Version 1.0 · 29 Oct 2026 · Draft
Every requirement, every threshold and how we audit it. A label always names the catalogue version it was audited against.
A product receives the highest tier whose criteria it fully meets. The common criteria (C) apply to every tier.
The product and the vendor's website state the NOCIP tier and say where AI processing takes place. Users can find this statement before first use (e.g. product page, settings, documentation).
The documentation lists every model used for the product's AI functions: name, version, licence, origin and where it runs (customer, vendor or third-party AI, with country).
Customer content is not used by the vendor or any third party to train or fine-tune models unless the customer explicitly opts in. Opt-in is off by default. Fine-tuning that takes place only on the customer's own systems is allowed.
Telemetry, usage statistics, crash reports and remote logs contain no document content, prompts, AI output or personal data taken from processed content.
The vendor reports changes to the AI architecture (new model or model provider, new processing location, new external connection, changed router or pseudonymisation) to NOCIP within 30 days. A change that leads to a lower tier is reported before it goes live.
The vendor lists every outgoing network connection the product makes (destination, purpose, data sent). Processing the test documents creates no connections outside this list.
If the vendor processes customer data (e.g. SaaS, remote support), it offers a data processing agreement under GDPR Art. 28 that names all sub-processors with access to AI input or output. Does not apply if the vendor receives no customer data.
If the product sends examples to the vendor at the user's request (e.g. to improve recognition), then only like this: (1) the user triggers each report, never automatically and never as a default. (2) The product first replaces personal data with invented data of the same format, without a mapping table. (3) A preview shows exactly what is sent, and the user can change it; words the user keeps in the original are confirmed once more before sending. (4) The vendor uses reports only to improve the product and does not pass them on. Does not apply if the product sends no reports.
Threshold: Replaced: ≥ 99 % of structured identifiers (IBAN, e-mail, phone, ID and tax numbers), ≥ 98 % of person names and ≥ 95 % of all canary values – as B-03.
GoldAll inference for AI functions runs on the customer's devices or servers (own hardware, or a cloud environment the customer controls itself). No AI request goes to the vendor or to third parties.
All AI functions work without an internet connection. Licence checks and updates are allowed if they carry no content and processing continues offline for at least 14 days.
Threshold: Continued offline operation ≥ 14 days.
Models and model updates are delivered as files with a published checksum or signature.
SilverAI that processes personal data runs at the customer's site or on vendor-operated infrastructure in the EEA. No third-party AI sees personal data. A cloud provider's model services count as third-party AI.
If a third-party AI is used, a router at the customer's site or on vendor-operated infrastructure checks every request. Only requests without personal data go to the third-party AI.
The router reliably keeps requests containing personal data away from the third-party AI.
Threshold: Of the test requests containing personal data, at most 0.5 % reach the third-party AI (≥ 99.5 % kept back); for requests containing structured identifiers (IBAN, e-mail, phone, ID and tax numbers), at most 0.1 % (≥ 99.9 %).
If the router is uncertain, fails or cannot be reached, the request stays local or with the vendor.
BronzeEvery request to a third-party AI passes a pseudonymisation step at the customer's site or on vendor-operated infrastructure.
At least the following are covered: names of natural persons, addresses, dates of birth, phone numbers, e-mail addresses, IBAN and account numbers, ID card, passport, tax, social security and health insurance numbers, file and case reference numbers, vehicle registration numbers, IP addresses. The vendor lists any further categories.
The pseudonymisation step reliably removes personal data. A canary value counts as leaked if it, or an obvious variant of its spelling, appears in plain text in the outgoing request.
Threshold: Removed: ≥ 99 % of structured identifiers (IBAN, e-mail, phone, ID and tax numbers), ≥ 98 % of person names and ≥ 95 % of all canary values overall.
The mapping table (placeholder ↔ real value) never leaves the customer or the vendor. Placeholders in AI output are replaced back at the customer's site or at the vendor.
If pseudonymisation fails or cannot be reached, nothing is sent to the third-party AI.
Users can see what was sent to the third-party AI (preview before sending, or a log).
The contract with the third-party AI provider excludes training on the data, limits retention to at most 30 days, and provides for processing in the EEA or a valid basis for transfers to third countries.
Threshold: Retention ≤ 30 days.
The product and its marketing do not call pseudonymised data anonymous or anonymised.
| Group | 1 point | 2 points |
|---|---|---|
| I-1Transparency | A data-flow diagram is published that shows the processing location of every AI function. | In addition, the product shows for each AI function or request where it is processed. |
| I-2Customer control | The customer can switch off every external AI connection; the product then continues with reduced functions. (Gold: met.) | In addition, all AI functions are available in a variant that runs entirely at the customer's site. (Gold: met.) |
| I-3Data minimisation | AI input and output are kept outside the customer for at most 30 days. (Gold: met.) | In addition, nothing is kept outside the customer beyond processing, and local logs contain content only if the customer switches this on. |
| I-4Integrity | The product verifies the signature or checksum of every model before loading it. | In addition, local stores holding content or mapping tables are encrypted (or set-up with operating-system encryption is documented). |
| I-5Verifiability | The customer can view a log of all external AI requests (Gold: of all outgoing connections). | In addition, the vendor gives NOCIP permanent test access or a test installation for unannounced spot checks. |