The fast answer: AI safety certification means an independent body tests an AI product against a published scheme and issues a result that anyone can verify. Three ingredients carry it: a test scheme written down before the testing starts, an assessor with no stake in the outcome, and a public record of the result. Take away any one of them and you are back to a company vouching for its own product.

That definition is older than AI. It is how the electrical cord on your desk earned its safety mark and how a medical device reaches a hospital in Europe. What is new is applying it to software that writes its own answers, changes when the model is retrained, and can be talked into misbehaving by a determined user. The rest of this guide covers where certification comes from, what the EU AI Act actually requires, which standards define the process, and how RateAI's A.E.G.I.S.™ framework turns AI safety into a rating a buyer, insurer or parent can read.

Why AI safety claims need independent testing

Almost every AI product launch now comes with a safety claim. "Built with guardrails." "Responsible by design." "Enterprise-grade safety." These phrases may be true. The problem is that the reader has no way to check them, and the company making the claim is the same company that profits from you believing it.

Physical products solved this problem a long time ago. In the United States, the Occupational Safety and Health Administration runs a Nationally Recognized Testing Laboratory (NRTL) program that recognizes private sector organizations to certify products against electrical safety test standards. Each recognized lab uses its own registered mark, and that mark signifies that the lab tested and certified the product. Nobody asks a toaster manufacturer to grade its own wiring.

The European Union built the same logic into product law, and its AI Act now extends it to AI. Medical devices and toys are both on the list of product laws in Annex I of the AI Act, which means AI built into those products inherits their existing conformity assessment routes.

AI makes the case for independent testing stronger, for three practical reasons:

• Behavior is probabilistic. The same prompt can produce different answers. A single demo proves very little; you need a large, repeatable battery of tests to see how a system behaves on average and at the edges.
• Systems change after launch. Models are retrained, prompts are rewritten, and new tools are connected. A safety result from six months ago may describe a different system.
• Failures are adversarial. Many harmful outputs only appear when someone is actively trying to provoke them. Testing has to include people and tools whose job is to break the system.

The NIST AI Risk Management Framework says much the same thing in its own language. Its Measure function notes that "processes for independent review can improve the effectiveness of testing and can mitigate internal biases," and subcategory MEASURE 1.3 calls for internal experts who were not front-line developers of the system, independent assessors, or both, to be involved in regular assessments and updates.

What certification actually means

"Certification" gets used loosely, so it helps to anchor it in the international standard written for the job. ISO/IEC 17065 sets out the requirements for bodies certifying products, processes and services. As ANSI's accreditation board summarizes it, the overall aim of certifying products, processes or services is to give confidence to all interested parties, and certification bodies are expected to operate certification schemes in a competent, consistent and impartial manner.

Those three words map neatly onto what a buyer should look for in any AI safety certificate:

Competent

The assessor has to understand the technology well enough to test it properly. For AI that means knowing how jailbreaks work, how models hallucinate, and how personal data leaks out of a chat window, and building tests that actually probe those failure modes.

Consistent

Two systems tested under the same scheme should be measured the same way, and the same system tested twice should get a comparable result. Without consistency, a rating is an opinion.

Impartial

The assessor must not benefit from a particular outcome. A certification everyone passes is worth nothing, because it no longer separates safe products from unsafe ones.

It also helps to keep three related ideas apart, because they often get blurred:

• Self-assessment: the developer tests its own system and reports the result. Useful internally, weak as evidence to outsiders.
• Audit of a management system: an auditor checks whether the organization has the right processes for governing AI. This is what an ISO/IEC 42001 certificate covers (more on that below). It says a lot about the company and less about any single product's behavior.
• Product certification: an independent body tests a specific product against a specific scheme and issues a result for that product. This is the closest analogue to the safety mark on an appliance.

All three have a place. Product certification is the one that tells a buyer how this particular chatbot, agent or AI toy behaves when it is pushed.

What the EU AI Act says about conformity assessment

The EU AI Act (Regulation (EU) 2024/1689) is the most detailed law yet on how AI systems should be checked before they reach the market. Its approach is called conformity assessment, and the vocabulary is worth knowing precisely. The definitions below are taken from Article 3 as published on the European Commission's AI Act Service Desk.

