AI Attestation vs Certification vs Audit: Definitions

Definitions that hold up under review

Regulated enterprises often use attestation, certification and audit as synonyms in questionnaires, regulator correspondence and procurement documents. Standards bodies and regulators do not. Using the terms precisely sets expectations about who does the work, against which criteria, and what evidence must exist.

Attestation. NIST, citing ISO/IEC 17000, defines attestation as the issue of a statement, based on a decision, that fulfillment of specified requirements has been demonstrated. NIST separates first-party attestation (self-attestation, declaration or a supplier's declaration of conformity), second-party attestation (by the purchaser) and third-party attestation by an independent party.

Certification. NIST describes third-party attestation as also known as certification, and its glossary defines certification as third-party attestation related to an object of conformity assessment, with the exception of accreditation. ISO describes certification as an independent body providing written assurance, a certificate, that an item meets specific requirements. ISO itself does not issue certificates; they come from an external certification body. The same NIST glossary also carries an older FIPS 200 sense, a comprehensive assessment of security controls in support of accreditation, so confirm which meaning a requester intends.

Audit. The EU AI Act gives the clearest usage. The notified body carries out periodic audits to confirm the provider maintains and applies its quality management system, gives the provider an audit report, and may run additional tests on AI systems that already hold a technical documentation assessment certificate. Audit here is recurring and report-producing, and it follows certification rather than replacing it.

Conformity assessment is the umbrella. The EU AI Act defines it as the process of demonstrating whether the requirements for a high-risk AI system have been fulfilled, and a conformity assessment body performs third-party activities such as testing, certification and inspection.

Side-by-side comparison

The matrix below compares the three on the dimensions compliance teams are most often asked about. The dimensions interact: independence follows from who performs the work, and the output follows from the independence and criteria.

• Who performs it: Attestation: the supplier, the purchaser or an independent party. Certification: an independent external certification or conformity assessment body. Audit: an internal team or an external body; under the EU AI Act, the notified body.
• Criteria: Attestation: the specified requirements named in the statement, such as a standard, a regulation or a customer control set. Certification: specific requirements in a standard or regulation. Audit: the requirements the audited process must meet, such as a maintained and applied quality management system.
• Scope: Attestation: whatever the statement covers. Certification: an object of conformity assessment, such as a product, service, process, system or person. Audit: how a system or process is operated and maintained over time.
• Independence: Attestation: varies by party; first-party is self-declared, second-party is the purchaser's view, third-party is independent. Certification: independent by definition. Audit: depends on who audits; notified-body audits are third-party.
• Output: Attestation: a statement or declaration. Certification: a written certificate. Audit: an audit report, which under the EU AI Act may follow additional testing.
• Duration: Attestation: a statement tied to the point at which it is made unless reissued. Certification: follows an assessment decision, with validity set by the scheme or requester. Audit: recurring, as in the EU AI Act's periodic notified-body audits.

Matching each mechanism to the request

The practical question is rarely which mechanism is best. It is which one the request actually asks for.

A customer security questionnaire answered by your own team is a first-party attestation. Label it that way, and do not describe it as certified or audited. If the purchaser evaluates your evidence itself, that evaluation is second-party attestation. A procurement requirement that names an independent certificate is asking for certification, which only an external body can issue. If a requirement states a recurring examination with a report, it is asking for audit.

A regulator inquiry needs more care. It may ask for a statement of compliance, for documentation of conformity, or for access to records so that the regulator can examine them. Read the request for the verb. Under the EU AI Act, for high-risk AI systems, the relevant constructs are conformity assessment, third-party conformity assessment bodies and notified-body audits. As of October 2026, those are the terms the regulation uses, and internal reviews should not be described as certification.

Providers that use third parties offering certified compliance services for data governance, such as verification of dataset integrity and training, validation and testing practices, remain responsible for ensuring compliance with the data requirements. An external service supports the claim but does not transfer the obligation.

The runtime evidence all three depend on

Attestation, certification and audit are all evidence-dependent. A statement, a certificate or a report is only as credible as the records behind it. For AI systems, the records that matter most are those showing what the system was permitted to do and what it did.

On the permitted side, that means the policies in force at a given time, who approved them, and when they changed. On the behavior side, it means interaction and tool-call records, the decision taken on each (allowed, modified, blocked or escalated), and any human approvals. The EU AI Act describes the risk-management system as a continuous, iterative process across the lifecycle of a high-risk AI system, with regular review and updating, and calls for documentation and justification of significant decisions and actions. Point-in-time evidence assembled for a single review is therefore a weak basis for lifecycle claims.

The same underlying evidence can serve first-, second- or third-party attestation. What changes is who evaluates it and how independent they are. Because notified-body audits recur and can include additional testing, evidence should be retained continuously rather than reconstructed when a request arrives. Retention periods and residency should be decided in advance and documented, so each response can state what records exist and for how long.

Where runtime policy enforcement fits

None of the three mechanisms can substantiate AI behavior without records of how policy was applied. That is the narrow role Trussed plays. Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions such as allow, redact, block, rate limit and escalate for human approval, applied to individual interactions and tool calls. Because enforcement happens at runtime, not reviewed after the fact, it generates audit-ready evidence continuously, mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST.

That evidence can support an attestation, a certification assessment or an audit. Trussed does not perform or replace any of them. Attestation statements, certificates and audit reports still come from the parties described above, and Trussed supplies records for them to evaluate. It can be deployed self-managed in the customer cloud, with configurable retention and data residency, which matters when retention and residency requirements differ by request.