Status: DRAFT

Future certification: independence and oversight

This proposal explores how a future Charter assessment scheme could keep rulemaking, assessment and oversight independent. For the distinction between commitments, evaluation and certification, start with the Trust & Accountability overview.

This is a future-state model, not a scheme that exists today, and the phased steps below are proposals — not work that is underway or scheduled. No pilot evaluations have been run; there is no Trust Mark, certificate, accredited assessor, or certification body. The current work is drafting and building connections.

Separate roles and accountable authority

The proposed separation of powers is intended to prevent an operator, assessor, funder or standard-setter from controlling its own assessment. Independence would need evidence: how roles are appointed, whose interests they represent, what they may decide, how conflicts are managed, and how affected people can challenge decisions. A diagram of separate roles does not by itself establish legitimate authority.

Four proposed roles and their precedents

1. Standard-setter — writes the rules. (ISO/IEC; FSC; Fairtrade International; the IFCN Code of Principles.)
2. Certifier / audit body — audits a system against the standard; independent of the audited party. (FLOCERT for Fairtrade; IFCN's region-matched external assessors.)
3. Accreditor — accredits and polices the certifiers; can suspend them. (National accreditation bodies; IOAS, which both accredits and suspends organic certifiers.)
4. Peer-review of accreditors — keeps accreditors honest and mutually recognised worldwide. (The IAF, peer-evaluating accreditation bodies against ISO/IEC 17011.)

Accreditation and peer review offer ways to scrutinise assessors and their overseers. Their scope, independence and effectiveness would need to be established for any future Charter scheme; these precedents do not mean that it is already accredited or recognised.

For AI, this is already emerging — and it's thin

The EU AI Act includes "notified bodies" — independent third parties designated by member states — for some high-risk-AI conformity assessments. Article 43 is category-specific: many Annex III high-risk systems use internal-control conformity assessment without a notified body, while biometrics and product-law systems can require or involve third-party assessment in specified cases. General-purpose AI providers have separate documentation, copyright-policy, training-summary, systemic-risk, incident-reporting, and cybersecurity obligations. Transparency rules also create duties around AI involvement, generated-content marking or labelling, and related user-facing disclosures where relevant. The structure exists in law, but it does not create a single international information-integrity baseline for every AI system a buyer or user may rely on.

The assurance stack: provider-declared legal scope, common baseline, public-interest modules

State regulation sets enforceable duties, rights, supervisory powers, and sanctions inside each jurisdiction. The EU AI Act is one such legal floor for systems, roles, and markets within its scope. But legal floors are not uniform internationally. A voluntary mark cannot replace law, weaken it, or certify legal compliance across every jurisdiction.

Certification would be useful for a different job if it is structured as a three-layer assurance stack:

1. Provider-declared legal scope (the legal floor). The assessed release declares its markets, role in the value chain, use-case, risk category, domain regimes, and required legal artefacts. The Charter complements legal regimes by making scope, evidence, limitations, and public-interest modules inspectable; it does not certify legal compliance, provide legal advice, replace a notified body, override a regulator, or grant market-entry permission. The evaluator or future assessor checks that the public claim is limited to the declared scope and records missing, disputed, or out-of-scope legal artefacts as limitations. Regulators, courts, notified bodies, domain certification bodies, and the provider's own legal assessment decide legal compliance.
2. Common Charter baseline. The five public obligations become operational duties that can be checked consistently across jurisdictions. Stricter local law prevails; weaker or silent local law does not lower the baseline.
3. Public-interest modules. Additional modules test the Charter's distinctive concerns beyond ordinary compliance — factual grounding, contestability, coercive-control transparency, AI-app security, privacy and provenance, fairness, resource and public-access impacts, and the other public-interest module candidates set out in the Charter Commitments. Modules are optional only where the risk is not material to the assessed release. A module marked not assessed does not waive baseline duties, and a full Charter alignment claim cannot omit material modules.

A builder or deployer could then say, "we have declared the legal scope for this assessed release, we accept the common Charter baseline, and an independent assessor can test which modules we meet in operation."

This avoids three common traps: pretending a voluntary mark is legal approval, treating a management-system certificate as product assurance, or using a narrow factuality test as if it covered the whole risk surface.

