Methodology
How AI:OK assesses, issues, maintains and withdraws certification.
Last updated 12 October 2026.
Status of the scheme
AI:OK is an independent, voluntary certification scheme run by AI-OK Limited. It is not a regulator, not a statutory conformity assessment body, and not a licensing body. Certification does not replace legal compliance or legal advice.
1. Purpose and scope
This document sets out what AI:OK verifies, the evidence it asks for, the review procedure, the limits of verification, and the governance that applies the standard consistently. It applies to every certification AI:OK issues.
2. What AI:OK certifies
AI:OK certifies that a system has a credible legal and operational basis for commercial deployment. On the balance of documented evidence at the time of assessment, a certified entity:
can identify the datasets and sources its system relies on;
holds explicit rights from the relevant rights holders or authorised licensors for commercial AI training and deployment;
can distinguish rights in a dataset list, catalogue or manifest from rights in the underlying assets;
keeps records sufficient to show training data provenance, can disclose its training sources on request, and where it used synthetic data, identifies the source and lineage; and
has not materially misrepresented its position in the evidence it submitted.
A certificate states its scope, the model version where relevant, the version of the standard applied, its issue date and its review date.
3. What AI:OK does not do
AI:OK does not:
audit training corpora at file level;
warrant that any output of a certified system is free of infringement;
give legal advice;
act as a statutory conformity assessment body or a regulator;
act as a licensing body, collecting society or rights intermediary;
monitor certified entities between reviews;
assess how a system handles imitation of a named artist’s voice or likeness, or how it responds to rights holder opt-outs; or
certify individual recordings or establish who owns rights in them.
Certification is a voluntary signal about practices and evidence at a point in time. It does not guarantee legal compliance and cannot remove risk. Different certified entities meet the standard in different ways. Where the standard does not prescribe a single method, such as retention periods, it asks for clear disclosure and consistent application.
4. The stages
Quick Check
An eligibility screen across five areas: system definition, model structure, dataset awareness, rights and permissions, and deployment context. Full documents are not required. A human assessor reviews it within five working days of submission. The outcomes are Proceed to Core, Requires Clarification and Not Currently Eligible.
Waiting list
An intake queue for applicants cleared to proceed to Core, used while places are limited. Order is by Quick Check clearance date. A place is not guaranteed.
Core Certification
The substantive review. It covers system disclosure, the Dataset and Source Register, training data provenance, rights and licensing, transparency, and commercial deployment basis. Review begins on a complete submission. Assessor time is typically one to three hours, depending on the dataset and rights structure. Elapsed time varies, and AI:OK states the expected review period when it accepts the submission. The outcomes are Certified, Conditional Certification and Not Certified.
Extended Framework
An operational review after certification, across six areas: data governance, the user, system design and operation, cultural and sector impact, governance and ecosystem, and AI literacy. It takes place within the first year and is refreshed at each annual review. It produces findings and agreed actions, which may support renewal or lead to review.
Applications are made through the online forms. The online form includes the applicant’s declaration of accuracy and acceptance of the Terms of Service and Privacy Policy. Downloadable versions of the forms help applicants prepare, and are not submissions.
Core review uses a structured questionnaire. Supporting documents must be submitted with it. Extended review is a structured dialogue and evidence exercise and does not produce a separate pass or fail outcome unless it reveals a ground in the Revocation Protocol. It is used after Core certification, and may be revisited where the system changes materially, where governance failures emerge, or where use of the trustmark is called into question.
From question to decision
The applicant completes the online form and makes its declaration.
The applicant submits evidence. For Core, this includes the Dataset and Source Register.
A human assessor reads the answers and the evidence against the requirements in the Standards. An application that fails a gating condition cannot proceed.
Where a case raises a new rights question, a second assessor or a panel reviews it.
AI:OK issues the outcome in writing with its reasons.
If certification is granted, the registry shows the entity name, certificate number, status, scope, issue date and review date.
5. The Dataset and Source Register
All datasets, sources and training inputs are listed. The Register refers to the actual assets used, not to metadata indexes, catalogues or lists. Where a dataset list or manifest was obtained, rights to that list are separate from rights to the underlying content, and both are addressed.
Each entry records the dataset name, provider or supplier, licensor or rights holder, asset type, role in the system, licence type and evidence reference.
If the Register cannot be completed, Core certification cannot proceed. Where an applicant relies wholly on a third-party model provider, the Register is completed as far as possible and the remainder is addressed in training data provenance.
6. Gating requirements
Certification cannot proceed where any of the following applies. These are absolute and are not subject to Conditional Certification.
Datasets used for training cannot be identified (A1).
Explicit rights for commercial training or deployment are absent or are clearly not held (A3).
Restricted, non-commercial or research-only data has been used for commercial deployment without appropriate rights (A5).
Material misrepresentation is identified in the application (A9).
7. Conditional Certification
Conditional Certification may be granted where gaps are identified, no clear infringement is established, and the applicant shows credible intent and a plan to resolve the gaps within a defined period. It requires a remediation plan with milestones and a re-review date. The registry shows the status as Conditional for the duration.
