Framework
How the AI:OK framework is built, how it relates to other frameworks, and how certification stays current.
Last updated 12 October 2026.
AI:OK is not a replacement for regulation, and it does not compete with the general AI governance standards your customers may already ask about. It looks at one question that those frameworks mostly leave to the applicant: does an AI music system have a documented rights basis for the data it relies on, and is it run in a way that supports that basis?
This page is for labels, publishers, platforms and vendors. It is a summary for information and is not legal advice.
1. What the framework is
The AI:OK framework has three layers, applied in order.
Quick Check is a free eligibility screen across five areas: what the system does, its model structure, whether its datasets can be identified, whether it has rights for commercial use, and whether the intended use would prevent certification.
Core Certification is the substantive review of training data, rights, transparency and deployment. This is where the trustmark is granted or withheld.
The Extended Framework is an operational review after certification. It looks at how the system is run day to day.
The AI:OK Certification Standard sets 33 requirements in five areas, with four gating conditions. Every requirement is assessed through a question in one of the three forms. A human assessor reviews every stage, and certified entities appear on a public registry.
Design principles
Rights first. The first questions are whether the data behind a system can be identified and whether rights to use it are documented.
Evidence based. AI:OK assesses the documents an applicant provides, not claims.
Human reviewed. Human assessors make every decision. No outcome is decided automatically.
Transparent. The standard, the methodology and the protocols are public. Changes are listed with their date. The registry is public.
Proportionate. Applicants choose a scope that fits what they can evidence. Gaps that are not clear failures can be addressed through Conditional Certification. Operational questions are reviewed after certification, not before.
Current. Certification lasts twelve months and is reviewed every year. The standard is reviewed every year and changes are announced 30 days before they apply.
Independent. AI:OK is independent of the vendors, labels, publishers and platforms it assesses. AI:OK does not certify any organisation to which AI:OK or the assigned assessor has provided paid consultancy in the previous 24 months. Assessors declare conflicts of interest before each assignment.
Complementary. The framework is designed to sit beside other frameworks, not to replace them.
2. How the layers fit together
Quick Check tells AI:OK and the applicant whether a full review is worth doing. It asks about the system, the model set-up, the datasets, the rights and the deployment, and a human assessor reviews it within five working days. An applicant cleared to proceed to Core may join the waiting list while places are limited.
Core asks whether the system can be legitimately built and deployed. It requires a Dataset and Source Register that lists every dataset, source and training input, referring to the actual assets used. It reviews how the data was obtained, who holds the rights, whether explicit rights cover training, fine-tuning and deployment, which transparency duties apply, where the system is deployed, and whether any synthetic data has traceable lineage. Four gating conditions decide whether certification can proceed at all.
The Extended Framework asks how the system is actually run. It covers data governance, the user, system design and operation, cultural and sector impact, governance and ecosystem, and AI literacy. It is a structured exchange of questions and evidence, reviewed by a human assessor and refreshed each year.
3. How evidence is treated
Three kinds of evidence
Provenance evidence shows where data came from: registers, inventories, manifests and source records.
Legal evidence shows what the applicant may do: licence agreements, data supply agreements, provider terms, rights clearance records, legal opinions and written confirmations from rights holders or licensors.
Operational evidence shows how the applicant works: policies, procedures, records, logs and screenshots of user controls.
Required and strengthening evidence
Some evidence is needed to answer a question at all. Other evidence strengthens an answer, such as a written confirmation from a licensor or a legal opinion on a deployment market. The Applicant Guide lists typical evidence for each section of each form.
What good evidence looks like
It is specific to the scope and to the named model and version.
It is dated, and where it is a policy or procedure, it shows a version history or review date.
It can be traced to a person or team who is responsible for it.
It is consistent with the applicant’s other answers.
It shows what the applicant does in practice, not only what it intends.
It is current. A policy that no longer reflects practice weakens an application.
Applicability
Where a question does not apply to a system, the applicant selects Not applicable and says why. Systems that are partly or fully generative receive additional scrutiny in the rights and deployment sections.
Review cycle
Every requirement is reviewed every twelve months, at the annual review.
