Advisory & assurance services
Cloud Security Alliance assurance program extending its STAR registry to AI services, with a Level 1 self-assessment against the AI Controls Matrix questionnaire, an automated validation option, and a Level 2 tier referencing third-party certification. Registry-based transparency for AI providers rather than a regulatory conformity assessment.
service · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Advisory & assurance services · AI risk & compliance management · Agent security & threat detection
Useful conversation with: CISO, Head of Trust & Compliance, AI product owner.
Demonstrate a completed AI-CAIQ submission for an agent platform and what the Valid-AI-ted scoring adds over a plain Level 1 self-assessment.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Documented by provider
CSA describes STAR for AI with a Level 1 designation earned by completing and submitting the AI-CAIQ self-assessment to the STAR Registry, an enhanced Level 1 validated by the Valid-AI-ted automated system, and a Level 2 tier referencing ISO/IEC 42001 certification.
Limit: Level 2 requirements and auditor qualification rules were not fully verified; CSA is not an accreditation body for regulatory conformity assessment.
Documented by provider
CSA states the AI Controls Matrix contains 247 control objectives across 18 domains with mappings to ISO/IEC 42001, ISO/IEC 27001, BSI AIC4, the EU AI Act and NIST AI RMF, and that it is the foundation for STAR for AI.
Limit: The matrix is a control framework and mapping artefact; mappings are CSA's interpretation and are not endorsed by the mapped standards bodies.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction