Skip to content

For vendors

Certification

Free of charge, against a public checklist, with an audit report for every criterion.

How it works

  1. ApplicationOnline at nocip.com. You name the product and the tier you expect.
  2. Self-assessmentOne answer per criterion, with architecture description and test access.
  3. Auditbe next audits against the published audit checklist: network capture, test corpus, fault tests, documents.
  4. Audit reportResult per criterion, tier and index. You can fix criteria that were not met.
  5. Label and registerLabel agreement, ID, register entry, logo kit and badge.
  6. RenewalAnnual re-audit; spot checks while the label is valid.

From a complete self-assessment to the audit report usually takes four weeks.

Which tier fits?

  • Does every AI function run on your customer's computer or server and work offline? → Gold.
  • Do you run the models yourself on your own or exclusively rented servers in the EEA (SaaS)? → Silver, variant S-a.
  • Do you use a third-party AI, but only for requests without personal data, with a router deciding? → Silver, variant S-b.
  • Do you send personal content to a third-party AI, but pseudonymise it first? → Bronze.
  • Do you send personal data unprotected to a third-party AI? → No NOCIP label. This guide shows which criteria you would need to meet for Bronze.

You apply for the tier you expect. If your product does not fully meet it, it receives the highest tier whose criteria it meets.

What to prepare

  • The completed self-assessment, including the model inventory and the connection list.
  • An architecture description: which AI functions exist and where each one is processed (a data-flow diagram is enough).
  • A test installation or test access with all AI functions, for at least six weeks.
  • For SaaS: data processing agreement, list of sub-processors, hosting contracts.
  • For Bronze and Silver S-b: the third-party AI's contract or terms and the selected region.
  • If your product uses certificate pinning: a test build without pinning, or a log of the outgoing data.

Fees and auditor

The audit and the label are free of charge. If a criterion is not met, you can fix it; the first retest is also free of charge.

Audits are carried out by be next GmbH. be next itself offers pseudonymisation software, LexITanon. That is why the audit checklist is public, every audit follows it, and be next publishes the full audit report of its own products. We treat your documents and test results as confidential.

After the audit

  • You receive the audit report with the result for each criterion, the tier and the index.
  • With the label agreement you receive the ID (e.g. NOCIP-S-2026-0003), the logo kit and the badge for your website. The badge always shows the current status from the register.
  • The label is valid for 12 months. You report changes to the AI architecture within 30 days, and changes that lower the tier before they go live.
  • NOCIP may carry out spot checks while the label is valid.

Frequently asked questions

We use a cloud provider's models in our own account in Frankfurt. Is that Silver?

No. A cloud provider's model services count as third-party AI, even when hosted in the EU, because the cloud provider runs the model. Silver S-a requires that you run the models yourself. With pseudonymisation in front, Bronze is possible.

Our product has AI functions at different tiers. Which one applies?

The lowest. The label describes the product as customers use it. If a function can be switched off, you can have a product variant without it audited.

Isn't pseudonymised data still personal data?

For you as the sender, yes (GDPR Art. 4(5)). For a recipient without access to the mapping table, CJEU case law says they may not be. Bronze therefore requires that the mapping table is never transferred, and forbids calling such data “anonymous”.

Our product lets users send us examples of errors. Is that compatible with Gold?

Yes, if the user triggers each report, the product first replaces personal data with invented data, a preview shows exactly what is sent, and you use the reports only to improve the product (criterion C-08).

Do we get the test corpus in advance?

No. It is not published, so that results stay comparable. The categories and thresholds are in the criteria catalogue.

May we advertise with the label while the audit is running?

No. You may show the label only after the label agreement has been concluded.

Documents and application

The applicant guide, criteria catalogue, self-assessment and audit checklist are available in English and German.

Apply for a label