The auditor: the Clauses tab, the seat, the pack
A programme's Clauses tab shows every clause and the step that handles it. Give your auditor a read-only seat and the records; the certificate comes from them, not from us.
The Clauses tab on a programme page is the clause-by-clause reference for that standard: each clause, the step it is handled in, and that step's status. It is read-only, and the status comes from the step's approval — never from the fact that a step exists for the clause. On an ISO programme the Annex A rows are one line pointing at the Statement of Applicability, where they are decided. Download CSV exports the same matrix.
Every clause in every catalogue is claimed by some step — a test holds that — so the tab exists to show where the work is, not to list gaps.
The auditor's seat
Invite your auditor with the Auditor role under Organisation → Members & roles. An Auditor reads everything — the register, the records, the evidence with its hash chain — and changes nothing. Scope the invitation to the engagement and remove it afterwards; the Audit trail records both.
What to hand over
Reports carries a section for each standard you run, beside the EU AI Act reports:
- ISO/IEC 42001 — the Statement of Applicability PDF, the Readiness pack (the Stage 1 readiness record, approved like any other) and the Clause matrix CSV.
- ISO/IEC 27001 — its own Statement of Applicability PDF and the ISMS readiness pack.
- NIST AI RMF — the Profile PDF.
Per system, the EU AI Act audit bundle from Reports adds a SHA-256 manifest of every document it contains. Each piece is a record with a hash.
Recording the outcome
Certification is a fact you record, never one the product derives. On the programme page's Certification facts tab an admin enters the certification body, the certificate reference and the next surveillance audit date; recording the certificate reference is what marks the programme Certified.
Who signs the certificate
Not Veritome. Accredited certification bodies work under ISO/IEC 17021-1, and ISO/IEC 17021-1 §5.2.5 keeps consultancy and certification apart: a certification body may not provide management-system consultancy, and may not certify a system where its own consultancy would compromise its impartiality. We are on the consulting side of that line by design. The certificate comes from an accredited body, on the strength of the evidence you show them — and it attests to the management system, not to conformity with the EU AI Act.
Still stuck? Open a support request in your workspace, and a person will answer there and by email.