Remediation may include AI literacy training. The AI:OK Literacy Programme is optional and is included with certification through the member portal at no extra charge. Completion does not guarantee certification.
Trustmark display during Conditional Certification is permitted only as stated in the certificate.
If remediation is not completed within the agreed period, AI:OK may revoke the certification under the Revocation Protocol.
8. Evidence
Typical evidence includes source registers and data inventories, supplier statements and data supply agreements, licence agreements and terms of use, provenance records, rights clearance records or legal opinions, data processing agreements, provider terms where third-party models are used, and written confirmation from rights holders or licensors.
Material marked [Confidential] is handled to a higher standard under the Confidentiality Protocol. Unmarked material is also treated as confidential business information. Misleading or incomplete evidence may lead to refusal or revocation.
9. Standard of assessment
AI:OK assesses on the balance of the documented evidence. Assessors may ask for more. They do not examine training files, and they do not make findings about whether any work has been infringed. A conclusion that evidence is insufficient is a conclusion about the evidence only. Where AI:OK documents use the word infringement, for example “no clear infringement is established”, they describe what the evidence clearly shows. They are not a legal determination.
10. Independence, assessors and impartiality
AI:OK is independent of the vendors, labels, publishers and platforms it assesses. Human assessors review every stage and make every decision. Complex cases, and cases that raise a new rights question, may go to a panel. No outcome is decided automatically. AI:OK uses online forms and automated emails to collect and acknowledge submissions.
An assessor with a material relationship to an applicant does not review that applicant. A different assessor is assigned.
Assessors do not provide consultancy or paid advice to entities they assess.
AI:OK does not accept gifts or hospitality from applicants or certified entities beyond items of nominal value. Applicants must not offer any payment or benefit connected to an outcome.
Evidence is seen only by the assigned assessor, panel members and a small number of technical administrators. Commercial partners, advisers, funders and other applicants do not see it.
AI:OK does not require applicants to buy any service in order to be certified.
Enterprise Ireland and the Insight Centre for Data Analytics at Dublin City University have funded and supported AI:OK while it was developed. They take no part in assessment decisions and do not receive applicant evidence. Dr Martin Clancy, AI:OK’s founder, wrote the AI:OK Literacy Programme. The programme is optional. It is included with certification through the member portal at no extra charge, and completing it has no effect on any certification decision.
11. Third-party models
A provider’s permission for an applicant’s intended use does not show that the provider’s model was trained on lawfully acquired or appropriately licensed data. A model may rest on a weak basis even where its terms permit the applicant’s use. AI:OK asks what the applicant can demonstrate at that layer, and records what remains unverifiable.
Evidence is tied to a specific, named model version, because the data behind a model can change between versions.
12. Commercial use
Commercial use means use in the course of a commercial activity, whether or not the end user is charged. A free system that advances the provider’s business is in commercial use.
13. Lifecycle
Certification lasts twelve months. An annual review is required in every case, whatever interim review or re-certification has taken place.
Material changes to training data, model structure, rights arrangements, ownership or control, third-party model dependencies or deployment markets must be disclosed to AI:OK promptly.
A material change to training data, model architecture or the rights basis on which certification was granted will normally require re-certification, not disclosure alone, because it changes the basis on which the trustmark was assessed. Other material changes, including to deployment markets, ownership or control, may require an interim review at AI:OK’s discretion.
The trustmark may be suspended or revoked where the Revocation Protocol applies.
If a new version of the standard has been published, the annual review is carried out against the current version, and AI:OK tells the entity what has changed before the review starts.
14. Publication and appeals
Each certification appears on the public registry with entity name, certificate number, status, scope, issue date and review date. An applicant that does not receive certification may appeal, or reapply with clarified information or further evidence.
15. Complaints about AI:OK
Complaints about how AI:OK has handled an application or certification can be sent to legal@ai-ok.org. They are handled by a person who was not involved in the matter.
16. Maintaining the Standard and this methodology
AI-OK Limited owns the AI:OK Certification Standard and this methodology. It reviews them each year. Changes are listed with their date in the version notes on the Standards page and take effect 30 days after publication, unless a change in law requires earlier effect. Certified entities are assessed against the current version at their annual review. AI:OK welcomes questions, challenges and corrections from applicants, certified entities, rights holders and anyone who relies on a certificate. Write to info@ai-ok.org.
17. Terms used
Applicant: an entity that has applied for certification or joined the waiting list.
Certified entity: an entity whose certification is current and neither suspended nor revoked.
Scope: the boundary of what a certificate covers: company, product or service, individual model, or catalogue.
Dataset and Source Register: the list of every dataset, source and training input, referring to the actual assets used.
Gating condition: a condition that must be met for certification to proceed. There are four.
Conditional Certification: certification granted with a remediation plan and a re-review date.
Status: the current state of a certificate on the registry: Certified, Conditional, Under Review, Suspended, Revoked or Expired.