Depth of assurance, not a provider ranking
Silver — Operational Assurance
Does the organisation operate as it claims?
Silver assurance adds operational evidence to the external-evidence baseline, checking whether documented controls are actually used in practice.
Silver assurance examines whether documented supplier and product controls operate in practice. It includes the applicable external-evidence checks from Bronze, then adds operational evidence such as policy implementation, support processes, incident handling, monitoring and control ownership.
What Silver assurance means
Silver describes investigation depth, not a ranking or quality league table. A Silver assessment does not mean a supplier is “better” than a Bronze supplier; it means AI TrustMark examined a deeper operational evidence set for the named scope.
What is checked
Depending on scope, Silver may examine evidence showing how documented controls are implemented, including:
- governance ownership and approvals;
- privacy and data-handling practice;
- operational security processes;
- support and escalation routes;
- incident handling;
- monitoring and review;
- human oversight;
- change management;
- customer or deployment evidence where relevant.
What buyers should look for
Buyers should read the published scope, date, evidence depth, remaining gaps and expiry. Silver is a dated assurance result for a named scope, not government endorsement, UKAS accreditation or ISO certification.
Payment and outcome
Payment buys the Silver investigation depth under the published methodology. It cannot buy a favourable score, review stars, directory position or predetermined certificate result.
See the methodology, independence safeguards and full assurance overview.
Includes all applicable Bronze controls plus operational evidence and authorised synthetic-customer tests. Silver is a depth of investigation, not a mid-tier ranking of providers.
Policy to practice
Controlled privacy-rights, deletion, correction, portability and opt-out tests using synthetic data.
Customer care
Low-volume support tests measuring acknowledgement, meaningful response, escalation and resolution.
Resilience
Backups, restore exercises, recovery objectives, continuity and incident response.
Access and change
MFA, privileged access, joiner/mover/leaver controls, releases, approvals, testing and rollback.
AI governance
Responsible ownership, risk register, escalation, model changes and evaluation processes.
What the result means
The certificate identifies the product, assessment depth, risk classification, Assurance Score, standard version, assessment date and expiry. Bronze, Silver and Gold describe how deeply the named scope was examined. They do not rank providers as bad, good or best. The certificate is not a guarantee that the product is free from every vulnerability, defect or failure.
Start Silver