CertifAI®: Testing and certification of AI-based solutions

Yes – deliberately. Our catalog integrates requirements from:

• ISO/IEC 27701 → Data protection measures
• ISO 27001 → Security measures
• EU AI Act → High-risk categorization and transparency obligations
• CH-GeBüV → Retention obligations
• Data protection law (DSG/DSGVO)

Certified systems can draw added value from this for other audits and verifications.

ISO/IEC 23894 is a guideline for organization-wide risk management. It offers good principles, but is not testable or certifiable. It also lacks an operational reference to specific applications.

CertifAI® operationalizes risk management:
We check whether risks such as bias, explainability gaps, data leaks or manipulation have been identified, addressed and technically secured in a specific system. Our testing methods include stress tests, technical evaluations, transparency checks and documented intervention mechanisms.

ISO 38507:
This standard is aimed at boards of directors and top management. It defines responsibilities, but does not contain any specific audit criteria. It is useful for governance, but not sufficient for system evaluation.

CertifAI® implements governance:
Our catalog includes governance controls such as responsibility, auditing, logging and traceability – concrete, verifiable and related to a specific system. CertifAI® checks special requirements for high-risk systems (EU AI Act Annex III) directly – incl. special logging, registration, annotator oversight.

The technical risk reference in CertifAI® is very specific with checkpoints such as “Bias Detection”, “Stress Testing”, “Adversarial Attacks” and “Data Classification”.

ISO/IEC 42001 is a management system standard that evaluates processes and structures at an organizational level – comparable to ISO 27001. It does not test specific AI systems, but rather the ability of an organization to manage AI safely.

CertifAI® goes beyond this: We certify specific AI applications from the perspective of the data subject (e.g. users of an app) and check whether and how a specific solution implements data protection, fairness, security and traceability in concrete terms.
We also integrate requirements from the AI Act and Swiss data protection law, including DPIA, data classification and human-centered control as well as the requirements for legally compliant data storage (according to the Ordinance on Business Records, GeBüV). In addition, there are further test contents such as: Explainability, incident response and logging mechanisms.