Certification Standard · Deployer
— EUMS v1.0
EUMS establishes requirements for organisations that deploy, procure, operate, oversee, or rely upon AI systems. It is intended to provide independent assurance that AI is used responsibly, transparently, safely, lawfully, and with meaningful human accountability — regardless of sector, geography, or vendor.
Document control
Section 1 · What EUMS is
EUMS is the Ethical Use of AI Management Standard — an independent certification standard for organisations that buy, deploy, or rely on AI systems built by others. It is focused on the three things regulators, boards, and customers actually ask about: governance, accountability, and risk management.
EUMS does not assess the underlying model. It assesses the organisation around the model — the policies, the people, the vendor controls, the incident handling, and the disclosures.
Section 2 · Scope
EUMS applies to
EUMS does not assess
Those are addressed by AIMSS. Organisations may hold one or both certifications.
Section 3 · The standard at a glance
EUMS is organised around five domains. Each one corresponds to a question a regulator, board member, or customer is entitled to ask — and to which a certified organisation must be able to answer in writing.
§3.1
A written framework establishing accountability for AI inside the organisation: an accountable executive, an AI register, an acceptable-use policy, and clear escalation paths.
§3.2
Every AI system in use is classified by risk tier and assessed for privacy, rights, bias, workforce, and safety impacts before deployment. High-tier systems receive heavier controls.
§3.3
Suppliers are evaluated, their claims independently verified, contracts reviewed for AI-specific terms, and exit plans maintained. AI procurement is treated with the same rigour as any critical supplier relationship.
§3.4
Deployed systems are continuously monitored. An incident register is maintained. Failures are investigated and corrected on a defined cadence — and certification is at risk if they are concealed.
§3.5
Affected persons are informed when AI is used in a decision that concerns them, given meaningful explanations, and offered a route to appeal. Public transparency statements are maintained.
The full standard expands these into ten technical control domains (EU01–EU10) below, each with shall-statements, required evidence, and review cadence.
Section 3A · Applicability
Enterprises using third-party AI tools
Any organisation embedding AI from external vendors into customer-facing or internal workflows — copilots, content tools, decision support, automation platforms.
Organisations deploying AI in regulated industries
Healthcare, financial services, insurance, legal services, education, and public-sector bodies whose AI use already attracts regulatory scrutiny under sector rules.
Procurement teams embedding AI into workflows
Procurement, vendor management, and transformation functions seeking a defensible standard to apply across new AI purchases and to require of their suppliers.
Section 3B · Certification process
Step 01
Self-assessment intake
A structured four-step application capturing your organisation, AI use, governance posture, and contact.
Step 02
Structured audit
An Ethicality assessor evaluates documentary evidence and conducts interviews against the EUMS framework.
Step 03
Board review
Findings are escalated to the Ethicality board for final review and certification decision.
Step 04
Blue Ribbon issuance
On approval, the Blue Ribbon mark is issued and the organisation is published to the Public Registry.
Section 3C · Comparison
Most organisations are already partway through an internal AI-policy exercise. EUMS converts that work into independently verified evidence of due care.
| Dimension | Doing nothing | Internal policy only | EUMS certification |
|---|---|---|---|
| Independent assurance | None | Self-declared | Verified by an independent assessor |
| Evidence for regulators | Reactive, ad hoc | Internal documents only | Structured evidence aligned to EU AI Act, NIST AI RMF, ISO/IEC 42001 |
| Board defensibility | Personal liability exposure | Partial — depends on quality | External attestation board can rely on |
| Vendor leverage | Limited | Internal guidance, not contractual | Standardised vendor controls and exit plans |
| Continuous oversight | None | Optional internal review | Surveillance visits and incident register required |
| Public credibility | None | Internal only | Blue Ribbon mark and public registry entry |
Why deployers adopt EUMS
EUMS is built for organisations using AI from third-party vendors. It is designed to reduce legal and reputational risk, lower the cost of regulatory compliance, and protect the business — by formalising the governance most companies already partly run, and giving it independent assurance.
Defensible position
An AI register, USIA, and human-oversight records are the documents regulators and plaintiffs ask for first. Having them ready de-risks enquiries before they escalate.
Lower compliance cost
One programme satisfies EU AI Act deployer duties, Colorado AI Act, NYC LL 144, and the California CPPA ADMT rules. Pay once, comply many times.
Vendor leverage
Standardised vendor assurance and exit-plan requirements give procurement real bargaining power and reduce lock-in to a single AI supplier.
Insurance and board reassurance
Independent certification is increasingly accepted as evidence of due care in D&O, professional indemnity, and cyber policies.
Proportionate, not punitive
Tier 1 internal copilots get a light baseline. Heavy controls only apply where AI affects rights or major decisions. No blanket burden.
Reuses existing controls
Procurement, privacy, HR, and internal-audit functions already produce most of the evidence. EUMS connects them, it does not duplicate them.
Ethicality is a certification body, not a regulator. EUMS does not create new legal obligations — it provides independent evidence that the obligations your business already carries are being met.
Section 4 · Deployer risk classification
Section 5 · Control domains
Each domain states what the organisation shall do, the evidence required, and the review cadence.
The organisation shall:
Required evidenceGovernance Charter · AI Policy · Organisational Chart · AI Register
Review cadenceAnnual
The organisation shall:
Required evidenceInventory · Classification Records · Ownership Records
Review cadenceContinuous
The organisation shall:
Required evidenceVendor Reviews · Procurement Records · Contracts · Exit Strategies
Review cadenceAnnual
The organisation shall:
Required evidenceCompleted USIA · Mitigation Plan · Executive Approval
Review cadenceAnnual
The organisation shall:
Required evidenceNotices · Disclosure Templates · Explanation Procedures
Review cadenceAnnual
The organisation shall:
Required evidenceReview Procedures · Appeal Records · Override Logs
Review cadenceQuarterly
The organisation shall:
Required evidenceConsultation Records · Impact Assessments · Complaint Logs
Review cadenceAnnual
The organisation shall:
Required evidenceTraining Records · Completion Logs · Competency Framework
Review cadenceAnnual
The organisation shall:
Required evidenceIncident Register · Corrective Actions · Monitoring Reports
Review cadenceContinuous
The organisation shall:
Required evidenceManagement Review · Board Minutes · Improvement Plans
Review cadenceAnnual
Section 6
Minimum submission package.
Minor
Administrative deficiencies — e.g. missing review record, outdated inventory entry.
Consequence · Correction within 90 days.
Major
Control failure — e.g. missing impact assessment, missing disclosure.
Consequence · Correction within 30 days.
Critical
Systemic failure — undisclosed consequential AI, rights-affecting deployment without oversight, concealed incident, retaliation against complainants.
Consequence · Immediate certification suspension.
EUMS maintains formal crosswalks to the following frameworks:
Level 1
Foundational
Basic controls established.
Level 2
Managed
Controls documented and measured.
Level 3
Assured
Controls independently validated.
Level 4
Leading Practice
Continuous monitoring and public accountability.
Ready to be certified against EUMS v1.0?
Apply for EUMS Certification →