4. How AI:OK relates to other frameworks
AI:OK builds on the transparency and rights questions now appearing in EU law and in chart rules. It does not duplicate general governance, privacy or security frameworks. For each framework below, this page says what the framework covers, what AI:OK relates to, and what AI:OK does not assess.
EU AI Act
The EU AI Act sets legal duties by risk tier. AI:OK assesses evidence that relates to some of them. Certification is not a conformity assessment and does not show legal compliance. The documents an organisation prepares for AI:OK may support its own compliance work.
Article 4, AI literacy. Providers and deployers must take measures to support the AI literacy of their staff and of others operating AI systems on their behalf. The duty has applied since 2 February 2025. Its wording was amended on 27 July 2026 by Regulation (EU) 2026/1744. AI:OK relates to this through requirement E7, and Sound Judgement, AI:OK’s AI literacy programme, can be one such measure.
Article 53, providers of general-purpose AI models. The Act requires, among other things, a public summary of the content used for training. AI:OK relates to this through requirements A1, B1, C1, C2 and C3, which cover identifying training sources, keeping records and being able to disclose sources on request. AI:OK does not assess a provider’s copyright policy, its handling of rights holder opt-outs, or its technical documentation duties.
Data governance and record-keeping. The Act sets data governance and record-keeping expectations, mainly for high-risk systems. AI:OK relates to these through requirements A1, B2, B4, D1 and D4. It does not assess high-risk conformity.
Article 50, transparency for AI-generated content. AI:OK does not assess these duties.
Check current legislation on EUR-Lex for the text and dates that apply to you.
EU copyright framework
The Core form asks applicants to identify which training data transparency duties apply to them under the EU AI Act, the EU Copyright Directive and national rules. AI:OK does not decide whether a copyright exception applies to any system. It looks for explicit rights from the relevant rights holders or authorised licensors, and where an applicant relies on something else, the assessor records it.
UK, US and other markets
The Core form asks applicants to identify their transparency duties and deployment issues in every market where the system is or will be deployed. AI:OK does not map its requirements to UK or US federal or state law. Training data transparency rules are also emerging outside the EU, including in some US states, and applicants should take advice for each market.
IFPI chart principles and AI labelling
IFPI’s chart principles of 30 July 2026 set conditions for a recording made with generative AI to be eligible for official charts. The core conditions are that the AI service is properly authorised and lawful, that the recording is substantially human-made, and that there is no stream or chart manipulation concern. The wider framework also covers copyright, related rights and personality rights, the terms of the AI service, and telling listeners that AI was used. IFPI and RIAA have also backed a voluntary system for labelling tracks as AI-Generated or AI-Assisted.
AI:OK relates to the first condition only. A label says AI was used on a recording. AI:OK looks at the tool behind it. Chart compilers apply their own rules, and certification does not make a recording chart-eligible.
Fairly Trained
Fairly Trained certifies whether a generative AI model was trained on appropriately licensed data, across creative industries. It is a separate scheme. The Extended Framework asks applicants whether they hold Fairly Trained certification and why or why not, and AI:OK may take it into account as supporting evidence only.
ISO/IEC 42001
ISO/IEC 42001 is an international standard for AI management systems: governance structure, policies, risk processes and review cycles. It shows that an organisation manages AI in a structured way. It does not describe whether the data behind a particular system was lawfully obtained.
Some ISO/IEC 42001 controls cover the same topics as AI:OK questions: acquisition of data (Annex A, A.7.3), data provenance (A.7.5), data resources (A.4.3), suppliers (A.10.3), reporting of concerns (A.3.3) and roles and responsibilities (A.3.2). AI:OK looks at these through evidence about specific datasets, licensors and suppliers, and through the Extended Framework. AI:OK does not assess an AI management system, does not audit conformity with ISO/IEC 42001, and does not assess matters such as management review or internal audit programmes. Holding one certificate does not replace the other, and the documents prepared for one may help with the other.
C2PA and Content Credentials
C2PA is a technical standard for provenance information that travels with a file. It carries a claim about how a file was made. AI:OK does not assess provenance metadata on outputs.