• Conformity assessment means "the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled."
• Conformity assessment body means "a body that performs third-party conformity assessment activities, including testing, certification and inspection."
• Notified body means a conformity assessment body notified in accordance with the AI Act and other relevant Union harmonisation legislation.
• CE marking is the marking by which a provider indicates that an AI system is in conformity with the Chapter III, Section 2 requirements and other applicable Union harmonisation legislation.

Which route applies

The route a high-risk system takes depends on what kind of system it is. Article 43 sets this out:

1. Biometric systems (Annex III, point 1): the provider chooses between internal control under Annex VI or an assessment of its quality management system and technical documentation with the involvement of a notified body under Annex VII. The notified body route becomes mandatory where harmonised standards do not exist, where the provider has applied them only in part, or where a standard was published with a restriction.
2. Other stand-alone high-risk systems (Annex III, points 2 to 8): the provider follows the internal control procedure in Annex VI, which does not provide for the involvement of a notified body.
3. AI inside regulated products (Annex I, Section A): the provider follows the conformity assessment procedure already required by that product's own Union harmonisation legislation, such as the rules for medical devices or toys.

Under Article 6(1), AI that is a safety component of an Annex I product, or is itself such a product, counts as high-risk where that product is required to undergo a third-party conformity assessment. And Article 43(4) adds that a high-risk system must undergo a new conformity assessment in the event of a substantial modification. In other words, the law already treats safety evidence as something that expires when the system changes.

The law leaves a lot of room for self-assessment

The detail worth pausing on is point 2 above. For most stand-alone high-risk use cases listed in Annex III, the AI Act relies on the provider's own internal control. No outside body is required by the regulation itself. That is a reasonable legislative choice, but it means a buyer, insurer or regulator reviewing one of those systems often sees only the provider's own paperwork. Voluntary independent testing is how a provider can show more than the legal minimum, and how a buyer can ask for it.

Where the deadlines stand now

AI Act dates have moved. In June 2026 the Council of the EU gave its final green light to the simplification package known as Omnibus VII, following approval by the European Parliament. Under that agreement, the rules for stand-alone high-risk AI systems apply from 2 December 2027, and the rules for high-risk AI embedded in products apply from 2 August 2028. Both had originally been due to apply from 2 August 2026. The amending act, Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal of the EU. Check the current text before relying on any date, because implementation details are still being issued.

A delay is not a reason to wait. Building the evidence a conformity assessment will ask for (test results, documentation, records of how risks were found and fixed) takes time, and buyers are already asking for it in procurement.

Standards that shape AI certification

Laws say what must be demonstrated. Standards describe how. Several are directly relevant to anyone building or buying AI.

ISO/IEC 17065: the rules for certifiers

Covered above. It governs how product certification bodies themselves must operate, with impartiality and competence at its core.

ISO/IEC 42001 and ISO/IEC 42006: certifying the management system

ISO/IEC 42001 is the international standard for an AI management system (AIMS), the policies and processes an organization uses to govern its AI. Its companion, ISO/IEC 42006, was published in July 2025 and sets out the additional requirements for bodies that audit and certify AI management systems. Together they give organizations a route to certify how they govern AI. They are about the organization, which is why many companies pair a management system certificate with product-level testing.

NIST AI Risk Management Framework

The NIST AI RMF 1.0 (NIST AI 100-1) is a voluntary US framework organized around four functions: Govern, Map, Measure and Manage. The Measure function is where testing lives. Subcategory MEASURE 2.1 asks that test sets, metrics and details about the tools used during testing, evaluation, verification and validation be documented, and MEASURE 2.13 asks that the effectiveness of those metrics and processes be evaluated and documented. A good certification scheme produces exactly that kind of record.

UL 3115: a sign the market is forming

Established product safety organizations are moving into AI too. UL Solutions offers AI safety certification services under UL 3115, the Outline of Investigation for Safety of AI-Based Products. UL Solutions describes it as a structured framework to evaluate AI-based products before and during deployment, intended as a horizontal evaluation used alongside vertical product standards, and covering technical, ethical and governance dimensions. Its listed example applications range from AI-based fault detection in machinery to large language model customer service applications. The arrival of schemes like this from a long-standing product safety organization is good evidence that independent AI product certification is becoming normal practice.

