When London Gatwick launched the Hidden Disabilities Sunflower programme in 2016, it solved an immediate problem with elegance. A small green-and-yellow lanyard, worn voluntarily, would signal to airport staff that a traveller might need a little more time, patience or support - without forcing the traveller to explain why. Ten years on, the symbol is recognised at 215 airports worldwide, plus 39 more in the process of joining. Lufthansa Group has committed to roll out the programme across every one of its airlines by the end of 2026. The Sunflower has become, in effect, a global standard for non-visible disability assistance.

What has not modernised at the same pace is the operational process behind it. At most airports the application flow still depends on a manual document review, a postal address, and a lanyard physically packed and posted to the applicant's home. For a programme designed to support neurodivergent travellers, travellers with chronic illness, anxiety, sensory sensitivities and a hundred other conditions, the friction of the application itself can be the largest barrier to using the scheme at all. The audience the scheme exists to serve is the audience least well-served by paper-and-post infrastructure.

The opportunity is now real and visible: a digital-first redesign of the hidden-disabilities application process, supported by AI document triage, built around Apple Wallet and Google Wallet for fulfilment, with GDPR Article 9 rigour from intake to deletion. This is what the next generation of accessibility schemes looks like.

The scale of the audience

Roughly 1.3 billion people worldwide live with some form of disability. Of those, up to 80% - over a billion individuals - have a disability that is not immediately visible. Chronic illness, mental-health conditions, sensory processing differences, autism spectrum conditions, mobility impairments that come and go. None of these are detectable on sight, and that invisibility is exactly the problem the Sunflower scheme exists to solve.

The same scale defines the operational reality for the operator. A medium-sized international airport processes between 500 and 900 applications a month for its hidden-disabilities scheme, with summer peaks pushing that figure higher. Each application carries supporting documentation - a GP letter, an autism organisation card, a clinical assessment - that has to be read, validated and decisioned by a human reviewer. None of this is high throughput in absolute terms, but it is bursty, it is sensitive, and it currently scales linearly with reviewer time.

Three structural problems with the current process

Operators running a Sunflower-style programme tend to recognise three problems immediately when they look at their own process honestly.

The first is the postal-address dependency. Most schemes deliver the physical lanyard by post, which means the application form needs a deliverable address. International travellers, transit passengers, EU residents without a local postal address - none of them can use the scheme reliably. This is not an edge case. It is a structural exclusion of exactly the cohort that benefits most from advance signalling at a foreign airport.

The second is the repeat-application burden. A family travelling three times a year submits the application three times, exposes the same medical evidence three times, and gambles on postal delivery three times. There is rarely any recognition of prior approval; the operator's customer service team handles the same case repeatedly because the architecture has no memory.

The third is the validation gap. Where a postal code or address is used to generate a discount or premium-lane code, it is often accepted with minimal validation - anything that looks like a valid string passes the form. The traveller arrives at the airport, the code does not work, and there is no feedback loop. The process appears successful but delivers nothing at the point of use. The personally identifying data has done two jobs (gate the form, generate the coupon), neither of which it is really fit for.

The digital-first redesign

Each of the three problems has a solution, and the solutions reinforce one another. The redesign has four moves.

Digital card by default

Apple Wallet and Google Wallet are now the natural fulfilment channel for any voluntary identification scheme. The US National Park Service moved its Access Pass for travellers with permanent disabilities into both wallets in 2026; the EU Digital Identity Wallet, available in every Member State by late 2026, will host an EU-wide Disability Card use case. A wallet-first design eliminates the postal dependency overnight and works for the international applicant as easily as for the local one. The physical lanyard remains available as a secondary option for travellers who prefer it; nothing the scheme provides today is taken away.

AI-supported document triage with a human in the loop‍

Supporting documentation comes in three broad shapes: GP letters with hundreds of letterhead variations, organisation-issued cards with more stable layouts, and an open-ended long tail of other clinical evidence. A layered intelligent document processing pipeline handles all three: a classifier identifies the document type, an extractor pulls the relevant fields with a confidence score, an authenticator flags potential tampering. The pipeline pre-extracts the evidence and surfaces a structured summary to a human reviewer. The AI does not decide; it prepares the decision. The reviewer's time is concentrated on the cases that need judgement, not on reading every letterhead from scratch.