For this charter, the auditable evidence should answer — as testable evidence, not just disclosure — the seven practical questions the Charter Commitments frame in full:

• What is it for? — assessed version, intended/prohibited uses, affected groups, limits, risk context.
• Who controls it? — operator, models, data, tools, dependencies, and any update, restriction, or shutdown power.
• What data and rights does it depend on? — training, retrieval, adaptation, and evaluation sources, rights basis, opt-outs, privacy treatment, licensed restrictions, and unresolved provenance gaps.
• Who is accountable? — the named owner, jurisdiction, and support route that answers for it.
• How can people challenge it? — notice, error-flagging, appeal of consequential decisions, and remedy.
• Who can inspect it? — what is public, what assessors see confidentially, and what lawful oversight can require.
• Can its claims and failures be checked? — claims, incidents, disparate failures, and corrections traceable to evidence.

A future baseline must not become a narrow "factuality badge" that ignores the rest of the real risk surface. At minimum, the common baseline needs to make the risks in the Risk and Vulnerability Audit inspectable: concentration and lock-in, coercive control, factual unreliability, AI-app security, privacy and provenance, bias and discrimination, harmful misuse, opaque consequential decisions, lifecycle drift, resource/global-access asymmetry, false legal-compliance claims, and evidence theatre.

That means an audit should not merely test outputs. It should require a documented risk and vulnerability register and a privacy-preserving release risk assessment, published before a public claim and kept current for the release — its required fields and the assurance-depth labels (documented, evidence observed, implementation checked, effectiveness tested, or not assessed) are defined in the Charter Commitments (operational duty 3). The audit checks that the public assessment covers the required risk areas, matches the confidential evidence pack, and keeps protected evidence — raw user data, secrets, exploit details — out of the public summary.

ISO/IEC 42001 is useful here as a management-system reference because it requires a living system for AI governance and risk management. ISO/IEC 42005 is useful for impact assessment. ISO/IEC 42006 is useful because it sets expectations for bodies auditing and certifying AI management systems. None of those, by itself, proves that a specific public release's factual claims are grounded, that affected people can challenge harms, or that coercive control interventions are reviewable. Those are Charter module questions.

People competence is a separate assurance object

System or release assurance does not by itself establish a portable claim that the people operating, overseeing, assessing, or reviewing it are competent across contexts. It may provide bounded evidence of how an assigned person performs a defined role in that deployment. The current consolidated EU AI Act requires providers and deployers to take measures that support the development of AI literacy among people dealing with AI on their behalf, while expressly not requiring a guaranteed specific level for any individual (Article 4); for high-risk systems, deployers must assign human oversight to people with the necessary competence, training, authority, and support (Article 26). ISO/IEC 17024:2026 addresses certification of persons against defined competence requirements; it is distinct from management-system certification and from assurance of a particular AI release.

A defined scenario exercise can provide bounded evidence of how a person performs when evidence is incomplete, scope changes, and organisational pressure is present; the validity, scoring consistency, and transferability of that evidence still need to be established. DAIGI's CAGL pathway is one current example of the simulation direction: as checked on 2026-09-10, its public programme and accreditation pages describe simulation-based, capability-gated training, credentials issued directly by DAIGI, and mapping to the EU AI Act, ISO/IEC 42001, and the NIST AI RMF. This illustrates why five claims must remain separate: course completed; credential authentic; curriculum framework-aligned; competence independently assessed; the relevant personnel-certification scheme or credential is within an external accreditation scope. None alone establishes the others. DAIGI is cited as a public example only; no affiliation, partnership, endorsement, accreditation, independent validation, or programme-quality judgment is claimed.

The Charter should not become a training provider or personnel-certification body. Its narrower role is to state which consequential roles require competence, authority, independence, and support; what evidence may substantiate those properties; and where a live exercise should observe whether the role performs as claimed. A system evaluation may record that bounded observation, but it should not silently turn it into a portable personal credential.

