The British Standards Institution has launched three assessment schemes covering high-risk biometric AI, the performance of large language model applications and AI product risk management. The practical distinction matters: a test of how an AI application performs is not the same thing as a regulatory conformity assessment, and a certificate is only useful if you know what it actually covers.
Watch Desk analysis
What happened
The schemes were announced on 14 October, according to Biometric Update. For high-risk biometric AI, BSI says its assessment follows the EU AI Act’s process for reviewing technical documentation, quality management and, where applicable, model capabilities and datasets. The service is currently a pilot while BSI works towards designation as an AI Act Notified Body. Until then, it supports preparation for conformity assessment, rather than providing formal regulatory certification.
The LLM scheme tests implemented applications, including chatbots, retrieval-augmented generation systems and summarisation tools. Its measures can include correctness, factual consistency, relevance, toxicity and summarisation quality, assessing the finished application with its data, prompts, retrieval systems and safeguards, not just the underlying model.
The third scheme assesses how a particular AI product or system identifies and manages risk, using the NIST AI Risk Management Framework and ISO/IEC 23894. BSI says successful organisations receive a certificate, a technical report and its Mark of Trust. This is not a substitute for regulatory conformity assessment.
Why it matters
“AI assurance” can mean several different things. A product might be tested for performance, assessed for risk management, or subject to formal conformity assessment under regulation. Those are not interchangeable badges, particularly for buyers deciding whether a system is ready to use or regulators determining what is required for market access.
The schemes also address different parts of the stack, from an organisation’s governance to an individual application’s results. BSI says a survey it commissioned found that only a quarter of business leaders had a formal AI governance programme. That is the organisation’s research, not an independent measure of the whole market.
Our read
This is a useful expansion of the machinery for checking AI, provided the label on the certificate does not do more work than the assessment behind it. For now, the biometric service is preparation, not formal certification. Buyers should ask what was examined, against which requirements, by whom, and what the result is recognised to mean. A certificate is not a magic wand; the scope is the point.
What to watch
- Whether BSI gains designation as an AI Act Notified Body.
- What evidence and testing methods the LLM assessments use in practice.
- How buyers and regulators distinguish formal conformity assessment from voluntary testing and risk reviews.
- Whether other assessors offer comparable schemes, and how their scopes differ. Read Biometric Update’s report.
Discussion spark: When buying or deploying an AI system, which assurance should carry the most weight: independent performance testing, a risk-management assessment, or formal regulatory conformity assessment?
Sources and evidence
- Source update (16 October 2026, 16:48 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.