BSI launches three AI assurance schemes – but has no Notified Body status yet
The British standards body BSI now offers pilot-based preparation for EU AI Act conformity assessment of biometric AI, performance testing of language model applications, and risk management based on NIST and ISO frameworks – but for now, without Notified Body status.
BSI (British Standards Institution) announced three new AI assessment schemes on October 14, 2026: a service for high-risk biometric systems, a performance assessment for applications built on large language models (LLMs), and an assessment of product-level AI risk management (Biometric Update; Verdict via MSN). The launch comes in a market where demand for independent documentation that AI products are safe and trustworthy is growing, and where the formal regulatory regime – as reported – has had its deadlines postponed.
This story is based on secondary coverage of BSI's announcement; both sources likely draw on the company's own press materials. That is worth keeping in mind when reading the numbers and claims.
Biometric scheme: a pilot toward the EU AI Act
The most regulation-adjacent of the three schemes targets biometric AI systems classified as high-risk under Annex III, point 1 of the EU AI Regulation – the category covering, among other things, biometric identification. The scheme follows the procedure in Annex VII, which is the conformity assessment procedure high-risk systems must undergo (Biometric Update).
The crucial caveat: BSI is launching the service as a pilot while the company works toward being designated as a Notified Body under the AI Regulation. Until such designation is in place, the service can support preparation for conformity assessment – but it does not constitute formal regulatory certification. For vendors of biometric AI, that means they can use the pilot to identify and fix gaps before the binding assessment, but a completed pilot program does not exempt them from the later, formal process.
The deadline is slipping – if the Omnibus shift holds
The timing is only partially settled. Under the AI Regulation as originally written, the requirements for Annex III high-risk systems were to take effect on August 2, 2026. According to Biometric Update, the EU's AI Omnibus has now moved this deadline to December 2, 2027 (Biometric Update). This change is not independently confirmed in the available source material and should be read as reported – not as documented law.
The irony is clear: precisely because the deadline for formal conformity is moving further out, the market for voluntary, independent validation becomes more attractive. Vendors get more time, but buyers – public and private – do not automatically get more trust.
Performance assessment for LLM applications
The second scheme, the "AI Performance Assessment for Large Language Models," targets not the models themselves but finished applications: chatbots, systems with retrieval-augmented generation (RAG), and summarization tools. The testable dimensions are the correctness of answers, factual consistency, contextual relevance, toxicity, and the quality of summaries (Biometric Update).
That the scheme tests applications rather than underlying models aligns with an increasingly widespread industry view: the product is not the model. A vendor building a customer-service chatbot on a third-party model can have the finished solution itself – with its RAG pipeline, its prompting, and its system boundaries – be the subject of the assessment.
The sources do not specify whether this scheme is a pilot, a fully launched service, or under development. Only the biometric scheme is explicitly described as a pilot.
Risk management anchored in NIST and ISO
The third scheme is an assessment of AI risk management based on two established frameworks: NIST's AI Risk Management Framework and ISO/IEC 23894, the ISO standard for AI risk management. Organizations that pass the assessment receive a certificate referencing both frameworks, a technical assessment report, and BSI's "Mark of Trust" (Biometric Update).
A clear caveat applies here too: the assessment does not replace regulatory conformity assessment. It provides a documentation package aimed at buyers and partners, not legal proof of compliance with the AI Regulation.
Why the market is demanding this
BSI itself justifies the launch with surveys the company cites. According to research from FocalData that BSI references, 67 percent of business leaders would trust AI tools more if they were validated by an external organization. BSI's own survey found that only a quarter of business leaders had a formal AI governance program, and that only 28 percent knew which data sources had been used to train or deploy their AI models – figures that should be read as the company's own claims, as relayed via Biometric Update (Biometric Update).
Omkar Joshi, managing director for AI and Digital Solutions at BSI, framed the launch this way, as reproduced in translation: "Having led the development of AI standards, BSI is committed to enabling AI adoption for good, and we are now expanding our offer to help AI providers demonstrate trust in their AI."
BSI also describes itself – according to Verdict/MSN, as a company statement – as the first organization accredited for ISO/IEC 42001, the standard for artificial intelligence management systems, among the three accreditation bodies RvA, ANAB, and UKAS (Verdict via MSN).
What remains to be answered
Several questions remain open. First: as long as BSI is not designated as a Notified Body, the market for formal AI Act conformity assessment exists in practice only as preparation – who is ultimately designated, in which countries, and with what capacities will determine how this market is actually organized. Second: the status of the Omnibus change to the deadline (August 2, 2026 → December 2, 2027) is reported only by Biometric Update in this material and should be verified against the legislation itself before being relied on for compliance planning. Third: it is unclear whether the LLM scheme and the risk management scheme are operational, pilots, or under establishment.
What is nonetheless clear is the signal value: one of the world's largest certification institutions is committing resources to AI assurance services before formal designations are in place. For vendors of biometric AI and LLM applications – and for buyers who want third-party scrutiny before they sign – the supply of independent validation is thus taking shape, even during the waiting period before the regulation requires it.