Cloud Security Alliance Launches STAR for AI Level 2 Certification

The Cloud Security Alliance (CSA) has launched STAR for AI Level 2, a third-party-verified assurance designation that extends its long-running STAR certification programme from cloud security into AI governance. Announced on 12 November 2026, the new level gives organisations a formal route to demonstrate that their AI systems operate under recognised governance and risk-management standards, verified independently rather than self-attested.

The stakes are straightforward. Businesses face growing scrutiny from customers, partners and regulators over how they govern, secure and monitor AI systems in operational use, and CSA has built the programme to convert existing compliance investments into evidence of AI oversight. Jim Reavis, Chief Executive Officer and Co-founder of the Cloud Security Alliance, framed the designation as a trust mechanism for accelerating AI adoption.

"As organizations accelerate their adoption of AI, demonstrating responsible governance and effective risk management is essential to building trust and enabling sustainable innovation," Reavis said. "STAR for AI Level 2 gives organizations a way to show their commitment through independent certification and a structured assessment of AI-specific controls."

What does STAR for AI Level 2 actually certify?

The programme combines two mechanisms. The first is independent certification, in which a third party assesses an organisation's AI governance against defined standards. The second is automated analysis delivered through CSA's Valid-AI-ted for AI process, which examines the organisation's documented control responses.

Both mechanisms align with the CSA AI Controls Matrix, a sector-specific catalogue of controls covering AI governance and AI risk management. Every certification path requires a Valid-AI-ted AI-CAIQ submission — a completed version of the Consortium's AI Controls Inventory Assessment Initiative Questionnaire, the standard self-assessment instrument used across CSA programmes.

The result is a single AI assurance designation that consolidates work organisations may already perform under separate security and AI management certifications. CSA positioned the launch as a response to a market shift in which companies, customers and regulators increasingly demand formal, verifiable methods for assessing how AI systems are managed in production.

Which certification paths are available?

CSA has defined three routes to STAR for AI Level 2, matched to an organisation's current assurance status:

• Path 1: ISO/IEC 27001:2022 plus the AI Controls Matrix. This route extends an existing cloud-focused STAR certification (the information-security management standard ISO/IEC 27001:2022 forms its base) into AI-specific controls.
• Path 2: ISO/IEC 27001:2022, ISO/IEC 42001:2023 and the AI Controls Matrix. CSA described this as the broadest assurance route in the new structure, combining information-security management with the AI management system standard.
• Path 3: ISO/IEC 42001:2023 plus the AI Controls Matrix. This path serves organisations that already hold certification under ISO/IEC 42001:2023 — the international management system standard for AI — and want to add further governance transparency.

All three paths require the Valid-AI-ted AI-CAIQ submission, meaning no organisation can reach the designation through standards certification alone.

What about organisations running SOC 2?

CSA is offering a separate attestation route alongside the three certification paths. The option targets companies that want independent validation of both the design and the operating effectiveness of their AI controls — a distinction borrowed from audit practice, where design effectiveness asks whether a control is correctly constructed and operating effectiveness asks whether it functions in practice.

The attestation route allows organisations to build on an existing SOC 2 programme, the widely used US reporting framework for service organisations, and extend that assurance into AI-specific areas. For companies already committed to SOC 2 reporting, this provides a path to AI assurance without pursuing a full management-system certification.

Why does the ISO 42001 anchor matter?

ISO/IEC 42001:2023 has become a focal point for organisations seeking a recognised management system standard for AI, playing a role analogous to what ISO/IEC 27001 has long played in information security. By tying STAR for AI Level 2 to that standard, alongside ISO/IEC 27001 and the AI Controls Matrix, CSA positions its programme alongside frameworks that security and compliance teams already operate.

That anchoring is deliberate. CSA framed the new level as a way to turn existing compliance work into evidence of AI governance, rather than requiring organisations to build an assurance programme from zero. For companies already managing certifications in cloud security, information security or AI management systems, the programme consolidates those efforts under a single AI assurance designation.

Daniele Catteddu, Chief Technology Officer of the Cloud Security Alliance, said the structure is designed to help businesses show that AI oversight keeps pace with deployment.

"As AI becomes increasingly embedded in business operations, organizations need practical ways to demonstrate that their governance practices are keeping pace with adoption," Catteddu said. "STAR for AI Level 2 provides a pathway to build on established standards and assurance frameworks while addressing the unique risks AI introduces."

He added that the designation "helps organizations move beyond stated commitments to responsible AI and provide tangible evidence of the controls and practices supporting their AI systems."

How does the launch extend the STAR programme?

CSA's STAR (Security, Trust, Assurance and Risk) programme has run for years as the mechanism organisations use to document and certify security practices in cloud environments. STAR for AI Level 2 extends that model with a verified AI layer, moving CSA into an area of corporate technology governance that now draws board-level attention.

The framework rests on three components working together:

• recognised international standards (ISO/IEC 27001:2022 and ISO/IEC 42001:2023);
• a sector-specific controls catalogue (the CSA AI Controls Matrix covering AI governance and risk management);
• a required AI questionnaire submission (the Valid-AI-ted AI-CAIQ), analysed through an automated process and paired with third-party certification.

CSA said the new designation is intended to help organisations extend established assurance models from cloud and security into AI oversight. The organisation also noted that the programme is designed for companies that already hold, or want to combine, certifications tied to information security and AI management.

What happens next?

The launch signals that AI governance assurance is converging on the certification infrastructure that cloud security built over the past decade. Organisations holding ISO/IEC 27001, ISO/IEC 42001 or SOC 2 credentials can now convert that work into a verified AI designation through one of four defined paths. As regulatory attention to operational AI systems increases, CSA is betting that independent certification plus automated control analysis becomes the baseline expectation for demonstrating trustworthy AI adoption.