Certification | Clause5afe Systems

The Certification Process

Four Stages. 8–12 Weeks. Complete Certification.

Our forensic audit methodology evaluates AI systems against EU AI Act, NIST AI RMF, ISO/IEC 42001, GDPR, UNESCO, and 25+ additional sectoral and adjacent frameworks in a single, comprehensive engagement.

Stage 1

Scoping

Verify AI system identity, confirm the regulatory landscape applicable to the deployment, and validate the evidence package required for forensic audit.

Stage 2

Forensic Audit

Evaluate evidence, conduct adversarial testing, verify data governance controls, assess algorithmic transparency, and test disclosure mechanisms.

Stage 3

Finding Classification

Classify all findings as Critical, Major, or Minor. Determine certification outcome based on the severity and distribution of findings.

Stage 4

Certification & Monitoring

Issue the Clause5afe Certification Mark upon successful completion. Activate continuous monitoring and schedule periodic re-certification.

Scope of Engagement

What Certification Includes — And What It Doesn't

We certify. We do not consult. This separation is the foundation of our independence and the basis for the trust signal our certification provides.

What's Included

✓ Full four-stage independent audit
✓ Assessment against EU AI Act, NIST AI RMF, ISO/IEC 42001, GDPR, and UNESCO simultaneously
✓ Detailed Findings Report with severity classifications (Critical, Major, Minor)
✓ Certification Mark issuance upon successful completion
✓ Continuous monitoring activation
✓ Board-ready certification summary report

What's NOT Included

✗ Remediation plans or implementation guidance
✗ Consulting, advisory, or preparation services
✗ Vendor recommendations or tool selection advice
✗ Pre-certification readiness assessments
✗ Legal opinions on regulatory compliance
✗ Any form of implementation support

Complete Regulatory Coverage

30+ Frameworks. One Certification.

The Clause 5 Framework™ maps simultaneously across every major AI regulation, governance standard, adjacent compliance requirement, and industry-specific rule. One engagement. Comprehensive coverage.

AI-Specific Regulations

Binding and voluntary AI regulations from major jurisdictions worldwide.

EU AI Act — Full high-risk requirements
NIST AI RMF — U.S. federal framework
Executive Order 14110 — U.S. AI policy
UK AI Principles — Pro-innovation approach
Canada AIDA — Bill C-27 framework
China ARR — Algorithmic recommendations
Brazil PL 2338/2023 — AI risk classification
Singapore MAIGF — Model AI governance

AI Governance Frameworks

International standards and consensus frameworks for responsible AI.

ISO/IEC 42001 — AI management systems
ISO/IEC 23894 — AI risk management
ISO/IEC 22989 — AI concepts & terminology
UNESCO AI Ethics — Global recommendation
OECD AI Principles — 42-country consensus
IEEE P7000 Series — Ethics standards (7000, 7001, 7002, 7003, 7010)
Partnership on AI — Industry best practices

Adjacent Compliance Standards

Data protection, security, privacy, and quality standards that intersect with AI governance.

GDPR — EU data protection (incl. Article 22)
ISO/IEC 27001 — Information security management
ISO/IEC 27701 — Privacy information management
SOC 2 — Service organization controls
ISO 9001 — Quality management systems

Industry-Specific Regulations

Sectoral requirements across financial services, healthcare, automotive, aviation, and employment.

SR 11-7 — Federal Reserve model risk management
EBA ML/Big Data Guidelines — EU banking
SEC Predictive Data Analytics — U.S. securities
FDA AI/ML Guidance — Medical devices & GMLP
EU MDR/IVDR — Medical device regulation
UN R155/R156 — Automotive cybersecurity & OTA
EASA AI Roadmap — Aviation certification
EEOC AI Guidance — Employment discrimination
NYC Local Law 144 — Automated employment tools

One engagement. Every framework that applies to your AI system. Our scoping process identifies which frameworks apply based on your deployment, jurisdiction, industry, and use case — then certifies against all applicable requirements simultaneously.

Ongoing Compliance

Re-Certification & Remediation

AI systems evolve. Certifications must keep pace. High-risk systems require annual re-certification. Standard systems require re-certification every two years maximum.

Re-Certification Schedule

→ High-Risk AI: Annual re-certification required (healthcare diagnostics, credit scoring, hiring algorithms, critical infrastructure)
→ Standard AI: Re-certification every 2 years maximum
→ Fee: 50–75% of original certification fee

Remediation Re-Assessment

→ Within 90 days: 10% of original fee — fastest, most cost-effective path
→ 91 days – 6 months: 25–35% of original fee
→ Beyond 6 months: 50–75% — original baseline is stale

AI Governance Certification