CSA Official Press Release
Published 10/27/2026
STAR for AI Level 2 allows organizations to extend existing industry certifications and assurance frameworks into the AI domain
SEATTLE – Oct. 27, 2026 — Organizations are increasingly under pressure to demonstrate that their AI systems are governed safely, securely and responsibly. In response, the Cloud Security Alliance (CSA), the world's leading not-for-profit organization committed to AI, cloud, and Zero Trust cybersecurity education, today announced the availability of the Security, Trust, Assurance, and Risk (STAR) for AI Level 2. Building on the STAR for AI framework, Level 2 brings third-party-verified AI assurance to the STAR program alongside traditional cloud certification, allowing organizations to demonstrate global AI compliance and operational transparency.
“As organizations accelerate their adoption of AI, demonstrating responsible governance and effective risk management is essential to building trust and enabling sustainable innovation,” said Jim Reavis, CEO and co-founder, Cloud Security Alliance. “STAR for AI Level 2 gives organizations a way to show their commitment through independent certification and a structured assessment of AI-specific controls. By achieving this designation, organizations can provide customers, partners, and other stakeholders with greater transparency into their AI governance practices while strengthening the foundation for secure, trustworthy AI adoption.”
STAR for AI Level 2 is designed for organizations that have achieved third-party certification to ISO/IEC 42001 (the AI Management System standard) and want to demonstrate a higher level of AI governance maturity. The designation combines independent certification with automated analysis through Valid-AI-ted for AI, helping organizations demonstrate transparent, evidence-based AI governance aligned with CSA’s AI Controls Matrix (AICM) and related standards.
“As AI becomes increasingly embedded in business operations, organizations need practical ways to demonstrate that their governance practices are keeping pace with adoption,” said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. “STAR for AI Level 2 provides a pathway to build on established standards and assurance frameworks while addressing the unique risks AI introduces. This helps organizations move beyond stated commitments to responsible AI and provide tangible evidence of the controls and practices supporting their AI systems.”
Depending on an organization's existing certifications and maturity levels in AI governance and cloud security, there are three paths to STAR for AI Level 2 Certification:
- ISO/IEC 27001:2022 + AICM. For organizations with a strong foundation in information security (ISO/IEC 27001) and that are looking to extend their assurance to AI-specific controls through the AICM. It is an extension of the existingSTAR Certification (for cloud).
- ISO/IEC 27001:2022 + ISO/IEC 42001:2023 + AICM. For organizations that want to achieve the most comprehensive assurance posture available.
- ISO/IEC 42001:2023 + AICM. For organizations already certified under ISO/IEC 42001 and that wish to enhance their governance and transparency through the addition of the AICM framework.
Organizations seeking independent validation of their AI controls’ design and operating effectiveness can build on their existing SOC 2 program to extend assurance to AI-specific controls and pursue STAR for AI Level 2 Attestation. (Regardless of whether an organization pursues STAR for AI Level 2 Certification or Attestation, a Valid-AI-ted AI-CAIQ submission is required.)
Learn more about the benefits of achieving STAR for AI Level 2 and the broader STAR for AI program. About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading not-for-profit organization committed to awareness, practical implementation, and credentialing of forward-looking cybersecurity topics, including AI, cloud, and Zero Trust. In an era where digital transformation drives business success, CSA stands as the global authority ensuring organizations can operate securely while harnessing cutting-edge technology. Through the 501(c)3 CSAI Foundation, volunteer-driven research, globally-accepted standards, and award-winning vendor-neutral education programs that unite varied associations, governments, chapters, and corporate members, CSA bridges the gap between innovation and pragmatic security execution. Visit CSA’s website to learn more.
Media Contact
Kristina Rundquist
ZAG Communications for the CSA
kristina@zagcommunications.com
About Cloud Security Alliance #
The Cloud Security Alliance is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations and other key stakeholders. For further information, follow us on Twitter @cloudsa.
For press inquiries, email Zenobia Godschalk of ZAG Communications or reach her by phone at 650.269.8315.