developed pre-positioned access to Canadian airport systems, such as air traffic control networks, for this purpose. We assess that state-sponsored cyber threat actors would likely only intentionally disrupt Canadian aviation infrastructure during periods of heightened geopolitical tension, crisis, or open conflict between states.

The early stages of pre-positioning often resemble espionage. While pre-positioning, state-sponsored actors maintain persistent access to target networks and conduct network reconnaissance to identify critical assets and vulnerabilities that could be exploited to degrade or disrupt their target. The 2024 compromise of Germany’s air traffic control authority, Deutsche Flugsicherung (DFS), illustrates how pre-positioning activity may appear in practice. German authorities attributed the compromise of DFS to Russian military cyber threat actors as part of an ongoing cyber espionage and hybrid warfare campaign against European critical infrastructure. Although the cyber threat actors compromised DFS’s business and administration systems rather than operational systems such as radar or flight routing, the information from those networks would allow the actors to better understand systems, personnel, and processes in a way that supports offensive cyber capability development for future disruptive activity.^{Footnote 25}

In February 2024, the Cyber Centre and international partners issued a joint advisory warning of activity by People’s Republic of China (PRC) state-sponsored cyber group Volt Typhoon. The advisory assessed with high confidence that Volt Typhoon had compromised and maintained access to U.S. critical infrastructure, including transportation networks, to pre-position capabilities that could enable the disruption of OT functions across multiple sectors in the event of conflict.^{Footnote 26}

We assess that the direct threat to Canada’s critical infrastructure from PRC state-sponsored cyber actors is likely lower than the threat to U.S. infrastructure. However, given the high degree of interconnection between the U.S. and Canadian aviation sectors, disruptive cyber threat activity against U.S. civil aviation may have implications for Canada. For example, a disruptive cyber attack against U.S. civil aviation may result in cross-border flight delays or cancellations or require U.S. flights to be diverted to Canadian airports. Additionally, a cyberattack on a U.S. system that Canadian aviation depends on could directly disrupt operations in Canada. The extent to which any cyber attack against the U.S. aviation sector would affect Canada will vary based on specifics of the attack and the nature of the affected organizations, systems, or services.^{Footnote 27}

Espionage for strategic advantage

We assess that state-sponsored cyber actors are likely to target Canada’s airports, airlines, and associated logistics networks for espionage, with a focus on bulk data collection and monitoring of individuals and sensitive supply chains to advance their national strategic objectives. Airports and airline systems handle continuous, high-volume passenger and cargo flows, making them uniquely valuable sources of aggregated travel and shipment data. Access to these systems enables state-sponsored actors to conduct pattern-of-life analysis and track high-profile travellers and diaspora members or activist groups in Canada. For example, a 2020 FBI advisory described a long-running malware campaign linked to Iran’s Ministry of Intelligence and Security (MOIS) that compromised several global airlines. This access enabled the tracking of individuals of interest to the Iranian state across more than 30 countries.^{Footnote 28}

We assess that state-sponsored actors are likely to exploit access to civilian airport and logistics systems to collect intelligence on military supply chains, including flight activity, cargo, refueling logistics, and ground support infrastructure. In May 2025, the Cyber Centre and international partners issued an advisory on Russian state-sponsored cyber threat activity targeting Western logistics and IT companies, particularly those involved in delivering foreign assistance to Ukraine.^{Footnote 29} These actors sought access to detailed shipment data and used Internet-connected cameras, including those at airports, to monitor aid movements.

Supply chain exploitation and state influence

We assess that state-sponsored actors will almost certainly continue to leverage suppliers within their jurisdiction to collect information on, or to compromise, the supplier’s client organizations. Some nation states have legal and regulatory authority to compel vendor cooperation in national security and intelligence operations.^{Footnote 30}

Concerns surrounding foreign-manufactured surveillance technologies highlight how digital infrastructure can be leveraged to advance foreign state interests, including through surveillance, intelligence collection, unauthorized data transfer, and interference with critical systems and communications. For example, starting in 2021, Hikvision, a partially state-owned Chinese manufacturer of civilian and military surveillance equipment, came under scrutiny after 140 cameras at Rome’s Fiumicino Airport were observed making approximately 11,000 unauthorized connection attempts per hour to a server in China, raising significant national security concerns and prompting stricter scrutiny of foreign-made surveillance equipment globally.^{Footnote 31}

Outlook

The cyber security of Canada’s commercial aviation sector is essential to both national security and economic resilience. As a critical means of domestic and international connection, the aviation sector is an attractive target for cyber threat actors motivated by financial gain and ideological or geopolitical objectives.

Financially-motivated cybercrime continues to be the most likely cyber threat to affect aviation organizations. However, increasing global competition and conflict is contributing to more situations in which ideologically motivated non-state actors or state-sponsored cyber threat actors may intend to target Canadian aviation organizations for espionage or disruption.

Many cyber threats can be mitigated through awareness and best practices in cyber security and business continuity. The Cyber Centre encourages all critical infrastructure network owners to take appropriate measures to protect systems against the cyber threats detailed in this assessment.

