Certified, or Just Aligned? AI Certifications and Partnerships, Stated Plainly
AI certifications and partnerships split three ways, and the gap between them decides tenders. A certification is independent written assurance, issued by a third-party certification body, that specified requirements are met. A self-assessment is administered by the vendor itself. An alignment claim is the vendor’s own reading of its own practice. All three appear on capability pages in almost identical language, and a procurement panel decides, from its tender documents, which evidence it requires and whether equivalent evidence is accepted. This page names which of the three applies to Synthesised.ai against each framework it uses, and what each of those frameworks actually attests.
What Each AI Credential Actually Certifies
An AI credential is one of three things, and the wording on a vendor page does not always tell a buyer which. According to ISO, certification is an independent body’s written assurance, in the form of a certificate, that a system meets specific requirements; accreditation is a separate, formal recognition by an accreditation body that the certification body operates to international standards. An attestation records that a licensed firm tested controls over a defined period and wrote a report. A self-assessment records that the vendor ran a toolkit against its own system and kept the output. The table below separates the frameworks Synthesised.ai names by which of those three each one produces.
| Framework | What it attests | Assessed by | Artefact issued | Synthesised.ai position |
|---|---|---|---|---|
| ISO/IEC 42001:2023 | An AI management system, with top-management accountability | Accredited certification body | Certificate | On roadmap (not started) |
| SOC 2 Type II | Controls suitably designed, implemented and effective over a defined review period | Licensed CPA firm | Attestation report | On roadmap (not started) |
| IMDA AI Verify | Governance testing against internationally aligned principles | Self-administered, toolkit-based | Test report, self-generated | On roadmap (not started) |
| NIST AI Risk Management Framework | Voluntary risk-management practice | Not assessed | None exists | Builds to |
| DISR Guidance for AI Adoption | Six essential practices for Australian adopters | Not assessed | None exists | Builds to |
ISO/IEC 42001 was published in 2023 as an international AI management-system standard. IMDA AI Verify is a governance testing framework launched by IMDA and the PDPC in 2022, and an organisation runs it against its own system rather than submitting to an external audit. Neither the NIST AI Risk Management Framework nor Australia’s Guidance for AI Adoption, published on 21 October 2025 as updated and simplified guidance that evolves the Voluntary AI Safety Standard, issues any certificate at all, so a vendor claiming to be “NIST certified” is describing something that does not exist.
Which AI Certifications Actually Exist for a Vendor to Hold?
Three of the five frameworks on this page produce a distinct assurance or testing output a buyer can request, and two produce practice rather than paperwork. ISO/IEC 42001 produces a certificate with a scope statement, an issuing body and an expiry date. SOC 2 Type II produces a dated attestation report covering a named observation window. IMDA AI Verify produces a test report the vendor generates itself, which carries evidential weight as a record of testing rather than as third-party assurance. NIST AI RMF and the DISR guidance produce practice, not paperwork.
Certification, Attestation and Self-Assessment Are Not Interchangeable
Whether a tender that writes “certified” also accepts self-assessment or alignment depends on its stated criteria. The three sit at different evidential levels. Tender requirements determine whether certification is mandatory and whether equivalent evidence is acceptable; assessment depends on the stated criteria. A buyer asking for the artefact by name, rather than for a general assurance, resolves the ambiguity in one email.
Certified, Builds-To or In Progress: Why the Difference Reaches Your Tender
Certified, builds-to and in-progress are three different risk positions, and a tender’s stated criteria decide which of them it accepts. An audited account and a self-prepared one show the same numbers and carry different weight. Alignment language can read as certification to a skimming buyer, so precise wording on a capability page matters.
What “Certified” Means
Certified means a third-party body examined the management system and issued a certificate naming its scope; where procurement requires it, check that the certification body is accredited. The certificate carries a scope statement, an issuing body, an issue date and an expiry date. A buyer verifies it by asking for the certificate itself and checking the scope covers the work being bought, because a certificate scoped to an internal function tells a buyer nothing about the delivery team.
