Skip to main content
A
Docs

Certificates

Generate formal compliance certificates for assessed AI systems.

Compliance Certificates

After a successful compliance assessment, Comply can generate a formal compliance certificate. Certificates serve as auditable proof that an AI system has been assessed against specific regulatory frameworks and achieved a documented compliance score.

Generating a Certificate

Certificates are generated from an existing assessment report. The report must exist and contain valid scores.

curl -X POST "http://localhost:8004/api/v1/comply/certificate?report_id=rpt-001" \
  -H "Content-Type: application/json" \
  -d '{
    "organization": "Abu Dhabi Government",
    "issued_to": "Anar Chat System",
    "valid_months": 12
  }'

Response:

{
  "certificate_id": "cert-001",
  "organization": "Abu Dhabi Government",
  "system_name": "Anar Chat",
  "frameworks": ["uae-ai-ethics", "sdaia-ai-ethics"],
  "overall_score": 78.5,
  "issued_at": "2024-01-15T10:30:00Z",
  "valid_until": "2025-01-15T10:30:00Z"
}

Certificate Fields

FieldTypeRequiredDescription
organizationstringYesName of the organization that owns the system
issued_tostringYesName or identifier of the assessed system
valid_monthsintegerNoValidity period in months. Default: 12

Certificate Contents

A generated certificate includes:

  • Certificate ID — Unique identifier for verification
  • Organization — The entity responsible for the AI system
  • System name — The specific system that was assessed
  • Frameworks assessed — Which regulatory frameworks were included
  • Overall compliance score — Percentage score across all frameworks
  • Issuance date — When the certificate was generated
  • Expiry date — When the certificate validity period ends

Certificate Validity

Certificates have a defined validity period. After expiry, the system should be re-assessed to generate a new certificate. Regulatory changes, system updates, or new framework versions may also warrant re-assessment before the expiry date.

Validity and Renewal

Certificates are time-bound. The default validity period is 12 months, but this can be adjusted based on organizational policy and regulatory requirements.

Factors that should trigger re-assessment before expiry:

  • Regulatory updates — When a framework releases a new version with additional requirements
  • System changes — When the assessed system adds new features, changes data handling, or modifies its risk profile
  • Incident response — After a security incident or compliance breach
  • Organizational change — New deployment regions, data types, or user populations

Certificate Verification

Each certificate has a unique certificate_id that can be used for verification:

# Certificates are linked to their source report
curl http://localhost:8004/api/v1/comply/reports/rpt-001

The certificate is permanently linked to its assessment report, preserving the full chain of evidence: system profile, framework requirements, scoring details, identified gaps, and the resulting certificate.

Dashboard

The Certificates page in the Comply dashboard displays all generated certificates with their status (active, expired, revoked), associated frameworks, and scores. Certificates can be filtered by organization, framework, and status.

Multi-Framework Certificates

A single certificate can cover multiple frameworks when the underlying assessment was run against multiple frameworks. This is common for systems deployed across GCC jurisdictions:

# Assess against all GCC frameworks
curl -X POST "http://localhost:8004/api/v1/comply/assess?framework_ids=uae-ai-ethics&framework_ids=sdaia-ai-ethics&framework_ids=qatar-ai-ethics" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

# Generate a single certificate covering all three
curl -X POST "http://localhost:8004/api/v1/comply/certificate?report_id=rpt-002" \
  -H "Content-Type: application/json" \
  -d '{
    "organization": "Ministry of Digital Government",
    "issued_to": "Citizen Services AI Platform",
    "valid_months": 6
  }'

The resulting certificate lists all assessed frameworks with individual and aggregate scores, providing comprehensive compliance documentation in a single artifact.

AssessmentsAPI Reference