What AI Compliance Certifications Actually Mean

The Problem with Compliance as a Checkbox

Compliance certifications are important. They provide an independent assurance that a vendor meets certain baseline standards. But they are frequently misunderstood - either dismissed as bureaucratic overhead or treated as a complete guarantee of security and data protection.

Neither is accurate. Understanding what each certification actually covers - and what it does not - helps you ask better questions and make better decisions.

ISO 27001: Information Security Management

ISO 27001 is the international standard for information security management systems. A vendor with ISO 27001 certification has demonstrated that they have a structured approach to identifying, managing and mitigating information security risks.

What it means: The vendor has documented processes for managing information security, has been audited by an accredited certification body and undergoes regular review.

What it does not mean: It does not guarantee that no security incident will ever occur. It certifies process and governance, not perfect security outcomes.

When to require it: For any vendor that will process, store or have access to your organisation's data.

SOC 2 Type II: Service Organisation Controls

SOC 2 is primarily used by US-based vendors but is increasingly common globally. Type II (the more rigorous version) means the vendor has demonstrated that their security controls operated effectively over a sustained period, typically six to twelve months.

What it means: An independent auditor has reviewed the vendor's security controls across five trust service categories: security, availability, processing integrity, confidentiality and privacy.

What it does not mean: It does not cover your specific use case or data environment.

When to require it: When evaluating US-headquartered vendors, particularly for cloud-based AI services.

GDPR Compliance

GDPR is not a certification - it is a legal obligation for organisations operating in the UK and EU. When a vendor claims "GDPR compliance," they mean they have structures in place to comply with the UK or EU General Data Protection Regulation.

What it means: The vendor has a legal basis for processing personal data, maintains records of processing activities, has a Data Processing Agreement available and has processes for handling data subject rights requests.

What it does not mean: GDPR compliance is self-assessed by most vendors. It should be verified through a Data Processing Agreement rather than taken at face value.

When to require it: Any vendor that will process personal data on your behalf.

Cyber Essentials: UK Government Scheme

Cyber Essentials is a UK government-backed scheme that verifies a vendor's defences against the most common cyber threats. There are two levels: Cyber Essentials (self-assessed) and Cyber Essentials Plus (independently verified).

What it means: The vendor has implemented basic cyber hygiene controls covering firewalls, secure configuration, access control, malware protection and patch management.

What it does not mean: Cyber Essentials is a baseline, not a comprehensive security audit. Cyber Essentials Plus provides greater assurance than the standard level.

When to require it: For UK-based vendors or vendors working with UK government contracts. Useful as a baseline check even when more comprehensive certifications are present.

The EU AI Act: Emerging Regulatory Framework

The EU AI Act is a new regulatory framework that categorises AI systems by risk level and imposes corresponding obligations on developers and deployers. While still being implemented, vendors operating in or selling to European markets should be aware of their AI Act obligations.

Ask vendors whether they have assessed their products against the EU AI Act risk categories, particularly if you are operating in a regulated sector.

Practical Guidance for Buyers

Do not treat certifications as a pass or fail test in isolation. Instead, use them as a starting point for a conversation.

Ask: when was this certification last audited? By which body? Can I see the certificate? What scope does it cover?

For high-sensitivity deployments, commission your own security assessment or legal review rather than relying on vendor certifications alone.

Key Questions to Ask

• •Which certifications do you hold, and when were they last renewed?
• •Is a Data Processing Agreement available, and can we review it before signing?
• •Where is our data stored and processed - UK, EU, or elsewhere?
• •What is your incident response process if our data is involved in a breach?
• •Have you assessed your products against the EU AI Act risk framework?