What a good AI safety certification should include

Whatever scheme you use or ask a vendor for, a credible AI safety certification should be able to answer yes to each of these questions:

1. Is the scheme published? You should be able to see what is tested and how results are graded before the test begins.
2. Is the scope explicit? Which agents, which features, which deployment context, which level of autonomy. A certificate for a narrow pilot says nothing about the full product.
3. Does testing cover adversarial behavior? Prompt injection, jailbreaks and manipulation attempts, not only friendly questions.
4. Is there human review where the stakes are high? Automated tests scale; expert reviewers catch what automation misses.
5. Can the result fail? If nobody has ever failed, the scheme is not measuring much.
6. Is the result verifiable by a third party? A logo on a website is not verification. A public listing that confirms current status is.
7. Does it expire or get re-tested? Because AI systems change, so should the evidence.

How RateAI certifies AI: the A.E.G.I.S.™ framework

RateAI is an independent AI safety certification company. Its framework, A.E.G.I.S.™ (Artificial Intelligence Evaluation for Guardrails, Integrity & Safety), is a standardized, repeatable way to turn AI safety from a marketing claim into a measurable, comparable rating. RateAI certifies customer-facing AI products, including conversational agents, AI toys, autonomous assistants and embedded AI features. Full detail is on the A.E.G.I.S.™ platform page.

The seven A.E.G.I.S.™ pillars

Each pillar is scored independently through automated test batteries, adversarial simulation and expert review, then combined into a single A-Scale rating. Our guide to how AI systems are tested for safety walks through what each pillar catches, with documented failures behind each one.

• Hallucination Integrity (H): does the system state falsehoods as facts? Factual reliability is benchmarked under pressure, ambiguity and domain-specific questioning.
• Guardrail Resistance (G): can the system be manipulated into unsafe behavior? Jailbreak attempts, prompt injection and boundary-pushing scenarios test every guardrail.
• Data Handling & Privacy (D): what does the system collect, retain and leak? The audit covers data collection behavior, PII exposure and privacy compliance posture.
• Ethical Alignment (E): does the system behave appropriately with vulnerable users and sensitive topics? Ethical boundary stress tests measure alignment in practice.
• Autonomy & Control (C): how far can the system act on its own, and can it be stopped? This covers autonomous behavior, escalation paths and human override integrity.
• Adversarial Robustness (R): how does the system hold up against a motivated attacker? Red-team exercises and multi-agent simulations probe real-world resilience.
• Explainability & Transparency (X): can the system's behavior be understood and audited? This assesses traceability, disclosure quality and the evidence trail behind decisions.

The A-Scale seals

Pillar results determine the A.E.G.I.S.™ Certified seal a system is awarded, from the highest safety assurance down:

• A-5 Guardian
• A-4 Shielded
• A-3 Contained
• A-2 Exposed
• A-1 Unrestricted

Every certified system also receives a standardized A.E.G.I.S.™ scorecard, a safety label designed to be as readable as a nutrition panel. The headline is an Overall Safety Rating, a single letter grade from A (Maximum Safety) to F (Dangerous). Beneath it, each of the seven pillars is graded individually, so a buyer can see exactly where a system is strong and where caution is warranted. Consumer products are additionally certified for age appropriateness, from Infant to Adult, with supervision guidance printed on the mark.

The certification process, step by step

1. Scoping and intake. The evaluation scope is defined: agents covered, autonomy level, deployment context, and the external reliance the certification must support.
2. Automated pillar testing. Standardized test batteries run across all seven pillars, including guardrail probing, hallucination benchmarks, data collection audits and ethical stress tests.
3. Adversarial and human review. For higher-assurance engagements, red-team exercises, multi-agent simulations and expert review panels validate the automated findings.
4. Rating and certification. The system receives its A-Scale rating, certification badge, formal approval letter and public Safety Registry listing.
5. Monitoring and re-certification. As models retrain and products evolve, continuous monitoring and periodic reassessment keep the certification current. Material changes to a system trigger reassessment.

Systems can fail. Those that do not meet the bar receive a detailed findings report and a remediation path, and can re-enter evaluation once the issues are addressed.

