Cloud Security Alliance launches verified AI assurance level

Cloud Security Alliance has launched STAR for AI Level 2, adding third-party-verified AI assurance to its existing STAR framework.

The programme is aimed at organisations that want to show their AI systems are governed under recognised standards. It builds on the group's STAR for AI framework and is designed for companies that already hold, or want to combine, certifications tied to information security and AI management.

STAR for AI Level 2 combines independent certification with automated analysis through CSA's Valid-AI-ted for AI process. It also aligns with the organisation's AI Controls Matrix, which sets out controls for AI governance and risk management.

CSA said the launch comes as businesses face growing scrutiny over how they govern, secure and monitor AI systems in operational use. The new designation is intended to help organisations extend established assurance models from cloud and security into AI oversight.

"As organizations accelerate their adoption of AI, demonstrating responsible governance and effective risk management is essential to building trust and enabling sustainable innovation," said Jim Reavis, Chief Executive Officer and Co-Founder, Cloud Security Alliance. "STAR for AI Level 2 gives organizations a way to show their commitment through independent certification and a structured assessment of AI-specific controls. By achieving this designation, organizations can provide customers, partners, and other stakeholders with greater transparency into their AI governance practices while strengthening the foundation for secure, trustworthy AI adoption."

Certification paths

There are three routes to STAR for AI Level 2 certification, depending on an organisation's current assurance status. One combines ISO/IEC 27001:2022 with the AI Controls Matrix, extending an existing cloud-focused STAR certification into AI-specific controls.

A second combines ISO/IEC 27001:2022, ISO/IEC 42001:2023 and the AI Controls Matrix. CSA described this as the broadest assurance route in the new structure.

The third combines ISO/IEC 42001:2023 with the AI Controls Matrix for organisations that already hold certification under the AI management system standard and want to add further governance transparency. In all cases, a Valid-AI-ted AI-CAIQ submission is required.

CSA is also offering a separate attestation route for companies that want independent validation of the design and operating effectiveness of AI controls. That option allows organisations to build on an existing SOC 2 programme and extend assurance into AI-specific areas.

Governance focus

CSA positioned the new level as a way to turn existing compliance work into evidence of AI governance. The approach reflects a wider market shift as companies, customers and regulators seek more formal ways to assess how AI systems are managed.

ISO/IEC 42001 has become a focal point for organisations seeking a recognised management system standard for AI. By tying STAR for AI Level 2 to that standard, as well as to ISO/IEC 27001 and the AI Controls Matrix, CSA is positioning its programme alongside frameworks many security and compliance teams already use.

Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance, said the new structure is meant to help businesses show that AI oversight is keeping pace with deployment.

"As AI becomes increasingly embedded in business operations, organizations need practical ways to demonstrate that their governance practices are keeping pace with adoption," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. "STAR for AI Level 2 provides a pathway to build on established standards and assurance frameworks while addressing the unique risks AI introduces. This helps organizations move beyond stated commitments to responsible AI and provide tangible evidence of the controls and practices supporting their AI systems."

The launch extends CSA's long-running STAR programme, which organisations have used to document and certify security practices in cloud environments. By adding a verified AI layer, the group is expanding that model into an area of corporate technology governance drawing more board-level attention.

For companies already managing certifications in cloud security, information security or AI management systems, the programme offers a way to present those efforts through a single AI assurance designation. For those using SOC 2 reporting, the attestation route provides a separate path focused on AI controls.

The framework combines recognised standards, a sector-specific controls matrix and a required AI questionnaire submission, creating a formal route for organisations seeking to document how AI systems are governed and monitored.