Certification — what CSOAI measures and does not

CSOAI measures AI compliance with statute on published harnesses. CSOAI does not certify, accredit, or designate. The boundary is structural, not strategic. A measurement body and a certification body cannot be the same operation without breaking independence — the entire value of an independent measurement is that it can be consumed by an accredited certifier without conflict of interest.

What CSOAI is

A measurement body: publishes harnesses, runs them, signs the results, makes them recompute-able.
An evidence producer: a notified body, regulator, or counsel can take our signed records and use them as audit evidence.
An Ed25519 signer: every published figure carries a signature verifiable against /.well-known/agent.json.

What CSOAI is not

Not a certification body. A certification body is accredited by UKAS (UK) or an EU NAB, and operates under ISO/IEC 17065 plus ISO/IEC 42006 for AI. CSOAI is neither accredited nor applying.
Not a notified body. A notified body is designated by an EU Member State. They have statutory authority to issue CE marks. CSOAI has no such authority.
Not a regulator. Enforcement powers under the EU AI Act rest with national market-surveillance authorities and the AI Office. There is no mechanism to delegate them to a private company.
Not legal counsel. Nothing on this site is legal advice.

Why the boundary matters

Independence is the entire moat. A body that measures AND certifies has no independent voice — its clients pay for the certification, and the measurement follows the same money. An AI vendor that buys a "compliance rating" from the same body that will mark the regulator's file has bought a rubber stamp.

CSOAI's structural choice: we measure, we sign, we publish the measurements, and the regulator or auditor or counsel makes the conformity call. The measurement is the diagnostic; the conformity call is the regulatory decision.

How our measurements are used by others

Notified bodies can take our signed runs as part of their technical-file evidence. The signed record is verifiable; the conformity opinion is theirs.
Regulators can use our records as informational input. They remain the regulators.
Internal compliance teams can use our harnesses to test their own systems before filing with a notified body.
AI vendors can publish their CSOAI run beside their own declarations — a public, verifiable, signed record of what was measured.

Boundary

This is the law, not a marketing choice. If you wanted a certification, you need a certification body accredited under ISO/IEC 17065 plus (for AI) the ISO/IEC 42006 scheme. The lawful route to accreditation is documented, slow, and rigorous. We do not shortcut it; we do not pretend to hold it.