EUMS Version 1.0

Badge Tiers

Three tiers, awarded only when all pass conditions are met.

The Pillars

Five pillars. Every requirement applies.

Each certified organisation must meet every specification listed below. Where a requirement is genuinely not applicable to the nature of the business, the certifier may grant a documented concession — recorded against the relevant pillar and reviewed at each recertification.

1. PILLAR 01

   Use AI Responsibly

   Weight · 20%

   The organisation has clear, written rules for how employees use AI at work.

   Requirements

   • ·An Acceptable Use Policy covering which tools employees may use, for what purposes, and what is prohibited.
   • ·Disclosure rules: the circumstances under which employees must inform a client or customer that AI contributed to an output.
   • ·A prohibition on using AI to make sensitive decisions without human review.
   • ·A list of prohibited uses — categories of decision or content for which AI may not be used at all.
   • ·Data handling rules: which categories of data (personal, confidential, client-privileged) may not be entered into AI tools, and which tools are approved for which data types.
   • ·A requirement that AI-assisted client deliverables are reviewed by a qualified human before issue.
   • ·A sign-off protocol: material AI-assisted outputs require named human authorisation before acting on them.
   • ·Periodic policy review; at minimum annually or when a material tool change occurs.

2. PILLAR 02

   Keep Humans in Charge

   Weight · 40%

   Higher minimum · 70%

   A person — not a system — is responsible for every AI-assisted outcome, can explain it, and knows what the organisation uses AI for. This is the heart of the standard.

   NoteHigher minimum: 70% on this pillar to pass certification.

   Human in the loopA named individual responsible for reviewing, approving, or overriding AI outputs before they take real-world effect. Every AI use must have one — by name.

   A

   AI Register & Human-in-the-loop

   30%

   Requirements

   • ·An AI Register documenting every AI tool in use, its purpose, and the named human in the loop responsible for it.
   • ·A plain-language description of what each tool does and how it produces its outputs.
   • ·An annual review of the Register, with a changelog recording additions, removals, and material changes.
   • ·For every tool in the Register, a named human in the loop is responsible for overseeing how that tool is used and for any outcome it contributes to.
   • ·A Human-in-the-Loop Policy that requires a human to make any final decision, even when AI has informed or assisted it. AI output is input. The decision is always human.
   • ·All AI use is explainable. For every tool in use, a responsible person can describe, in plain language, how the AI produces its outputs and on what basis.
   • ·AI tools whose reasoning cannot be understood or explained are not used.
   • ·AI is not permitted to make decisions autonomously on the organisation's behalf.
   • ·A process for employees to notify the Register owner when a new AI tool enters use, so a named human in the loop can be assigned before reliance.
   • ·The named human in the loop reviews all material AI outputs before delivery. AI-generated work is not routed directly to a client without that review.
   • ·The named human in the loop can explain how a specific output was produced and why it was accepted, modified, or rejected.

   B

   Hallucination awareness

   10%

   Requirements

   • ·Employees who use AI tools understand that AI can produce confident, plausible, and wrong outputs — and are briefed on how to recognise them.
   • ·A verification expectation: factual claims, citations, figures, and quotations generated by AI are checked against source material before use.
   • ·Verification is documented for client-facing deliverables: the reviewer records what was checked and against what source.

3. PILLAR 03

   Be Open

   Weight · 15%

   The organisation is transparent about how AI is used — with clients and with staff.

   Requirements

   • ·Disclosure language for client-facing communications where AI contributed to an output, respecting commercial confidentiality.
   • ·Internal communications so employees understand how AI is and is not used in their workplace.
   • ·A plain-language summary of AI use available to clients on request.
   • ·Active disclosure: clients are informed that AI was used in a specific deliverable, not only when they ask.
   • ·A record that disclosure was made — a log or sample sufficient to demonstrate the practice, not just the policy.

4. PILLAR 04

   Support Your People

   Weight · 10%

   The people using AI know what's expected of them, and have somewhere to go when they're uncertain.

   Requirements

   • ·All employees who use AI tools are briefed on the Acceptable Use Policy and Human-in-the-Loop Policy before using them.
   • ·A named point of contact for AI questions — the person employees go to when unsure whether a use is appropriate.
   • ·A refresh briefing when policies or tools change materially, or at minimum annually.
   • ·New employees are oriented as part of onboarding, before they use any AI tool.
   • ·Role-specific guidance for employees whose work involves AI-assisted client outputs, covering their verification responsibilities.
   • ·Evidence of briefings: a record that each employee has been briefed, sufficient to demonstrate the practice to an assessor.

5. PILLAR 05

   Respond to Problems

   Weight · 15%

   The organisation has a plan for when AI produces a harmful or incorrect outcome — and learns from it.

   Requirements

   • ·An Incident Response Process: how to identify, log, and escalate an AI-related problem.
   • ·A review process: a named person or group decides what went wrong and what changes as a result.
   • ·A record of incidents and how they were resolved.
   • ·A trigger mechanism connecting the review process to Pillar 4: if the review determines a policy or training change is needed, a named person is responsible for actioning it within a defined timeframe.
   • ·A client notification protocol: if an AI-related error affects a client output, the process for informing them and remediating.
   • ·An annual review of the incident log to identify patterns, even in the absence of individual incidents.
   • ·Root cause analysis is documented for material incidents and retained for a minimum of three years.

Need a starting point? See ready-to-use templates and examples for every document required under EUMS.