White Paper 03In planning · 2027
Deployment Conformance: A Certification Framework for Regulated Industries
A deployment-conformance scheme distinct from ISO/IEC 42001 — addressed to the question regulated-industry deployers actually face.
Abstract
Abstract
The paper proposes a certification scheme — distinct from ISO/IEC 42001's organizational management-system standard — that addresses the deployment conformance of specific AI systems in specific regulated contexts (health, finance, employment, critical infrastructure). It defines the assessment dimensions, the evidence requirements, the conformity-assessment-body model, and the relationship between AI SIGMA conformance and existing certification regimes (FDA SaMD, FedRAMP, SOC 2, ISO 27001, ISO 42001). Paper 03 is the foundational document for AI SIGMA's certification program. The certification gap the paper addresses is structural: ISO/IEC 42001 certifies an organization's AI management system; it does not certify a particular AI deployment for a particular regulated use. FDA SaMD certifies software-as-medical-device; it does not address the deployment of frontier AI in non-SaMD clinical contexts. FedRAMP certifies cloud-service infrastructure; it does not address model-level conformance. The result is a series of overlapping organizational, infrastructural, and product-level certifications, none of which speak directly to the question regulated-industry deployers actually face: is this AI system fit for this use, in this jurisdiction, under this risk regime? The paper proposes a deployment-conformance scheme structured around four assessment dimensions: capability fitness for the regulated use; control adequacy at deployment; monitoring and incident-response capacity; and exit-and-deprecation planning. It specifies the evidentiary record an AI deployer would maintain, the role of an independent conformity-assessment body in evaluating that record, and the certification mark that follows. It maps the proposed scheme against existing regimes (FDA, FedRAMP, SOC, ISO) to identify overlap, complementarity, and the specific gaps the new scheme is needed to close.
Outline
Outline
- Outline forthcoming as the founding cohort convenes.
Status
Status
Why this paper
Corporate counsel, compliance officers, and procurement teams across health, finance, employment, and critical-infrastructure sectors are now actively asking how to evaluate AI deployments under the regulatory regimes they already operate. Paper 03 provides the assessment scheme. It also operationalizes Pillar II of the Institute (Deployment Conformance), which is currently described on the homepage as a goal without an articulated path. Paper 03 is the path.
Status
Paper 03 is in planning. The founding cohort will set the final scope, sequencing, and timing. A draft outline and a public-comment timeline will be published once the cohort convenes.
Notify me when this paper publishes
Suggested citation
Marc Hoag, Deployment Conformance: A Certification Framework for Regulated Industries, AI SIGMA (in planning, target 2027), https://aisigma.org/research/deployment-conformance.Hoag, M. (in planning, 2027). Deployment conformance: A certification framework for regulated industries. AI SIGMA. https://aisigma.org/research/deployment-conformance