What “Builds To” and “Aligns To” Mean
Builds-to and aligns-to are the vendor’s own account of its own practice, and no external party has tested that account. The claim carries real information when the vendor names the specific framework, maps named artefacts to named clauses, and hands the mapping over on request. It carries none when it appears as a logo strip. Synthesised.ai states every framework relationship at this level today, and states it in those words rather than in language that reads as certification.
What “In Progress” Means, and What Evidence Exists During It
In-progress means the work toward certification has started and no certificate exists yet. The useful question during that period is not when the certificate arrives but what evidence already exists. An organisation part-way through ISO/IEC 42001 has a scoped management system, an assigned owner, a risk register and monitoring records, and each of those is inspectable now. Synthesised.ai treats those running artefacts as the deliverable and the certificate as the confirmation.
What Happens if a Vendor Says “Aligned” and the Tender Requires “Certified”?
Where certification is a mandatory criterion, an alignment claim may not meet it; the outcome depends on the tender’s stated criteria. Tender requirements determine whether certification is mandatory and whether equivalent evidence is acceptable, and an alignment claim answers a different question from a certification requirement. A vendor in that position gains more from naming its actual position early and offering the underlying evidence than from wording the claim to sound closer than it is.
Three Questions That Settle a Credential Claim in One Email
Three questions separate a certificate from a claim. Ask which accredited body issued it and on what date. Ask what scope statement appears on the certificate. Ask which artefacts the vendor produces during delivery that map to the framework’s clauses. A vendor holding a certification answers all three from the document. A vendor building toward one answers the third in detail and the first two plainly.
Where Synthesised.ai Stands Against Each Framework
Synthesised.ai holds no AI certification as of September 2026, states builds-to on every framework it names, and has ISO/IEC 42001 certification, SOC 2 assessment and AI Verify testing on its roadmap, with none of that work yet started. That position appears here in the same words used in every proposal, tender response and capability document the studio produces, because a claim that changes between a website and a bid document is the claim a procurement review tests hardest.
Governance: ISO/IEC 42001 and the AI Management System
ISO/IEC 42001 is the standard Synthesised.ai builds its governance evidence pack against, and certification against it is on the studio’s roadmap, not yet started. The management-system clauses covering top-management accountability, AI risk assessment, impact assessment and monitoring map onto artefacts produced during delivery rather than assembled at audit. The AI governance frameworks explained across the resources library set out what those clauses require of any organisation, independent of who holds a certificate.
Data and Privacy: Singapore PDPA and Australia’s Privacy Act 1988
Personal data handling sits under statute rather than under a voluntary framework, and statute applies whether or not a vendor holds a certificate. Under Singapore’s Personal Data Protection Act, a provider’s obligations depend on its role for the relevant processing; according to the PDPC, a provider acting as a data intermediary carries the Protection and Retention Limitation obligations, plus a duty to notify the organisation it processes for of a data breach as soon as practicable, which differ from an organisation’s full duties. Australia’s Privacy Act 1988 and the Australian Privacy Principles apply to covered entities for Australian engagements. Both are named in scoping rather than deferred to a compliance annex.
Delivery Evidence: What Ships Regardless of Certificate Status
A production build may include a frozen eval-set, an observability layer and a governance evidence pack; the deliverables, timing, acceptance criteria and responsibilities are agreed for each engagement, and none waits on a certificate. The eval-set gates each release before it reaches production. The observability layer logs decisions and spend from the first week. The evidence pack maps delivered artefacts to the frameworks named above and hands over as one deliverable rather than as a separately billed compliance exercise.
Is Synthesised.ai ISO 42001 Certified?
No. Synthesised.ai holds no ISO/IEC 42001 certificate as of September 2026, and certification is on its roadmap, not yet started. The studio builds to the standard, produces the artefacts its clauses call for during delivery, and states that position in these terms until a certificate exists. The same answer applies to SOC 2 Type II and to IMDA AI Verify self-testing.
