A polished audit badge often tells readers less than the audit scope, sampling method and exact standard. Organizational certification is not a certificate that every model output is safe.
Name the assurance object
Distinguish a financial-statement-style assurance engagement, a security assessment, a model evaluation, a process audit and certification of a management system. Ask what was examined, by whom, when and under which criteria. A vendor’s internal benchmark slide is not an independent certification.
Check the boundary
Did the assessor review one subsidiary, one API endpoint, production use, training data, retrieval systems or all organizational activities? A clean finding for an AI management process does not establish that a new model release or third-party plugin is error-free.
Understand ISO/IEC 42001
The 2023 standard describes requirements for establishing and improving an AI management system. It is about systematic organizational governance, not a universal technical test suite that certifies harmless outputs. Verify the issuing certification body, current status and covered scope before repeating a vendor claim.
Request practical evidence
For the user’s intended risk, ask for independent test methodology, datasets, access assumptions, incident history, remediation and current version applicability. No evidence that a test covered multi-turn conversations, vulnerable populations or another language should be reported as unknown rather than silently inferred.
Decision example
Two vendors both say independently audited. One offers a time-bounded security report for a specific service; another offers ISO/IEC 42001 certification covering company-wide governance. These are complementary forms of assurance, not directly comparable numerical scores.
Sources & Further Reading
Evidence checked 25 October 2026. Applicability: Global. This material is general education, not legal, medical, investment or other professional advice. No vendor performance test is implied.