STAR for AI Level 2 gives businesses a new way to check whether an AI supplier's security and governance controls work in practice.
AI suppliers now have a clearer way to prove how they govern security, risk and accountability. On 27 October 2026, the Cloud Security Alliance launched STAR for AI Level 2, an independent assurance route for organisations that build or operate AI systems.
The programme combines third-party certification or attestation with evidence mapped to CSA's AI Controls Matrix. It examines whether documented AI controls exist and whether they work in practice.
There are three certification paths. Companies can combine the AI Controls Matrix with ISO/IEC 27001, ISO/IEC 42001, or both. Businesses with an existing SOC 2 programme can pursue an attestation route. Every path also requires a Valid-AI-ted AI-CAIQ submission, which adds an automated review of the organisation's control evidence.
Most AI procurement still depends on questionnaires, policy documents and vendor claims. Independent assurance gives a buyer stronger evidence before connecting a model or agent to customer records, payments, internal files or business systems.
This does not make an AI supplier risk-free. A certification can still miss poor implementation, new attacks or weak controls outside its scope. Buyers should treat it as one part of due diligence, alongside architecture reviews, data-flow mapping, access limits, incident procedures and contract terms.
For African companies buying global AI services, a recognised assurance framework can make vendor comparison easier. It gives procurement and security teams a shared control language, even when suppliers operate under different national rules.
Ask suppliers which systems and services their assurance covers. Request the current report, control exceptions and remediation dates. Confirm where your data is stored, who can access it, how long it is retained and whether it trains the vendor's models.
For custom deployments, keep sensitive actions behind approval steps, log every tool call and give each agent the minimum permissions required. Xyzee Developers applies these controls when planning AI integrations for business systems.
The practical shift is straightforward: AI purchasing teams can now ask for independently checked control evidence instead of accepting a polished policy page.
0 comments
Loading comments...