The practical proposal — lean, phased, not a mega-authority

• Phase 1 (the proposed first step, not yet underway): a published method, then — if it proceeds — independent pilot evaluators, public evaluation reports, and a public report index. No mark, certificate, accredited assessor, or certification claim. Today only the method and drafts exist.
• Phase 2 only if demand appears: a small standard steward, hosted in or accountable to an existing neutral body, maintains the standard, mark rules, and public registry — and audits no one itself. Capture-resistant governance: multi-stakeholder board, capped influence for those bound by or helping write the rules, and two-assessor plus academic re-evaluation for contested cases. (Models: IFCN/Poynter, GOTS, Creative Commons.)
• Independent accredited assessors (ML + domain + regional expertise) would do the audits — independent of both vendor and steward.
• Ride the accreditation infrastructure that already exists (ISO/IEC 17065 + national accreditation bodies + IAF) instead of reinventing "who checks the auditors," once the scheme is mature enough to justify it.
• Inclusion built in: tiered (free self-assessment → audited mark), hardship waivers, a solidarity fund — so small and Global-South builders aren't priced out.
• Funding diversified — never dominated by logo/audit fees (the conflict that has eroded some eco-labels).
• Teeth from demand, not a police force: procurement preference, platform requirements, and alignment with legal duties where applicable. In Phase 1, a buyer can require the evidence baseline; in Phase 2, it could require the mark. (In web security, browsers enforce trust by distrusting bad certificate authorities — the demand side is the enforcer.)

How it resists authoritarian switch-off or manipulation

No voluntary mark can stop a state, court, platform, or infrastructure provider from exercising power. The certification job is narrower and practical: make material control powers visible before reliance, require logs for restrictions and shutdowns, require lawful-basis and scope records, require review routes where available, and require continuity or exit planning for public-interest use. A system should not be able to claim the Charter while hiding who can bend it, silence it, or withdraw it. If a material control intervention cannot be disclosed publicly and cannot be independently reviewed under confidentiality or lawful oversight, the affected scope should lose the pilot listing or future mark claim.

Who could drive this?

Existing initiatives illustrate several possible stewardship arrangements: - A mission-driven NGO stewards it — Reporters Without Borders drove the Journalism Trust Initiative; Poynter runs the IFCN code; Fairtrade International and FSC are dedicated nonprofits. - A neutral host incubates it — the Linux Foundation hosts OpenSSF and open-model work; OASIS hosts the Coalition for Secure AI; CEN hosted JTI's standard. A host can provide legal and administrative support; neutrality would depend on its governance and conflicts of interest. - A multi-stakeholder coalition runs it — the CA/Browser Forum (browsers + certificate authorities); the AI Alliance; the Digital Public Goods Alliance. - A public anchor can lend context or convening legitimacy — UNESCO, the Council of Europe, or relevant EU assurance structures, without implying endorsement, legal approval, or that the Charter certifies legal compliance.

These examples illustrate different functions: information-integrity assessment, standards stewardship, technical measurement and public-interest representation. RSF convened JTI and CEN published it as CWA 17493; Poynter hosts IFCN; the Linux Foundation consolidated existing open-source-security efforts into OpenSSF; and OASIS hosts CoSAI. They are references, not prospective-partner commitments or endorsements. No host or coalition is established by this proposal. Any future selection would need published criteria, a clear mandate and conflict-of-interest safeguards.

Where the Charter is applied to public AI infrastructure, legal form is secondary to stewardship. A credible host or steward should let partners inspect evidence, challenge claims, participate in governance, and support the work only under disclosed, capped, conflict-managed funding rules. Model operation, standard-setting, evaluation, accreditation, and funding decisions should be institutionally separate or strongly firewalled; the steward maintains the standard and registry, but does not audit or operate the infrastructure itself.

How would it be financed?

Diversify funding and limit any one funder's influence. Dependence on a single funder or on passing audits creates a risk of capture. Funding sources, caps and safeguards would need to be disclosed and tested against the scheme's actual incentives.

The working mix: - Public-interest seed funding to bootstrap (Germany's Sovereign Tech Fund; the EU/UNESCO-backed Journalism Trust Initiative). - Tiered, capped fees that can't crowd out the rest (ISO certification, B Corp). - Cross-subsidy, hardship waivers, and a solidarity fund so small and Global-South builders aren't priced out (Fairtrade; IFCN waivers down to $0). - Diversified, durable revenue — the Wikimedia mix of many small donors, an endowment, and enterprise income.