NIST AI Risk Management Framework
The NIST AI RMF is a voluntary US framework for managing AI risk. AI:OK does not map to it. The Extended Framework questions on risk assessment, documentation, human oversight and third-party management will be familiar to organisations that use it.
GDPR, ISO/IEC 27001 and 27701, and SOC 2
AI:OK does not duplicate these. The Extended Framework asks about privacy, security and retention practices and accepts GDPR documentation, ISO/IEC 27701 documentation and similar evidence. Applicants should comply with these frameworks independently of AI:OK.
Other AI certification schemes
Other schemes cover other subjects. AIUC-1, for example, covers security, safety and reliability of AI agents through technical testing. AI:OK has no affiliation with other schemes, and a certificate from one does not stand in for a certificate from another.
5. What AI:OK adds
Dataset-level rights evidence. AI:OK asks which datasets, from which licensor, under what licence, with what evidence, and reviews the Dataset and Source Register against what the applicant submits.
Rights in a list are separate from rights in the content. Holding rights to a dataset list or catalogue is not the same as holding rights to the music inside it. AI:OK asks about both.
Supplier and rights holder are separate questions. The party that supplied content may not hold the rights in it.
Synthetic data lineage. Where synthetic data is used, AI:OK asks for its source and lineage.
A plain statement about third-party models. A provider’s permission for your use does not show that the provider’s own training was lawful. AI:OK asks what the applicant can show and records what it cannot.
A public registry. Anyone can check the status of a certificate as AI:OK last recorded it.
6. What the framework does not assess
The framework does not assess whether a system prevents imitation of a named artist’s voice or likeness, how a system handles consent or opt-out requests from rights holders in operation, or whether any individual output infringes a right. It does not monitor certified entities between reviews. It does not verify the lawful sourcing of a third-party model by its provider. AI:OK may add topics in a future version and will publish any change before it applies.
7. How the framework stays current
AI:OK reviews the standard and the methodology every year. Each change is listed with its date in the version notes on the Standards page and takes effect 30 days after publication, unless a change in law requires earlier effect. AI:OK welcomes questions, challenges and corrections. Write to info@ai-ok.org.
8. Annual review and re-certification
Certification lasts twelve months. The annual review confirms that the basis on which certification was granted still holds. It is also where the Extended Framework is refreshed.
Which version applies
Certified entities are assessed against the current version of the standard at their annual review. Because changes take effect 30 days after publication, applicants have notice of what will apply before the review.
What happens at the annual review
Confirm what has changed. You tell AI:OK about any material change to training data, model structure, rights arrangements, ownership or control, third-party model dependencies or deployment markets.
Update your evidence. Where an answer or document has changed, you update it. Where nothing has changed, you say so.
Refresh the Extended Framework. You review and update your answers.
Assessor review. A human assessor reviews your update and may ask questions or request more evidence.
Outcome. The registry shows the new review date. If a gap appears, Conditional Certification may apply. If the review reveals a ground in the Revocation Protocol, AI:OK follows that protocol.
When re-certification is needed
A material change to training data, model architecture or the rights basis on which certification was granted will normally require re-certification, not disclosure alone, because it changes what the trustmark was assessed on. Other material changes, including to deployment markets, ownership or control, may require an interim review at AI:OK’s discretion. The annual review is required in every case.
Changing scope
You can extend scope at renewal, or apply separately to add a product or model during the term. Reducing scope must be disclosed to AI:OK and the registry entry will reflect the change.
If the review is not completed
If the annual review is not completed, the certificate lapses. The registry shows Expired and the trustmark may not be used.
Effort
Evidence prepared for the first review can be reused where nothing has changed. Keeping the Dataset and Source Register, the licence records and the policies up to date through the year makes the annual review simpler to evidence.
9. For labels, publishers and platforms
A certificate tells you that an assessor reviewed a vendor’s evidence about its training data sources, rights position and deployment basis against a published standard, and that the vendor did not fail any of the four gating conditions. It does not tell you that any specific output is free of infringement, and it does not replace your own legal review. The section How to read an AI:OK certificate on the Certification page explains the checks to make. Where you need the same standard across your vendors, an Enterprise Platform Licence is available.