Self-Assessment — FAIR Certification

FAIR v2.1

Score yourself first

No account, no fee, no third-party audit required. Rate your own organisation against the published FAIR rubric, see roughly where you stand, and apply when you are ready. Hard evidence such as an existing certification will always score better under the real assessment than a self-declared answer — but a self-declared answer still counts, and still gets you through the door.

C1 — Product & Solution Documentation

What the product does, where it is used, and how it uses AI. A product deck, overview or website usually covers this whole category.

c1-1 — Purpose, problem and who it serves 0 = no evidence at all, 10 = fully met, backed by hard evidence c1-2 — Where it is used 0 = no evidence at all, 10 = fully met, backed by hard evidence c1-3 — AI functions and their limits 0 = no evidence at all, 10 = fully met, backed by hard evidence

C2 — Technical Architecture & Data Flow

How data moves through the system: where it comes from, what is processed, where it is stored and who can reach it. A simple data-flow or architecture diagram is the ideal evidence.

c2-1 — How data moves through the system 0 = no evidence at all, 10 = fully met, backed by hard evidence c2-2 — Where data is stored and who can access it 0 = no evidence at all, 10 = fully met, backed by hard evidence c2-3 — External integrations 0 = no evidence at all, 10 = fully met, backed by hard evidence

C3 — Privacy & Data Governance

How personal and organisational data is collected, kept, transferred and deleted. A privacy policy and a data-retention policy usually answer most of this category.

c3-1 — Why the data is collected, and on what basis 0 = no evidence at all, 10 = fully met, backed by hard evidence c3-2 — Retention and deletion 0 = no evidence at all, 10 = fully met, backed by hard evidence c3-3 — Correction and deletion requests 0 = no evidence at all, 10 = fully met, backed by hard evidence c3-4 — Data leaving the country 0 = no evidence at all, 10 = fully met, backed by hard evidence c3-5 — Use of user data to train AI 0 = no evidence at all, 10 = fully met, backed by hard evidence

C4 — Security & Access Control

The controls that protect the product, its systems and its data. An information security policy, access-control screenshots, or an ISO 27001 or SOC 2 report are all accepted; external certification is not required.

c4-1 — Access control 0 = no evidence at all, 10 = fully met, backed by hard evidence c4-2 — Protecting sensitive information 0 = no evidence at all, 10 = fully met, backed by hard evidence c4-3 — Incidents, security and AI 0 = no evidence at all, 10 = fully met, backed by hard evidence c4-4 — Testing and corrective action 0 = no evidence at all, 10 = fully met, backed by hard evidence

C5 — AI Models, Cloud Services & Third-Party Dependencies

The AI models, cloud services and other providers the product depends on. One table — provider, purpose, data, region — answers this category.

c5-1 — Dependency inventory 0 = no evidence at all, 10 = fully met, backed by hard evidence c5-2 — Critical dependencies 0 = no evidence at all, 10 = fully met, backed by hard evidence

C6 — User & Stakeholder Engagement

How intended users and affected communities shaped the product, including language, culture and accessibility.

c6-1 — Stakeholders and consultation 0 = no evidence at all, 10 = fully met, backed by hard evidence c6-2 — Language, culture and accessibility 0 = no evidence at all, 10 = fully met, backed by hard evidence c6-3 — What feedback changed 0 = no evidence at all, 10 = fully met, backed by hard evidence

C7 — Complaints, Incidents, Appeals & Human Review

What happens when something goes wrong for a user: complaints, challenges to AI-supported decisions, and human review.

c7-1 — Complaints and feedback after launch 0 = no evidence at all, 10 = fully met, backed by hard evidence c7-2 — Decisions about people, and human review 0 = no evidence at all, 10 = fully met, backed by hard evidence

C8 — Sustainability & Social / Local Impact

The difference the product makes for users, local jobs and skills, and the environment. Small and early-stage teams are not expected to have formal impact reports.

c8-1 — Benefits and measurable outcomes 0 = no evidence at all, 10 = fully met, backed by hard evidence c8-2 — Effects on jobs and local skills 0 = no evidence at all, 10 = fully met, backed by hard evidence c8-3 — Environmental and computing footprint 0 = no evidence at all, 10 = fully met, backed by hard evidence

Nothing you enter here is saved or sent to AIFOD.