Rapid Prototyping vs Certified Production: What Actually Scales

By early 2026, Zipline's aircraft had flown more than 125 million autonomous commercial miles and completed over two million deliveries across Rwanda, Ghana, Japan, and a growing list of U.S. cities, with zero serious injuries on record. That is not a demo statistic. It is years of production aircraft doing the same job, over and over, under the same documented process, at a scale a hand-built prototype could never survive a single week of. Getting to that number required something most prototype teams never have to prove: that a factory can keep producing the same aircraft, with the same reliability, long after the engineers who built the first one have moved on to the next program.

That gap between an aircraft proving it works once and a factory proving it can keep producing it, flight after flight, year after year, is where most UAS programs actually stall, and it has very little to do with how good the aircraft is.

A prototype and a production aircraft can share every line of the same CAD file and still be answering completely different questions. A prototype exists to answer "does this design work," as cheaply and quickly as iteration allows. A production aircraft exists to answer a harder question: "can this exact design be built again, by someone else, with the same result, every time." Those two goals pull against each other constantly, because the fastest way to learn whether a design works is to change it freely, and the only way to prove it can be built the same way twice is to stop changing it.

Scaling a UAS program is usually described as an engineering problem, a better airframe, a smarter autopilot, a longer-endurance battery. In practice, the harder problem waiting on the other side of a good prototype is rarely engineering at all. It is manufacturing discipline: locking a design, documenting every part back to its source, and proving to a regulator, an insurer, or a customer's own quality team that the aircraft rolling off the line today is the same aircraft that passed every test months ago.

You can imagine them as two different jobs wearing the same job title. A prototyping team optimizes for the speed of learning: swap a motor, reprint a bracket, change a wiring harness overnight, because every iteration that fails fast and cheap is iteration the team does not pay for later. A production team optimizes for the opposite: repeatability. The same bracket, from the same qualified supplier, built to the same drawing, inspected the same way, indefinitely, because the value of a production line is that unit four thousand behaves exactly like unit one.

Those two goals are not just different, they are in direct tension. A prototyping team's best instinct, change whatever isn't working, is a production team's worst nightmare, because every unapproved change breaks the paper trail that proves the aircraft in the field still matches the aircraft that was tested and certified. A production team's best instinct, lock it down and stop touching it, is exactly what would have strangled the prototype in its crib, back when it needed to change every week to find out what actually worked.

The transition between those two modes has a name: design freeze. At a design freeze, a program commits to a specific bill of materials, a specific set of drawings and tolerances, and a specific supplier for every part, and stops treating any of it as negotiable without a formal engineering change process. Before the freeze, swapping a motor supplier because a better one showed up is routine, barely worth a second thought. After the freeze, the same swap triggers a documented change review, because every unit built after that point has to trace back to a single, fixed specification, not whichever parts happened to be on the bench that week.

Part traceability is what that freeze actually buys. A prototype build typically uses whatever components are available, often off-the-shelf parts ordered in small batches with no requirement to track which specific lot ended up in which aircraft. A certified production aircraft needs the opposite: every structurally or functionally significant part documented back to its source, its lot, and often its specific manufacturing batch, so that if a defect turns up in the field, the program can identify exactly which other units might share it, rather than grounding an entire fleet on a guess. This is the same redundancy logic this series has returned to since the constraint chapter, just applied to the supply chain instead of the airframe: a single untraceable part is a single point of failure in the paper trail, even if the part itself never fails.

That qualification requirement has gotten sharper recently, in both directions. A 2024 U.S. federal acquisition rule now bars federal purchases of drones and drone components from certain foreign manufacturers, and by 2026 China's own export controls on drone components were disrupting European manufacturers' supply chains in the opposite direction. A supplier qualified and locked into a frozen design today can become a regulatory liability within a single product cycle, independent of whether the part itself ever changes.

Quality management systems formalize that discipline rather than leaving it to good intentions. AS9100, the aerospace industry's standard quality management framework, builds on the general manufacturing standard ISO 9001 with aerospace-specific requirements around traceability, risk management, and configuration control. A shop certified to AS9100 is not being evaluated on whether it can build one excellent part. It is being evaluated on whether its documented process will keep producing a consistent part after the engineer who wrote the process has moved to a different project. That distinction, process reliability rather than a single good result, is exactly the gap between a prototype and production.

