The assessment journey, step by step
Six steps, four weeks of work and no surprises. This is how an AI system goes through SoAITrust and comes out with a scorecard, a report and a seal any buyer can verify.
Start with the free pre-assessment
Seven questions about your AI system and the engine picks, out of the 47 controls in the methodology, the ones that matter for your case. An AI generates three follow-up questions from your answers.
10 to 16 adapted controls
Environment security and AI governance, chosen from the profile: data handled, decisions about people, agents, model origin.
Level, gaps and tier
Overall score, main gaps with recommendations, evidence readiness and the recommended diagnostic.
A code to share
The result goes by email with a code, to circulate internally before deciding.
The pre-assessment is self-declared. It helps you see where you stand and lets us calibrate the diagnostic. The seal only comes later, with verified evidence.
We define the scope and the tier
A 45-minute kickoff with the technical lead. We choose the assessed system, the vendor type and the assessment tier, proportional to risk.
Self-service
Low-risk systems. Questionnaire on the platform, automated triage and sample human review.
Assisted diagnostic
Personal data or regulated customers. Mandatory evidence and full human review.
Full due diligence
Credit, fraud, automated decisions, sensitive data. A 15-to-20-page report and an action plan.
A simple contract, the first invoice and platform access on the same day.
Time for evidence
The questionnaire adapts to your answers. Every "yes" asks for proof: a policy, a screenshot, a configuration, a contract. The AI reads what you attach and pre-classifies it; nothing is approved without a person looking.
Evidence instead of a checklist
PDF, image or link. AI triage flags whether the evidence covers the clause or something is missing.
Continuous follow-up
Partial answers generate follow-up questions on the same control until it is closed.
Without stopping operations
All remote and documentary. No penetration test and no access to production.
We analyze and verify at the source
Human review of every control, ISO certifications checked in the IAF CertSearch database, a 5×5 risk matrix and a criticality score. A 60-minute meeting to clear up questions.
Real certifications
ISO 27001, 42001, 27701 and others checked in the certification body's registry, not in a PDF.
Matrix and criticality
Each risk linked to the gaps that support it, with likelihood and impact.
NIST AI RMF, ISO 27001 and 42001
Aligned with NIST AI RMF 1.0, with references to OWASP LLM, MITRE ATLAS, the EU AI Act and LGPD/GDPR.
You receive the scorecard, the report and the seal
A results meeting with leadership. The scorecard goes into proposals and RFPs; the gap report stays with you; the seal goes on your website and proposals, verifiable by any buyer.
Scorecard
Scores per domain, criticality band and maturity level.
Gap report
P1 to P3 findings with recommendations and an action plan with deadlines.
Verifiable seal
Anyone can check it at soaitrust.com/verify: system, scope, date and validity.
Use the result and renew
The seal is valid for 12 months or until a relevant change in the system. During that period, the communications guide helps you take the result to customers, press and social media. Renewal is simplified.
Annual renewal
Reassessment focused on what changed, with simplified conditions for vendors that renew.
One seal, many customers
Every buyer checks the same seal. Their security review starts with 80% done.
Communications guide
How to announce it, what to say and what not to say about the assessment.