Built so results can be checked

Two design choices matter for anyone relying on a RateAI result. First, scoring is epoch-based: pillar weights, A-Scale thresholds and quorum parameters are defined by the active scoring epoch rather than hardcoded, and epochs freeze those parameters so evaluations stay comparable over time. Second, the audit trail is tamper-evident. Every prompt case, validator vote, consensus decision and certification is chained via SHA-256 hash, and records are write-once, so they cannot be altered, deleted or backdated.

The public Safety Registry

Verification is the last ingredient of certification, and it is the one most often missing. RateAI's public Safety Registry lets anyone confirm a certification without logging in, including whether it is current and has not been downgraded. The registry currently shows illustrative sample listings ahead of its public launch; certified products will appear there with verifiable certification IDs.

What RateAI certification is, and what it is not

RateAI certification is independent evidence of how an AI product behaves across seven measured safety pillars. It is not a legal determination. RateAI's Pro and Enterprise tiers include compliance mapping to the EU AI Act, NIST AI RMF and ISO 42001, and certification artifacts are designed as defensible evidence in regulatory reviews. Formal regulatory determinations remain with the relevant authorities, and under the AI Act any required conformity assessment still follows the route the law sets for that system.

Who should care about AI safety certification

Companies building customer-facing AI

A rating gives sales teams something concrete to hand a cautious buyer, and gives engineering teams a findings report that shows where to improve. It also starts building the evidence trail that future conformity assessments will ask for.

Enterprise buyers and procurement teams

Instead of a vendor's self-reported questionnaire, procurement can ask for an independent rating and check it in a public registry. Pillar-level grades make it easier to match a system to a use case: a low-autonomy internal tool and a customer-facing agent with access to payments carry very different risks.

Risk, compliance and insurance teams

Underwriters and risk teams need evidence they did not have to generate themselves. Standardized, repeatable results that sit on a tamper-evident record are easier to rely on than one-off demonstrations.

Parents and families

AI toys and children's apps talk to the most vulnerable users there are. Age-suitability marks and the Ethical Alignment and Data Handling & Privacy pillars speak directly to the questions a parent has before buying. Our complete guide to AI toy safety for parents works through those questions using the latest independent research.

Regulators and policy staff

Where the law relies on providers' internal control, independent testing adds a second, outside view of how a system actually behaves, without replacing any formal regulatory process.

How to get started with AI safety certification

Start small and specific. Pick the AI feature that carries the most risk or faces the most customers, write down what it is allowed to do and what it must never do, and get it tested by someone who does not report to the team that built it. From there you can decide whether you need ongoing monitoring, a formal certification, or both.

RateAI offers a free safety benchmark for one AI agent, so you can see your risk profile before committing to anything, and then recommends the right tier based on scope and how much outside parties will rely on the result.

Frequently asked questions

What is AI safety certification?

AI safety certification is a process in which an independent body tests an AI product against a published scheme and issues a result that others can verify. It differs from a vendor's own safety claims because the assessor has no stake in the outcome.

Does the EU AI Act require third-party certification for all high-risk AI?

No. Under Article 43, most stand-alone high-risk systems listed in Annex III points 2 to 8 follow internal control under Annex VI without a notified body, while some biometric systems and AI inside regulated products such as medical devices can require third-party assessment.

Is ISO/IEC 42001 certification the same as AI product certification?

No. ISO/IEC 42001 certifies an organization's AI management system, and ISO/IEC 42006 sets the requirements for the bodies that audit it. Product certification tests how a specific AI system actually behaves.

What are the seven A.E.G.I.S.™ pillars?

Hallucination Integrity, Guardrail Resistance, Data Handling & Privacy, Ethical Alignment, Autonomy & Control, Adversarial Robustness, and Explainability & Transparency. Each is scored independently and combined into the overall A-Scale rating.

Can an AI product fail an A.E.G.I.S.™ certification?

Yes. Systems that do not meet the bar receive a detailed findings report and a remediation path, and can re-enter evaluation once the issues are addressed.

Does RateAI certification make a product compliant with the EU AI Act?

No certification can make that determination on its own. RateAI provides compliance mapping to frameworks such as the EU AI Act, NIST AI RMF and ISO 42001, and formal regulatory determinations remain with the relevant authorities.

See where your AI stands

If you build customer-facing AI, the quickest way to find out how it would rate is to test one agent against the seven A.E.G.I.S.™ pillars. Compare RateAI's monitoring, certification and enterprise options and request a free safety benchmark.