AI Security AssuranceDemonstrate Trusted AI Security with STAR for AI
Show that your AI services meet recognized security and governance expectations through the industry’s leading AI assurance program.
What is STAR for AI?
STAR for AI is CSA’s assurance program for AI services. It gives organizations a recognized way to document and demonstrate how their AI systems address security and governance expectations, using the AI Controls Matrix (AICM) as the common framework and the STAR Registry as the public record.
Because AI-specific risk has become part of procurement, governance, and emerging regulatory expectations, STAR for AI serves organizations that build, deploy, or embed AI in the services they offer, whether they are publishing a first AI self-assessment or extending an ISO/IEC 27001, ISO/IEC 42001, or SOC 2 engagement to cover AI.
Why Choose STAR for AI?
Demonstrate that your organization is addressing AI-specific security risks while building confidence with customers, partners, and regulators.
Select the benefit that matters most to your organization to see a suggested starting point.
STAR for AI Level 1: Self Assessment
An AI-CAIQ documents how your AI service implements the AICM controls, without a third-party audit.
STAR for AI Level 1: Valid-AI-ted
Automated validation of your AI-CAIQ adds a STAR for AI Valid-AI-ted badge to your Registry listing.
STAR for AI Level 2: Certification (ISO/IEC 27001 route)
Extends an existing ISO/IEC 27001 certification to AI security through the AICM without requiring ISO/IEC 42001.
STAR for AI Level 2: Certification (ISO/IEC 42001 route)
ISO/IEC 42001 demonstrates the management system exists; the AICM extends it with additional AI and cloud security controls.
Choose Your Level of Assurance
Whether you're beginning your AI assurance journey or seeking independent validation, choose the level that best fits your organization.
–
Documents AI security controls and demonstrates transparency without a third-party audit.
–
Stronger differentiation through automated validation without a third-party audit.
STAR for AI Level 1 certification; STAR Registry listing; STAR for AI Level 1: Valid‑AI‑ted badge
Get Listed with this path →Valid-AI-ted AI-CAIQ on the STAR Registry
Enables organizations with an existing ISO/IEC 27001 certification (or STAR Certification) to extend their assurance to AI security through the AICM without requiring ISO/IEC 42001.
STAR for AI Level 2 certification; STAR Registry listing; STAR for AI Level 2 badge
Get Listed with this path →Valid-AI-ted AI-CAIQ on the STAR Registry
The broadest assurance package and is attractive to organizations operating in highly regulated industries or those seeking maximum market differentiation.
STAR for AI Level 2 certification; STAR Registry listing; STAR for AI Level 2 badge
Get Listed with this path →Valid-AI-ted AI-CAIQ on the STAR Registry
ISO/IEC 42001 demonstrates that the management system exists; AICM extends the ISO assurance and demonstrates that additional AI and cloud security controls are implemented and assessed.
STAR for AI Level 2 certification; STAR Registry listing; STAR for AI Level 2 badge
Get Listed with this path →Valid-AI-ted AI-CAIQ on the STAR Registry
This allows organizations to obtain AI assurance within a reporting model already familiar to their customers.
STAR for AI Level 2 certification; STAR Registry listing; STAR for AI Level 2 badge
Get Listed with this path →Getting Listed on the STAR Registry
Follow the steps from preparing your assessment to maintaining a published STAR for AI listing.
Prepare
Review the AICM, determine the appropriate assurance level and path, and gather the information needed for your assessment.
Complete Your Assessment
Complete the assessment required for your selected STAR for AI level and path—self assessment for Level 1 or independent assessment path for Level 2.
Submit
Submit the required assessment information and supporting materials through the STAR Platform.
Get listed
Once requirements are met, your organization’s STAR for AI listing is published in the STAR Registry, making your assurance information available to customers and stakeholders.
Maintain & advance
Keep your listing current and strengthen your AI assurance as your organization, technologies, and security practices evolve.
How Organizations Use STAR for AI
Use STAR for AI assurance information to evaluate AI providers, strengthen third-party risk management, and support procurement, governance, and compliance decisions.
AI Third-Party Risk Management
Use STAR for AI listings and assessment information to evaluate how providers address AI-specific security and governance risks and identify areas that may require further review.
AI Procurement & Vendor Due Diligence
Incorporate STAR for AI assurance into vendor selection and onboarding to help procurement and security teams evaluate AI providers using a consistent set of controls and assurance information.
AI Supply Chain Risk
Gain greater visibility into the security and governance practices of AI providers and services across your supply chain to better understand dependencies, responsibilities, and areas of risk.
Governance & Compliance
Use AICM-aligned assurance, supporting assessment information, and related mappings to inform AI governance and compliance activities and reduce duplication across assurance efforts.Ready to demonstrate AI security assurance?
Choose your STAR for AI level and route, then follow the submission path for that route.
What’s Included?
Explore the framework, assessment tools, guidance, and training that support STAR for AI participation.
Explore STAR Program Resources
Frameworks, submission guides, prep kits, and FAQs in one library.Browse resources →AI Trustworthy Pledge
Learn what the pledge commits your organization to. Signing takes place on the pledge page.
