How certification works
Three stages, and the middle one is somebody else’s judgement rather than your own.
Assess your firm
Work through the 15 Bronze controls across 6 domains in any order. Write an answer in your own words for each, and attach at least one piece of evidence. Progress saves as you go.
An assessor reviews it
An assessment provider authorised by AIGAS scores every control on two axes — how well the control is implemented, and how well it is proven. Both are scored 0 to 3.
Your certificate is issued
Approval and issuance are separate steps. Once issued, your firm appears on the public register with a certificate number, valid for 12 months, that anyone can verify.
Start before you pay
Two parts of AIGAS need no payment at all. Your firm does need an account, which is granted by request rather than self-serve sign-up.
A readiness check, free
Twenty short questions across five areas. It takes about ten minutes and there is nothing to prepare — answer for your firm as it is today. You get a band, a section-by-section breakdown, and a list of where to look first.
An AI tool register, free
Record the AI tools your firm uses. AIGAS computes each tool’s risk band on the server from its proximity to client data, what kind of AI it is, and whether the supplier trains on your inputs. Risk is never a value the firm sets.
What the certificate actually means
A certificate is only worth what the threshold behind it is worth, so here is the threshold.
The pass mark is enforced, not encouraged
Every one of the 15 controls must reach a status score of at least 2 and an evidence score of at least 1. The threshold is binary and enforced by the system rather than by a disabled button — approval is refused at 14 of 15 and accepted only at 15 of 15.
Anyone can check it
Every current certificate is listed on the public register, which needs no sign-in. Ask a firm for its certificate number and check it yourself — there is a public page for a person and a versioned JSON endpoint for a system.
One thing worth knowing before you start: plan for at least two people. Control answers and evidence are written by a compliance lead or a contributor, and only a firm admin can submit the finished assessment for review.