Firewall: funders disclosed; no funder sets the criteria; the steward's budget is independent of any audited party's fees. Grant funding carries the cheap early phase; the costly accreditation layer arrives only with Phase 2 demand (see The practical proposal above).

(Funding figures here are illustrative — verify before citing; they shift year to year.)

What it is deliberately NOT

• Not a new central authority that "owns" trustworthy AI.
• Not self-certification (the thing that discredits weak schemes).
• Not pay-to-pass — assessor independence and accreditation are non-negotiable.
• Not legal approval — the Charter can require a legal-scope map, but regulators, notified bodies, courts, and domain laws still decide legal compliance.
• Not finished — a model to build and contest, not a body that exists today.

The honest part

A certification scheme would need a legitimate mandate, independent scrutiny, participation by affected people and effective challenge and remedy. Published rules, a public registry and a revocation history would make its decisions inspectable; they would not, on their own, establish legitimacy or effectiveness.

One incentive question remains open — raised by Angelo Richiello in the public discussion of the runtime-governance article: the rules above remove the reward for passing (outcome-independent fees, no pay-to-pass, diversified funding), but nothing yet rewards questioning or stopping. Where speed and deployment keep paying while a justified stop pays no one, oversight can drift from real to symbolic even with cleanly separated roles — and, as the same discussion noted, formal incentives rarely reward constructive dissent, so making responsible challenge count as a recognised contribution is organisational culture as much as scheme design. Candidate directions, none adopted here yet: reviewer compensation independent of throughput and verdict; protected escalation routes; and demand-side consequences that make a justified stop valuable to those relying on the mark (the demand-side enforcement above).

Public discussion record

The dated reply below concerns personnel credentials, a separate question from assurance of an AI release. It is retained as a publication record; its source checks describe July 2026, not a current accreditation assessment.

Published reply and sources — 27 July 2026

The following reply was published on LinkedIn on 2026-07-27 in Andrew Woodward's hardware-rooted audit-trail discussion, replying to his proposal to train people who already hold relevant credentials. It is mirrored verbatim:

Andrew Woodward Yes—the personnel-certification framework exists, distinct from management-system certification. ISO/IEC 17024 governs bodies certifying people under schemes that specify competence requirements.

ISACA's AAIA follows your existing-titles logic: an active CISA, or an active designation from ISACA's closed audit/accountancy list plus an IT-audit or IT-advisory role focus. No experience-only route.

Current ANAB ISO/IEC 17024 scopes include AI credentials: CompTIA's DataAI and SecAI+, and SISA's CSPAI. So the standard does not categorically exclude AI credentials. The audit-side gap here is AAIA, absent from ISACA's current ANAB scope; separately, IAPP's handbook says AIGP is not ANAB-accredited. That is ANAB-specific, not worldwide.

Competence is only half. A review regime also needs published decision criteria and an applicable challenge route. Your example shows the distinction: the coder can cite public CMS rules, while a beneficiary can appeal an appealable coverage or payment determination.

A small group can start the function. My model still does not reward justified questioning or stopping.

https://robertschaub.github.io/our-ai-charter/Assurance/Framework/certification-model/

Primary-source check, 2026-07-27: ISO/IEC 17024:2026, AAIA's current eligibility rules, the current ANAB scopes for CompTIA, SISA, ISACA, and IAPP, IAPP's Candidate Handbook v5.3.2, and CMS's Original Medicare appeals guidance. The comment's negative accreditation statements are deliberately ANAB-specific.

---

Sources: ISO/IEC 17065; ISO/IEC 42001, ISO/IEC 42005, and ISO/IEC 42006; the IAF (International Accreditation Forum); EU AI Act Art. 43 (conformity assessment and notified-body routes), Art. 53 (GPAI provider obligations), and Art. 55 (GPAI systemic-risk obligations); and certification, standards, and public-interest analogues including Fairtrade/FLOCERT, GOTS/IOAS, IFCN/Poynter, EFCSN, JTI and CWA 17493, OpenSSF/Linux Foundation, OASIS/CoSAI, DPGA, MLCommons AILuminate, AI Alliance Trusted Evals, and Current AI.