We are not asking you to trust us. We prove it.

It is the newest standard of them all and it is about exactly this: how you build and supervise an artificial intelligence system so it does not end up doing odd things with nobody noticing.

This standard hands you, in writing, the answer to the most awkward question in a procurement committee: who exactly controls the artificial intelligence? It is documented who trains the models that watch your cameras, on what data, who checks that they get it right and what happens when they do not. The day that question comes up in a council meeting or an audit, you show a certificate instead of improvising.

It is the world reference for protecting information. An outsider reviews who can access what, how credentials are stored, what happens if someone loses a laptop and how you spot that something is wrong.

Your IT department does not have to take our word for it: they ask for the certificate and check it. That saves you the forty-page security questionnaire you would otherwise have to send us, wait for and assess yourself. In a tender, the information-security box arrives already signed off by an external auditor.

It is the sister of the previous one, focused on people's data. It governs what is kept about someone, what for, for how long and who may see it.

The day a resident asks what is being kept about them, there is a written procedure and not an improvisation. And when you have to justify how footage is handled to the data protection authority or to your own data protection officer, the work is already done and audited: you are not starting it the day the request lands.

It is about the bad day: a fire, a cyberattack, a flood in the server room. The standard forces you to have it written down and, above all, to have tested it.

A tender will ask you what happens the day the system goes down and how long it takes to come back. With this standard that answer is measured and rehearsed, not estimated by someone in sales. It is a continuity plan that has actually been tested, not one sleeping in a drawer until the day of the incident.

The classic one. It requires the way of working to be written down, measured, and corrected when it does not work.

If something goes wrong, there is a procedure to fix it and to stop it happening again, and that procedure can be audited. It does not depend on the one engineer who knows the trick being on shift that day. In many public tenders this standard appears as a technical-capacity requirement: with us, that box comes ticked.

It measures and reduces what we consume and what we throw away: server power use, electronic waste, equipment life cycle.

In a public tender, environmental criteria carry points, and a certified supplier adds to your score instead of subtracting from it. And if your organisation has to report on its sustainability targets, our consumption and our waste are already measured and audited: you do not have to estimate them for your annual report.

It is about the people installing and maintaining: whoever climbs an eight-metre pole to fit a camera, or goes into a treatment plant or a tunnel.

The people who set foot in your facility arrive trained, equipped and working to a procedure — which is exactly what you will be asked to evidence when contractors are coordinated on your site. If there is an accident on your premises, the paperwork exists and has been audited by a third party. Without it, the problem ends up being yours.

Spain's National Security Framework is the mandatory ruleset for systems used by public administration. It has three levels and high is the toughest: for systems whose failure would have serious consequences.

If you are a Spanish public administration, you can contract us without opening a file to justify why. The requirement is met and certified by a certification body, and that shows in how long the paperwork takes. For public-sector systems the ENS is not optional: either the supplier holds it, or the file stalls.

It is the European directive requiring the sectors daily life depends on — energy, water, transport, healthcare — to protect themselves from cyberattacks. The high category covers the most critical entities.

If your organisation falls under NIS2, your suppliers are part of the equation: the directive looks at the whole supply chain, not just your own house. With us that box is already ticked, so you neither have to audit us yourself nor explain in your report why you hired someone who does not comply.

IRIS incorporates NeuralPax, a separate licence, and today it is the only system in the world holding this certification: that of the Spanish Metrology Centre for counting people, measuring occupancy and controlling crowd flow. The Spanish Metrology Centre is the body that says whether an instrument measures correctly: the same one that certifies a weighbridge or a speed camera. So the number of people IRIS gives is not an estimate of ours: it is a measurement verified by a third party. Mind the scope: what is certified is that measurement, not the whole product.

When you say twelve thousand people were at an event, that number has official backing. That is why it satisfies the occupancy rules in force for events: it is not an estimate, it is a certified measurement, and it is precisely the one that gets challenged when an occupancy figure has to be justified to an inspector, to an insurer or, if it comes to it, to a judge. An estimate does not survive there. Mind the scope: what is certified is counting people, not the whole product.