Certification
Certification with a scope you can read
A certification is only useful if a third party can tell exactly what it covers. Ours states the system, the version, the criteria, the period, and the limitations on a single record.
The certification process
From application to issued mark
Certification is a defined process with defined evidence at each stage. Nothing about it is negotiable once the scheme criteria are set.
-
Application and scoping
The applicant identifies the system, version, and use context to be certified. We confirm which scheme applies and what evidence will be required.
-
Readiness review
A gap assessment against the scheme criteria. Applicants that are not ready are told so before incurring the cost of a full assessment.
-
Assessment
Documentation review, technical testing, and control walkthroughs against every criterion in the scheme. Evidence is retained in the evidence repository.
-
Independent review
A reviewer who did not perform the assessment examines the evidence and the proposed conclusion. Certification decisions are not made by the assessment team alone.
-
Decision and issue
Certification is granted, granted with conditions, or refused. The record states which, with the scope and validity period.
-
Surveillance
Continuous monitoring runs for the life of the certificate. Material change must be disclosed; undisclosed change is grounds for withdrawal.
Governance of the scheme
Controls that make a certification defensible
- Separation of duties
- The team that assesses does not decide. The team that decides does not sell.
- No advisory conflict
- We do not certify a system whose controls we designed. Remediation advice and certification of the same system are mutually exclusive.
- Non-contingent fees
- Fees are fixed at scoping and are not contingent on the outcome.
- Published criteria
- Scheme criteria and their version history are published, so a holder cannot claim a standard that does not exist.
- Appeal route
- A defined appeal process, heard by reviewers unconnected to the original decision.
- Public register
- Issued, suspended, and withdrawn marks are recorded, so a mark can be verified rather than merely displayed.
Related
Deploy AI with confidence.
Start with an independent assessment of your highest-stakes AI system.