The FAA's own certification structure mirrors the same split, as a matter of regulation rather than any single company's story. A Type Certificate confirms that a specific design meets the relevant airworthiness standards. A separate Production Certificate confirms something else entirely: that the applicant's manufacturing facility and quality system can reliably reproduce that exact certified design at scale. Matternet's M2 delivery drone became the first non-military aircraft to hold both, its Type Certificate arriving in September 2022 and its Production Certificate following two months later, which is simply formal recognition that building one working aircraft and being able to manufacture it repeatably get evaluated, and certified, as two separate achievements. An aircraft can pass the first and still have no path to the second if its own manufacturing process cannot prove it builds the same thing twice.

Europe runs the same split under a different name. For UAS in EASA's Certified category, the highest-risk tier that covers operations like passenger-carrying air taxis, design approval and production approval are handled as separate processes too, a Type Certificate for the design itself and a Production Organisation Approval for the facility building it, rather than one combined sign-off. The vocabulary differs from the FAA's, but the underlying question a manufacturer has to answer twice, once for the design and once for the factory, is the same on both sides of the Atlantic.

The uncomfortable part is that the skills a team needs to build a great prototype are not the skills it needs to scale one, and the two are not just different, they can actively work against each other inside the same organization. An engineering culture built around moving fast, skipping documentation that slows down the next iteration, treating the bill of materials as a living suggestion rather than a contract, is exactly the culture that produces a brilliant demo aircraft and then struggles for a year to get that same aircraft through a production certificate, because nobody was tracking the paper trail a regulator would eventually ask for.

This is not an argument that prototyping teams are undisciplined. Speed and documentation genuinely trade off in the early stages, and a program that runs full configuration control from day one usually just prototypes more slowly without learning anything faster for it. The actual failure mode is not skipping discipline early. It is treating the design freeze as a formality to rush through at the end, instead of a deliberate transition with its own planning and often its own team.

That handoff is also where a lot of promising UAS startups actually die, not in the air, but in the gap between a working demo and a factory that can reproduce it under an audit. An elegant, high-performing prototype can turn out to depend on a supplier who will not commit to a multi-year contract, or a tolerance that was fine for one hand-built unit but drifts out of spec on the fiftieth off a real production line. None of that shows up in a flight test. It shows up the first time someone builds the aircraft without the original prototyping team standing next to it.

Pharmaceutical manufacturing runs through the identical split, just with a different name for it. A drug that works perfectly when a research lab formulates a small batch by hand does not get approved to sell on that result alone. A regulator also requires process validation, documented proof that the manufacturing process itself, run at commercial scale in a real factory, reliably produces a product with the same purity and potency as the version that passed clinical trials. A lab that can make one excellent batch and a factory that can make the ten-thousandth identical batch are proving two different things, and pharmaceutical companies have spent decades learning the second is often harder than discovering the drug itself. UAS manufacturers are relearning the same lesson, with airframes and avionics standing in for compounds and dosages.

A flying prototype and a certifiable production aircraft answer different questions, and scaling a UAS program is usually a manufacturing and documentation problem wearing an engineering disguise.

• A prototype optimizes for fast iteration; a production aircraft optimizes for repeatability, and those two goals actively work against each other
• Design freeze locks a specific bill of materials and tolerances, replacing informal changes with a documented engineering change process
• Part traceability back to source and lot is what lets a field defect be traced to specific units instead of grounding an entire fleet
• Quality management systems like AS9100 evaluate whether a documented process stays reliable, not whether one unit came out well
• The FAA's separate Type Certificate and Production Certificate, first both held by Matternet's M2, formalize the exact same split between a working design and a reproducible one

The next post in this chapter looks at what happens once a UAS program stops being a single aircraft at all, and starts being a fleet that has to coordinate, rather than just scale in number.

Curious to exchange some ideas? Reach out via the contact form or connect on Linkedin!