The Certification Path: What Each Step Requires
Certification tests running evidence, not filed intentions, so the path runs through delivery rather than alongside it. Each step below produces an artefact an auditor inspects. The ISO 42001 explainer covers what the standard itself demands of an AI management system in full.
| Step | What it produces | Where the evidence lives | Who signs it off | Framework reference |
|---|---|---|---|---|
| Scopes the management system boundary | A scope statement naming systems, teams and data in scope | Governance evidence pack | Named accountable owner | ISO/IEC 42001 |
| Documents risks and impacts per system | An AI risk register and impact assessments | Governance evidence pack | Risk owner per system | ISO/IEC 42001, NIST AI RMF |
| Implements controls inside delivery | Named owners, release gates, approval records | Delivery repository | Engineering lead | ISO/IEC 42001 |
| Monitors behaviour after go-live | Observability logs, drift checks, incident records | Observability layer | Operations owner | NIST AI RMF Measure and Manage |
| Audits against the clauses | Internal audit findings and corrective actions | Governance evidence pack | Internal auditor | ISO/IEC 42001 |
| Certifies through an accredited body | Certificate with scope and expiry | Issued externally | Accredited certification body | ISO/IEC 42001 |
The Evidence an Auditor Inspects, Not the Policy They File
An auditor tests whether a control operated, and a policy document records only that someone intended it to. Owner assignments with dates, risk registers with review records, and monitoring logs with retention all demonstrate operation. A policy library with no operating record behind it satisfies neither an auditor nor a procurement panel that asks the same question in different words.
How Long Does ISO 42001 Certification Take?
Duration follows scope and the maturity of existing records rather than a fixed calendar. An organisation already running release gates, risk registers and monitoring logs is shortening a documentation exercise. An organisation starting from policy documents alone is building the operating evidence first. Synthesised.ai publishes no target date for its own certification, because a date without an audit booking behind it is a forecast rather than a commitment.
Red Lines: The Claims Synthesised.ai Does Not Make
Synthesised.ai states no certification it does not hold, names no partner tier it has not been granted, and claims no grant status it has not been awarded. These limits are written into the studio’s own copy standards and apply to proposals and tender responses as well as to this website.
No Certification Claim Until the Certificate Is Issued
The words “certified”, “accredited” and “compliant” appear against a framework only once an artefact exists to support them. Until then the studio writes “builds to” and names the framework precisely. This applies to ISO/IEC 42001, to SOC 2 Type II and to IMDA AI Verify self-testing, all three of which sit on the studio’s roadmap, none yet started.
Partner Tiers Stated as Pending, Not Implied
Synthesised.ai works with Anthropic and Google technology and states no partner tier, because tier confirmation has not been granted. A partner badge carries a defined meaning inside each vendor’s programme, and displaying one ahead of confirmation misrepresents a relationship a buyer is able to verify with the vendor directly. The relationships appear here as working relationships and gain a tier statement once a tier exists.
Grant Vendor Status Stated Exactly
Synthesised.ai claims no government grant vendor status, appointment or accreditation. Enterprise Singapore operates no list of pre-approved Enterprise Development Grant vendors, and grant eligibility is assessed per application against the scheme rules in force. The EDG, MRA and Productivity Solutions Grant schemes cease on 29 September 2026, and from 30 September business grant support is applied for under the EDGE Grant; a buyer scoping grant-supported work receives the position that applies to that specific engagement and scheme at scoping.
When Does a Buyer Treat a Credential Claim as Unproven?
A credential claim is unproven whenever the artefact behind it has no issuing body, no date and no scope statement. Those three attributes exist for every real certification and attestation, and their absence is the fastest signal available to an evaluator. The seven buyer checks that expose deck-builders extend the same test across delivery evidence, sector depth and references.
Brief a Governed Build
The evidence a certification audit inspects is produced during delivery, which is what an AI readiness assessment scopes first. An assessment maps the data, process, governance and skills position of a planned deployment, and the governance dimension of that map is the same material a certification body examines later. Synthesised.ai builds enterprise AI in Singapore and Australia with that evidence attached from the first sprint. Enquiries route through the form below, and no pricing figure appears on this page.
Start a scoped conversation
Every commercial step begins with a scoping conversation, and a written proposal follows it. No list prices appear on this site. Tell us the problem, the stack you already run and the timeline.
Book a discovery call →