Boeing's ODA and the 737 MAX - How the FAA Lets Industry Police Itself

The FAA is ultimately responsible for certifying that commercial aircraft are safe to fly - but for large manufacturers like Boeing, much of the actual certification work is performed by Boeing’s own engineers acting on the FAA’s behalf. This system, called the Organization Designation Authorization (ODA), became the center of the most consequential regulatory debate in modern aviation history after two Boeing 737 MAX crashes killed 346 people in 2018 and 2019.

What Is the FAA’s ODA System?

The FAA employs roughly 45,000 people. Boeing employs roughly 150,000. Airbus employs another 130,000. There is no version of the FAA that has enough engineers, test pilots, and inspectors to personally certify every component, every line of flight control software, and every structural calculation in a modern transport category aircraft.

Under the ODA framework, certain companies are authorized to designate their own qualified employees to perform certification functions on behalf of the agency. Those employees - called ODA unit members - work for Boeing, Cessna, Bell, or whoever holds the authorization. But in their certification role, they are supposed to act as independent technical evaluators, not company advocates.

Every major aviation regulatory body in the world operates some version of this model. The European Union Aviation Safety Agency (EASA) has its own delegation framework. So does the UK Civil Aviation Authority. The question every regulator faces is the same: how do you oversee an industry that is technically more sophisticated than the agency regulating it? Delegation is the universal answer.

How the 737 MAX Exposed a Structural Flaw

Boeing developed the 737 MAX as an update to the 737 Next Generation, with a key selling point being that pilots transitioning from the NG would need minimal additional training. To accommodate larger, more fuel-efficient CFM LEAP engines on a 50-year-old airframe without triggering extensive recertification, Boeing repositioned the engines further forward and higher on the wing - which gave the MAX a tendency to pitch up at certain angles of attack.

To compensate, Boeing developed the Maneuvering Characteristics Augmentation System (MCAS), designed to automatically push the nose down in specific conditions. MCAS was certified through Boeing’s ODA. But the system’s authority and scope changed significantly during development, and those changes were not fully communicated to FAA engineers outside the ODA unit.

The version of MCAS that flew on production aircraft could command nose-down trim based on input from a single angle-of-attack sensor - with no redundancy - and could command far more nose-down input than had been disclosed early in the certification process.

The Crashes and the Grounding

On October 29, 2018, Lion Air Flight 610 departed Jakarta and crashed into the Java Sea 13 minutes after takeoff. All 189 people aboard were killed.

Boeing issued a bulletin. The FAA issued an emergency airworthiness directive. Airlines were given existing emergency procedures for a runaway trim situation. The response treated it as a known-procedure event.

On March 10, 2019, Ethiopian Airlines Flight 302 departed Addis Ababa and crashed near Bishoftu six minutes after takeoff. All 157 people aboard were killed.

The 737 MAX was grounded globally. Individual aviation authorities acted before the FAA, which initially maintained the aircraft was airworthy before reversing course under extraordinary pressure. The grounding lasted 20 months - the longest in FAA history.

What the Investigation Found

Congressional investigations, internal FAA audits, and the Joint Authorities Technical Review (2019) identified a fundamental structural failure. Boeing’s ODA unit had become so integrated into Boeing’s product development process - so aligned with schedule and commercial pressures - that it was no longer functioning as an independent certification body.

This is not a criticism of individual engineers. It is a description of what happens when the people designated to act on behalf of the FAA are, in practice, employees whose careers depend on the same program they are certifying. Independence is harder to maintain than the org chart suggests.

The pattern is familiar from accident reports across aviation history: normalization of deviation, institutional get-there-itis, and checks that exist on paper but are compromised in practice.

What Changed After the Grounding

The 737 MAX returned to service in November 2020 after extensive modifications. MCAS was redesigned to use inputs from both angle-of-attack sensors. Nose-down authority was limited. The system can now be overridden by the flight crew. Training requirements were updated, and airlines received simulator time for MAX transitions.

Boeing’s ODA authority was restructured before it was restored. The FAA significantly increased its direct oversight, requiring granular FAA involvement at specific certification decision points rather than high-level reviews. ODA unit members gained formalized channels to escalate concerns directly to the FAA without going through Boeing management. Congress provided funding for additional FAA certification engineers.

Boeing made internal changes as well - establishing a safety organization with reporting lines separate from program management, and revising compensation structures to reduce incentives that could conflict with safety reporting.

What This Means for Pilots Flying the MAX Today

Boeing’s ODA authority for the 737 MAX program is currently operational, and deliveries of new MAX aircraft are proceeding. FAA oversight operates at a level of intensity that would not have been recognizable before the grounding.

The MAX 10 and MAX 7 completed their certification programs under the new oversight regime, with FAA engineers far more directly involved than during the original MAX certification. The 737 MAX currently flies with Southwest, American, United, Ryanair, Air Canada, and carriers around the world - including aviation authorities in countries with no interest in giving Boeing favorable treatment.

The ODA system is not going away. There is no realistic alternative at the scale of modern aviation. What the MAX situation forced was a confrontation with how that system can fail - and produced reforms that are, at least structurally, substantive. Whether the cultural change inside Boeing has kept pace with the structural change remains a harder question, and one that former Boeing engineers and FAA veterans continue to debate publicly.

For pilots, the 737 MAX story is ultimately the same story accident reports have always told: procedure and checklist exist because humans in organizations under pressure make predictable errors. Independent oversight is not bureaucratic friction. It is the mechanism that catches what internal pressure conceals.

Key Takeaways

The FAA’s ODA system allows manufacturers like Boeing to designate their own engineers to perform certification functions - a necessary accommodation given the FAA cannot match the technical scale of the industry it regulates.
MCAS was certified through Boeing’s ODA with inadequate disclosure of its expanded authority and single-sensor dependency - a structural failure of independent oversight, not a deliberate decision to build a dangerous aircraft.
The 346 deaths across Lion Air 610 and Ethiopian 302 triggered the longest grounding in FAA history (20 months) and a comprehensive overhaul of Boeing’s ODA relationship with the FAA.
Post-grounding reforms include dual-sensor MCAS, direct FAA involvement at certification decision points, protected escalation channels for ODA unit members, and revised Boeing internal safety structures.
The current 737 MAX reflects one of the most scrutinized certification processes in commercial aviation history - but independent observers continue to monitor whether structural reforms have produced lasting cultural change inside the manufacturer.