What we assess, and how
You can read our approach before you engage us — and so can anyone you show the results to. A standard that cannot show its working is a logo.
The framework
Every assessment covers the same five areas, in the same order. Most organizations score unevenly, and the pattern matters more than the total.
1. Inventory and visibility
What AI is running, including features switched on inside software you already pay for and tools staff or chapters adopted themselves. You cannot govern what you cannot see, so this comes first.
2. Human review and accountability
Who checks the work, and who answers for it. Where AI touches decisions about individual people — certification eligibility, exam scoring, awards, discipline, member scoring — whether a person decides, and whether that decision is recorded.
3. Member and member-company data
Which member data reaches which system, and on what terms. For trade associations, whether competitively sensitive company data is in scope — an antitrust question as much as a privacy one.
4. Disclosure and transparency
What you can tell members, your board and your chapters, and whether it is written down anywhere. This is the widest gap in the sector and usually the fastest to close.
5. Monitoring and response
Day two. Whether anyone reviews what the tools actually did, on a schedule, recorded — and what happens when something goes wrong, decided while nothing is on fire.
Mapped to recognized standards, calibrated for your sector
The framework is anchored to NIST AI RMF and ISO/IEC 42001, the recognized reference points for AI risk management and AI management systems. We map to them deliberately, so findings translate when an accreditor, a regulator or a large member company asks.
What those standards do not do is fit an organization with fifteen staff. ISO/IEC 42001 certification is enterprise-grade — slow, costly, and delivered by bodies with multi-month waiting lists and no sector fluency. It also certifies a management system rather than watching a deployment day to day.
Cimbiotic is the sector-calibrated equivalent: the same underlying discipline, scoped and priced for associations, with the continuous monitoring and public disclosure layer those standards leave out.
What we publish, and what we refuse
We charge for the process, never the outcome
The fee covers the assessment. It does not buy a passing grade, and the price does not change with the finding.
We publish the criteria
The framework is readable before you engage us. Every pass and fail decision has to be defensible against it.
We keep the right to fail and to revoke
An assurance provider that has never refused anyone is not providing assurance. Marks can be withdrawn.
We take no money from anyone we certify
No equity, no revenue share, no board seats from vendors. All material commercial relationships are disclosed.
What we have not built yet
The full criteria — the scoring thresholds, the assessor methodology, the appeals process — are being finalized with our founding cohort, and will be published when that work is done. Founding clients get direct influence over them before they are fixed.
Cimbiotic is aligning to ISO/IEC 17065 as a certification scheme, which is the route by which an external body eventually vouches for our impartiality. We do not currently hold that accreditation, and we will not imply otherwise.
There is a specific gap worth naming rather than leaving you to find. That standard excludes consultancy as an activity of a certification body, and we currently provide advisory work alongside assurance. Running both is a deliberate, time-limited choice while the assurance business is being built — it is what lets us fund this without taking money from anyone we would assess. It resolves when accreditation is actually pursued: the advisory line either ends at that point or moves to genuinely independent ownership.
We would rather tell you that now than have you discover it later. It is the same standard we apply to your disclosures.
See how you score against the five areas.
The free Scorecard walks the same framework in sixteen questions. No sign-up to see your result.