Please refer to the following online resources for more information and for useful advice and guidance.

Supply chains:

• The cyber threat from supply chains
• Cyber supply chain security for small and medium-sized organizations (ITSAP.00.070)
• Joint guidance on supply chain risks and mitigations for artificial intelligence and machine learning

Critical infrastructure:

• Cross-sector cyber security readiness goals toolkit
• Security considerations for critical infrastructure (ITSAP.10.100)

Operational technology:

• Protect your operational technology (ITSAP.00.051)
• Cyber threat bulletin: Cyber threat to operational technology
• Cyber Centre advice on securing operational technology systems

Artificial intelligence:

• Frontier artificial intelligence (ITSAP.10.050)
• Generative artificial intelligence (ITSAP.00.041)
• Top 10 artificial intelligence security actions: A primer (ITSAP.10.049)

Cyber threats/TTPs:

• Defending against distributed denial of service attacks (ITSM.80.110)
• Ransomware playbook (ITSM.00.099)
• What is voice phishing (vishing)? (ITSAP.00.102)
• Protecting your organization while using Wi-Fi (ITSAP.80.009)

Incident management:

• Developing your incident response plan (ITSAP.40.003)
• Developing your business continuity plan (ITSAP.10.005)

Annex - Airport AI applications

Airports and airlines are increasingly adopting AI, machine learning, and automation to manage growing passenger volumes and operational complexity. By shifting from reactive to predictive operations, these technologies help reduce delays, improve aircraft turnaround times, and minimize human error.

Passenger processing

• Traditional manual process: Manual document verification at check-in desks and gates, and physical boarding passes.
• Autonomous integration: Facial recognition and smart gates replace manual processes for check-in, immigration, and boarding.
• Real-world implementation: Dubai International Airport's Smart Gates are automated immigration gates that use facial recognition and biometric technology to verify identity. Singapore Changi Airport and some United States airports have fully implemented similar technology.

Baggage handling

• Traditional manual process: Labour-intensive sorting and manual transport via carts or tugs.
• Autonomous integration: AI-powered conveyor systems and autonomous vehicles track and sort bags with minimal human touch.
• Real-world implementation: Kansai International Airport in Japan has begun implementing autonomous tractors for baggage transport.

Baggage screening

• Traditional manual process: Physical screening of all luggage and manual behaviour observation.
• Autonomous integration: Automated screening lanes and computer vision analyze footage and scans in real time to flag threats.
• Real-world implementation: CT scanners with AI-driven threat detection are eliminating the security checkpoint requirement of removing laptops and liquids, cutting screening queue times at airports across the EU and the United States.

Flight delay mitigation

• Traditional manual process: Manual monitoring, use of historical averages, and reactive responses to disruptions.
• Autonomous integration: By synthesizing live data from sources like weather systems, crew availability, and fleet status, AI enables operations teams to anticipate delays earlier. Predictive models help teams intervene proactively, adjusting plans before disruptions ripple through the network.
• Real-world implementation: United Airlines uses AI-driven forecasting to analyze severe weather in real time, enabling airlines to proactively adjust flight paths, delay departures, or reroute aircraft before disruptions intensify.

Ground support and maintenance

• Traditional manual process: Human-piloted tugs and manual inspections of aircraft systems.
• Autonomous integration: Autonomous ground operations such as self-driving tugs and fuelling systems speed up turnarounds. AI diagnostics also help predict mechanical failures.
• Real-world implementation: Indira Gandhi International Airport launched Unified Total Airside Management, an AI-enabled system to manage airside operations, including real-time monitoring of aircraft movement and ground support equipment.

Resource allocation

• Traditional manual process: Decisions relied heavily on human judgment and predefined rules, which limited the ability to quickly rebalance crews, gates, or airport capacity when constraints or disruptions arose.
• Autonomous integration: AI‑enabled systems streamline crew scheduling by automating pairings, reassignments, and post‑flight administrative work, improving operational speed and regulatory compliance. These tools factor in live crew availability, rest requirements, and operational constraints to optimize assignments.
• Real-world implementation: Air India leverages Microsoft Copilot to apply AI based data analysis directly within its operational workflows. Operations teams can quickly interrogate live data using natural language to identify performance gaps and make timely adjustments, with consolidated insights spanning fleet availability, crew scheduling, and airport capacity constraints. Japan Airlines uses an AI-powered mobile app to help cabin crews generate post-flight incident reports, even in low-connectivity environments.

Gate assignment

• Traditional manual process: A largely manual, rules‑driven approach handled by operations teams using fixed schedules, with minimal capacity to adjust to delays or real‑time congestion.
• Autonomous integration: AI-driven gate-planning systems analyze arrival patterns, aircraft characteristics, and real-time congestion to assign gates more efficiently, reducing taxi times, fuel consumption, and passenger delays.
• Real-world implementation: American Airlines uses AI-powered gate-management technology built on Microsoft Azure to dynamically assign the optimal gate for arriving aircraft, helping reduce delays.