Depth of assurance, not a provider ranking
Gold — Technical Assurance
What happens when the technology itself is examined?
Gold assurance adds technical examination to the operational and external evidence layers for a named AI product or service.
Gold assurance is AI TrustMark's deepest standard investigation layer. It includes applicable Bronze and Silver evidence checks and adds technical examination where access is granted, including architecture, dependencies, APIs, data flows and AI-specific security controls.
What Gold assurance means
Gold describes how deeply the named scope was examined. It is not a supplier ranking, government approval, UKAS accreditation or ISO certification.
What technical evidence may be examined
Depending on scope and access, Gold may examine:
- system architecture and trust boundaries;
- model, API and infrastructure dependencies;
- data flows and storage;
- authentication, authorisation and administrative controls;
- logging and monitoring;
- AI-specific threat controls;
- tool or agent permissions;
- model and provider change controls;
- testing and evaluation evidence;
- incident and vulnerability handling.
Technical access matters
Gold does not imply unrestricted source-code access. The public result should state what was available for examination and any material limitations.
How buyers should use Gold
Use the published scope, technical depth, findings, unresolved gaps, assessment date and expiry as evidence within your own procurement or assurance process.
Payment and outcome
Payment buys technical investigation depth. It cannot buy a higher Assurance Score, directory position, review stars or a predetermined certificate outcome.
See the methodology, independence safeguards and full assurance overview.
Includes applicable Bronze and Silver controls and normally requires temporary, read-only technical access. Gold is a depth of investigation, not a claim that the provider is the “best”.
Secure engineering
SAST, dependency and secret scanning, SBOM, provenance, licences, IaC and CI/CD controls.
AI architecture
Models, providers, RAG sources, vector stores, prompts, tools, memory, gateways and data flows.
Adversarial testing
Safe prompt-injection, retrieval, data-exfiltration, tenant-isolation, approval and agent-tool tests.
Reliability
Repeatable product-specific evaluation of accuracy, grounding, consistency, refusal and regression.
Human oversight
Reversibility, appeal, human escalation and protection against bypass of consequential review.
What the result means
The certificate identifies the product, assessment depth, risk classification, Assurance Score, standard version, assessment date and expiry. Bronze, Silver and Gold describe how deeply the named scope was examined. They do not rank providers as bad, good or best. The certificate is not a guarantee that the product is free from every vulnerability, defect or failure.
Start Gold