Opaque codes that separate identity from entitlement‍

Where the scheme grants a premium-lane discount code or similar benefit, the code should be generated by the system - short, friendly, one-time, and crucially detached from any personal data. The applicant's postcode, address, name or date of birth should never travel downstream as the coupon. This is the design move that lets the operator give the benefit to anyone, anywhere, without leaking Article 9 health data into a third-party booking system.

Three-tier address validation with graceful degradation‍

Where the form does need an address (for any traveller who prefers a posted lanyard), the validation should fall back gracefully. A national postcode database for the home market, an international geocoding service for the next tier, and a digital-card-by-default path for everyone else. The form never hard-gates on a postcode the applicant cannot supply.

GDPR Article 9 and the design choices that make it work

The supporting documentation in a hidden-disabilities application is special-category personal data under Article 9 of the UK and EU GDPR. A GP letter or clinical assessment is health data, full stop. The design has to reflect this from intake to deletion, not retrofit it later under audit.

Three design choices do most of the work. First, lawful basis: Article 9(2)(a) explicit consent captured at form submission, with consent text drafted by the Data Protection Officer and reviewed by legal. Second, default-delete of supporting documentation post-decision: the application record itself is retained, the documents are not, and the audit trail keeps a cryptographic proof of deletion rather than the document itself. Third, field-level encryption with customer-managed keys: anyone with infrastructure access to the storage cannot read the document; only the reviewer at the moment of review, with logged just-in-time access.

The EU AI Act adds a fourth dimension. A scheme that fully auto-rejected applicants on the basis of AI confidence would step into a higher-risk category with substantial obligations. The deliberate design choice is the opposite: every decline is reviewed by a human, regardless of how confident the AI is. Auto-approval is defensible - the applicant gets the thing they applied for. Auto-rejection is not, and is architecturally absent from a well-designed scheme.

What the redesign unlocks for the operator

Three changes follow once the digital-first architecture is in place.

Reviewer effort concentrates on judgement work. The customer service team no longer reads every document from scratch. The AI surfaces a structured pre-extraction with evidence highlighting, the reviewer confirms or overrides, and the case is closed. Operational reality is that a meaningful proportion of clean cases can be auto-approved inside a conservative confidence band, with the reviewer's time directed to the ambiguous or sensitive cases that need it. The team feels augmented, not replaced - and the change-management conversation is correspondingly easier.

The scheme becomes genuinely accessible. The international applicant, the transit passenger, the traveller without an address in the operator's home country, the family applying for the third time this year - each of them gets a measurably better experience. The scheme reaches the audience it was always intended to reach.

Audit, traceability and continuous improvement become available by construction. Every application, every review, every override, every decision and every deletion is logged with timestamp, reason code and outcome. The operator finally has a dataset showing which document types are hardest to process, which reviewers are most consistent, where the scheme is being used, and how that usage is changing over time. The same data the audit needs is the same data continuous improvement needs.

The pattern transfers beyond aviation

Hidden-disabilities accessibility is not an aviation-only conversation. The Sunflower scheme is in supermarkets, rail networks, theatres, libraries and universities. Local councils are adopting it as part of disability-inclusion plans. Public-sector digital accessibility regulation is tightening - the new US Department of Justice rule under Title II of the Americans with Disabilities Act takes effect for larger public entities on 24 April 2026, requiring web and mobile content to meet WCAG 2.1 Level AA.

The same digital-first chassis - wallet-based credential, AI-supported document review, opaque codes, conservative auto-decision band with human-in-the-loop, GDPR Article 9 rigour - applies cleanly to NHS specialist schemes, transport accessibility programmes, council disability inclusion services, and any public service that today depends on a postal lanyard and a manual document review. The architecture does not care which scheme it is supporting; it cares about the design principles.

Closing

The Sunflower programme proved that a small, voluntary, discreet signal could change the experience of millions of travellers with non-visible disabilities. The architecture behind it has not kept pace - and in 2026, with digital wallets, AI-supported document processing, and the EU Digital Identity Wallet all reaching maturity at the same time, there is no longer a technical reason for it not to. The operators that move first will reach travellers the current process structurally excludes, free reviewer capacity for the cases that genuinely need human judgement and meet the GDPR and EU AI Act standards that everyone will have to meet anyway.

If you are running or planning a hidden-disabilities accessibility scheme and want to look at the architectural choices behind a digital-first redesign, the VE3 team would welcome a 30-minute conversation.