Frequently asked questions
Short answers to the questions we hear most. Each one links to the page with the detail.
The standard
What does CTS-1 stand for?
Caudals Trust Standard, version line 1. It is a certification standard for AI agents and assistants with 36 requirements under three risks: operational, security, and legal and financial.
Is CTS-1 an official or accredited standard?
No. CTS-1 is a private standard written and maintained by Caudals. It is not issued by a standards body and Caudals is not an accredited certification body. Its value comes from what is tested and from the public record. See About CTS-1.
How does it relate to ISO/IEC 42001, SOC 2 and the NIST AI RMF?
They look at the organization and its controls. CTS-1 tests the agent itself. CTS-1 maps each requirement to those frameworks and accepts their certificates and reports as evidence where it says so. See the crosswalks.
Does a certificate mean the agent complies with the EU AI Act?
No. CTS-1 is not a conformity assessment and is not legal advice. It tests behaviors the Act regulates, such as disclosure under Article 50, and gives you evidence for your own compliance work.
Certification
What kinds of AI systems can be certified?
Agents, assistants and chatbots that work with text and documents, including voice agents through their transcripts and agents that act through tools. See Scoping.
How long does it take?
Plan for four to eight weeks. The part that varies most is the time your team needs to fix findings. See How certification works.
What do we need to provide?
A named owner for the agent, your documentation and real questions, a test environment or test accounts, the evidence requested, and a signed authorization for security testing.
Will you see our customers' data?
Tests use seeded test data and test accounts. When evidence contains personal data, we ask for it redacted. Caudals works under a confidentiality agreement and a data processing agreement, and its domain experts see only the redacted material their task needs.
What if the agent does not pass?
Nothing is published. You receive the findings, fix them and we test again. A certificate is issued only when no critical or high finding is open. See How we test.
What does it cost?
The price depends on the scope and is fixed before work starts. We quote it after the scoping call.
After certification
How long is a certificate valid?
Twelve months, with a re-test every quarter. See Keeping a certificate.
We change our prompt every week. Do we have to tell you each time?
No. Report material changes: a new model, a substantial change to the system prompt or guardrails, a new knowledge source, a new tool, a new channel or language. Routine updates are covered by the quarterly re-test.
Can we lose the certificate?
Yes. It is suspended if a blocking finding is not fixed within 30 days, if a material change is not reported, if a re-test is missed or if the badge is misused. It is withdrawn if the cause is not resolved within 90 days.
How can someone check that our badge is real?
The badge links to the certificate's page in the registry, which shows its status, scope and last re-test.