Keeping a certificate
An agent changes after it is certified, and so do the attacks against it. A CTS-1 certificate stays active only while the agent keeps passing.
Quarterly re-tests
Every three months Caudals tests the certified system again. A re-test uses about a quarter of the original operational set, new cases drawn from recent questions and documentation, and an attack set refreshed with techniques published since the last round.
The bar is the same as at certification: no critical or high finding. If one appears, you have 30 days to fix it and pass a new test of the affected requirements. The date of the last re-test appears in the registry entry.
Reporting changes
Tell Caudals before any of these changes goes live. We test the requirements it affects, usually within a few days.
- A different model or a new major version of the same model.
- A substantial change to the system prompt or the guardrails.
- A new knowledge source, or the removal of one.
- A new tool, or wider permissions for an existing one.
- A new channel, language or group of users.
Routine content updates to the knowledge base do not need to be reported. They are covered by the quarterly re-test.
Reporting incidents
If the certified system is involved in an incident that suggests a requirement is no longer met, such as a data exposure, an unauthorized action or a harmful answer at scale, tell Caudals within five working days. We review what happened and decide whether a re-test is needed.
Annual recertification
A certificate is valid for twelve months. Recertification starts about eight weeks before it expires, and follows the same steps as certification with a fresh test set, against the version of CTS-1 in force at that time. The new certificate keeps the same number with a new period of validity.
Certificate status
| Status | Meaning |
|---|---|
| Active | The system is certified and its re-tests are up to date. |
| Suspended | A blocking finding, an unreported change or a missed re-test is being resolved. The badge may not be used while the certificate is suspended. |
| Withdrawn | The certificate has been ended by Caudals or by the holder. |
| Expired | The twelve months have passed without recertification. |
Certificates that are suspended, withdrawn or expired stay in the registry with their status and its date.
Suspension and withdrawal
Caudals suspends a certificate when a critical or high finding is not fixed within 30 days, when a material change was not reported, when a quarterly re-test is missed or when the badge is used outside its rules. A suspended certificate is restored once the cause is resolved and the affected requirements pass. If it is not resolved within 90 days, the certificate is withdrawn.
Complaints and appeals
A holder who disagrees with a finding or a decision can appeal in writing within 30 days. The appeal is reviewed by someone who took no part in the original decision. Anyone can report a concern about a certified system or about misuse of the badge at [email protected].