We aren’t asking you to trust us. We prove it.

It’s the newest standard of them all and it’s about exactly this: how you build and supervise an artificial intelligence system so it doesn’t end up doing odd things with nobody noticing.

This standard hands you, in writing, the answer to the most awkward question in a procurement committee: who exactly controls the artificial intelligence? It’s documented who trains the models that watch your cameras, on what data, who checks that they get it right and what happens when they don’t. The day that question comes up in a city meeting or an audit, you show a certificate instead of improvising.

It’s the world reference for protecting information. An outsider reviews who can access what, how credentials are stored, what happens if someone loses a laptop and how you spot that something’s wrong.

Your IT department doesn’t have to take our word for it: they ask for the certificate and check it. That saves you the forty-page security questionnaire you’d otherwise have to send us, wait for and assess yourself. In a tender, the information-security box arrives already signed off by an external auditor.

It’s the sister of the previous one, focused on people’s data. It governs what is kept about someone, what for, for how long and who may see it.

The day a resident asks what is being kept about them, there’s a written procedure and not an improvization. And when you have to justify how footage is handled to the data protection authority or to your own data protection officer, the work is already done and audited: you aren’t starting it the day the request lands.

It’s about the bad day: a fire, a cyberattack, a flood in the server room. The standard forces you to have it written down and, above all, to have tested it.

A tender will ask you what happens the day the system goes down and how long it takes to come back. With this standard that answer is measured and rehearsed, not estimated by someone in sales. It’s a continuity plan that has actually been tested, not one sleeping in a drawer until the day of the incident.

The classic one. It requires the way of working to be written down, measured, and corrected when it doesn’t work.

If something goes wrong, there’s a procedure to fix it and to stop it happening again, and that procedure can be audited. It doesn’t depend on the one engineer who knows the trick being on shift that day. In many public tenders this standard appears as a technical-capacity requirement: with us, that box comes ticked.

It measures and reduces what we consume and what we throw away: server power use, electronic waste, equipment life cycle.

In a public tender, environmental criteria carry points, and a certified supplier adds to your score instead of subtracting from it. And if your organization has to report on its sustainability targets, our consumption and our waste are already measured and audited: you don’t have to estimate them for your annual report.

It’s about the people installing and maintaining: whoever climbs an eight-foot pole to fit a camera, or goes into a treatment plant or a tunnel.

The people who set foot in your facility arrive trained, equipped and working to a procedure — which is exactly what you’ll be asked to evidence when contractors are coordinated on your site. If there’s an accident on your premises, the paperwork exists and has been audited by a third party. Without it, the problem ends up being yours.

Spain’s National Security Framework is the mandatory ruleset for systems used by public administration. It has three levels and high is the toughest: for systems whose failure would have serious consequences.

This one is a state audit, and it’s tougher than almost any RFP asks for: an outside body went through the controls one by one and signed that they hold. It buys you no box to tick in the United States, and we’re not going to pretend it does. What it tells you is how we work when somebody is checking.

It’s the European directive requiring the sectors daily life depends on — energy, water, transport, healthcare — to protect themselves from cyberattacks. The directive doesn’t use categories: it distinguishes essential entities from important ones, by sector and size.

If your organization falls under NIS2, your suppliers are part of the equation: the directive looks at the whole supply chain, not just your own house. With us that box is already ticked, so you neither have to audit us yourself nor explain in your report why you hired someone who doesn’t comply.

IRIS incorporates NeuralPax, a separate license, and today it is the only system in the world holding this approval: that of the Centro Español de Metrología for counting people, measuring occupancy and controlling crowd flow. The Centro Español de Metrología is the body that says whether an instrument measures correctly: the same one that certifies a truck scale or a speed camera. So the number of people IRIS gives isn’t an estimate of ours: it’s a measurement verified by a third party. Mind the scope: what’s approved is that measurement, not the whole product. That approval is Spanish and it isn’t equivalent to any U.S. certification: we say so up front and not at the end.

When you say twelve thousand people were at an event, a third party stands behind that number. It isn’t an estimate: it’s a measurement approved by the Centro Español de Metrología, Spain’s national metrology institute. And that difference is exactly what shows when an occupancy figure has to be justified to an inspector, to an insurer or, if it comes to it, to a judge: an estimate doesn’t survive there. Mind the scope: what’s certified is counting people, not the whole product. The approval is Spanish. It doesn’t stand in for a U.S. certification, and we don’t present it as one.