The AI:OK Standards

What AI:OK checks.

The AI:OK Certification Standard has 33 requirements in five areas. Every requirement is assessed through a question in the Quick Check, Core or Extended form, shown beside it. Nothing is assessed that the forms do not ask, so every requirement can be checked against evidence. How the standard relates to other frameworks, including the EU AI Act, is on the Framework page.

The requirements reflect the questions that labels, publishers and platforms put to AI vendors about training data and rights, and the transparency duties now appearing in law and in chart rules. The first area, Rights and Provenance, carries the four gating conditions.

How the standard works

• Quick Check screens eligibility across five areas: what the system does, its model structure, whether datasets can be identified, rights for commercial use, and anything in the intended use that would prevent certification.

• Core Certification assesses areas A, B and C in depth. This is where the trustmark is granted or withheld.

• The Extended Framework assesses areas D and E, and the operational side of B, after certification.

Four conditions are gating. Each is marked with an asterisk below. If one is not met, certification cannot proceed and Conditional Certification is not available.

1. Datasets used for training can be identified (A1).

2. Explicit rights for commercial AI training and deployment are held (A3).

3. No restricted, non-commercial or research-only data is used commercially without appropriate rights (A5).

4. There is no material misrepresentation in the application (A9).

Everything else can be addressed through Conditional Certification, with a remediation plan and a re-review date.

A. Rights and Provenance

• A1*. Datasets and sources used to train, refine or evaluate the system can be identified. The underlying assets must be known. A catalogue or manifest alone is not enough. Assessed in: Quick Check 4.3. Core 2, 3.1.

• A2. Rights in a dataset list, catalogue or manifest are separated from rights in the content inside it, and both are addressed. Assessed in: Quick Check 4.3. Core 3.4.

• A3*. Explicit rights from the relevant rights holders or authorised licensors cover commercial AI training and commercial deployment, for every source containing third-party content. Assessed in: Core 4.1, 4.3, 4.4.

• A4. Explicit rights cover fine-tuning and continued improvement. Assessed in: Core 4.2.

• A5*. Non-commercial, research-only, evaluation-only or otherwise restricted data is not used commercially without appropriate rights. Assessed in: Core 3.5, 4.6.

• A6. Where a third-party model is used, the provider’s terms for training, development and deployment are addressed, and the applicant states what it can and cannot show about the provider’s own training. Assessed in: Quick Check 4.4. Core 3.2, 4.5, 6.4.

• A7. Where synthetic data is used, its source and lineage are identified. Assessed in: Core, synthetic data question.

• A8. Evidence is tied to a named model and version. Assessed in: Core, model name and version.

• A9*. The application contains no material misrepresentation. Assessed in: Declaration made when the online form is submitted.

B. Data and Sources

• B1. The Dataset and Source Register is complete: name, provider or supplier, licensor or rights holder, asset type, role in the system, licence type, evidence reference. Assessed in: Core 2.

• B2. Sources are classified: licensed or purchased, internally owned, vendor-supplied, open or public, non-commercial or restricted, scraped or web-collected. Assessed in: Quick Check 4.3. Core 3.2.

• B3. The limits of open licences are understood. A stated licence on a dataset does not settle the rights status of the content inside it. Assessed in: Quick Check 4.3. Core 3.2.

• B4. Data security, retention and deletion practices exist. Assessed in: Extended 3.4, 3.5.

• B5. Sharing of data with third parties is disclosed. Assessed in: Extended 3.1, 5.4.

C. Transparency and Records

• C1. The applicant knows which training data transparency duties apply to it. Assessed in: Core 5.1.

• C2. The applicant can disclose its training sources on request. Assessed in: Core 5.2.

• C3. Records are kept in a form that could be produced to a regulator or rights holder. Assessed in: Core 5.3.

• C4. Material changes are disclosed to AI:OK promptly, and changes to training data, model architecture or the rights basis are notified for re-certification. Assessed in: Core 10.

D. Accountability and Governance

• D1. Responsibility for AI governance is assigned, and concerns can be reported. Assessed in: Extended 7.2.

• D2. Risk assessment and plans for harmful behaviour and system failure exist. Assessed in: Extended 5.2.

• D3. Humans oversee the system and can intervene. Assessed in: Extended 5.7.

• D4. System documentation is created, maintained and accessible. Assessed in: Extended 5.3.

• D5. Third-party software, models and suppliers are assessed. Assessed in: Extended 5.4, 5.5, 7.6.

• D6. Quality is tested and reviewed. Assessed in: Extended 5.1, 5.5.

E. Culture and Community

These requirements do not gate the trustmark. They are reviewed after certification.

• E1. Bias and representation across genre, gender, geography, language, and independent and major-label artists. Assessed in: Extended 5.8.

• E2. Cultural and sector impact, including intellectual property and fair compensation. Assessed in: Extended 6.

• E3. Users can understand the system, choose how their data is used and report problems. Assessed in: Extended 4.1 to 4.3.

• E4. Accessibility, including EU Accessibility Act requirements where they apply. Assessed in: Extended 4.4.

• E5. Child safety. Assessed in: Extended 7.7.

• E6. Responsible marketing. Assessed in: Extended 7.8.

• E7. AI literacy for staff, users and API clients. EU AI Act Article 4 requires providers and deployers to take measures to support AI literacy. Assessed in: Extended 8.

• E8. Sustainability. Assessed in: Extended 7.3.

• E9. Guidelines for developers and partners building on the system. Assessed in: Extended 7.4.

What the standard does not assess

The standard does not assess whether a system prevents imitation of a named artist’s voice or likeness, how consent or opt-out requests from rights holders are handled in operation, or whether any individual output infringes a right. Certification does not speak to those points. AI:OK may add them to a future version of the forms and the standard, and will publish any change before it applies.

Version notes

This page restates AI:OK Certification Standard v3 (28 September 2026). A certificate shows the version it was assessed against. AI:OK reviews the Standard each year. Each change is listed here with its date and takes effect 30 days after publication, unless a change in law requires earlier effect. Certified entities are assessed against the current version at their annual review.

• Version 3, 28 September 2026. Current version. 33 requirements in five areas, with four gating conditions.

• Website text revision, 12 October 2026. The certification process and the forms did not change.

Send questions or suggestions about the Standard to info@ai-ok.org.