AAMOS Trust & Certifications

All 16 AAMOS modules have been classified under the EU AI Act risk framework. 15 modules fall under Limited Risk classification (Art. 52 transparency obligations met). The People module (HR/performance management) is classified as High Risk (Annex III, point 4) with full compliance measures implemented including human oversight, data governance, and bias testing.

Full GDPR compliance implemented across all data processing activities. Record of Processing Activities (ROPA) is complete and current. Data Protection Impact Assessments (DPIA) conducted for all high-risk processing. Consent management, right to erasure (Art. 17), and automated decision-making safeguards (Art. 22) are fully implemented.

All AAMOS AI agents operate under the Primal Charter v1.0.0 — a constitutional AI governance framework governing agent behaviour, escalation protocols, red lines, and human oversight requirements. The Charter is ratified through the Constitutional Court mechanism and enforced at the Hermes routing layer.

ISMS (Information Security Management System) established and operational. Internal audit completed with 92% conformity to Annex A controls (93 controls total). Gap assessment identifies 7 controls requiring additional evidence before formal certification audit. Target certification: Q3 2026.

Quality Management System (QMS) implemented covering software development, deployment, and service delivery processes. Customer satisfaction monitoring, non-conformance management, and continuous improvement processes are active. Clause 8 (Operations) and Clause 9 (Performance Evaluation) are fully implemented. Target certification: Q4 2026.

Independent AI safety readiness assessment conducted by TÜV Rheinland on 2026-04-27. The audit evaluated model robustness, explainability, bias detection, human oversight mechanisms, and incident response procedures. AAMOS achieved Readiness Level 3 — the highest tier for enterprise AI deployments.

SOC 2 Type II preparation underway covering the five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Internal readiness assessment complete. Audit window scheduled for Q3 2026 (90-day observation period). Security and Availability criteria are already at audit-ready maturity.

Comprehensive red team exercise completed 2026-05-04. Attack surface assessment covered API endpoints, authentication flows, data exfiltration vectors, and social engineering scenarios. Zero critical vulnerabilities found. 3 medium-severity findings remediated within 48 hours. Next scheduled assessment: Q3 2026.