Transparency

Assessment methodology and scoring rubric

AIFOD publishes in full the rubric every application is scored against, the points allocated to each pillar and sub-indicator, and the role and limits of AI in the assessment. The assessment process is itself designed to comply with the FAIR principles it certifies. You can also score your own organisation against this rubric before applying.

Framework FAIR v2.0 · Procedure v2.0 · published 24 Aug 2026

The role and limits of AI in this assessment

Assessment combines a structured documentation review, AI-assisted scoring against the rubric below, and a confirmatory interview conducted by human examiners.

AI-generated scores are advisory. They triage, structure and inform the examination. They set a provisional tier and nothing more. No application is finally declined, and no rating is finally awarded, without human review and sign-off. Every decline and every rating carries the signature of the responsible human reviewer or examiners.

To reduce variance, each application is scored in three independent runs and the median score per pillar is adopted. For each pillar the engine produces a score out of 25, sub-indicator scores, the specific evidence it relied upon with document references, the evidence gaps it identified, and a list of questions recommended for the examiner interview. The full output, including its reasoning, is retained in the case file and is auditable.

An examiner may adjust the provisional tier by one level in either direction, with written reasons. An adjustment of more than one level requires the countersignature of a second examiner not previously involved in the case. Where two examiners disagree, a senior examiner decides.

Pillars and weights

Every application is assessed against four pillars of equal weight. Each pillar carries a maximum of 0 points, for a total score of 100.

C1
Product & Solution Documentation
Please provide materials that help us understand what your product does, how AI is used, and who the product is intended to serve. Your evidence should, where applicable, explain: the purpose of the product or solution; the problem it is designed to address; its primary users or beneficiaries; the countries or markets where it is used; the main AI-enabled functions; whether AI models are developed internally or provided by third parties; whether the product makes or supports decisions that may affect individuals.
0 pts
C2
Technical Architecture & Data Flow
Please provide evidence showing how the product operates technically and how data moves through the system. Where possible, provide a simple system architecture or data-flow diagram, for example: User -> Application -> Cloud Infrastructure -> AI Model/API -> Database -> Analytics. Your evidence should help identify: where data originates; what types of data are processed; which systems process the data; which AI models or APIs receive data; where data is stored; relevant cloud or hosting regions; who can access the data; whether data is transferred across national borders; major external system integrations.
0 pts
C3
Privacy & Data Governance
Please provide evidence demonstrating how data is collected, used, accessed, retained, transferred and deleted in connection with the product. Your evidence should, where applicable, address: what personal or organizational data is collected; why the data is collected; the legal or consent basis for collection; who can access the data; where the data is stored and processed; how long the data is retained; how users can request correction or deletion; whether data is transferred internationally; whether customer or user data is used for AI training, fine-tuning or model improvement.
0 pts
C4
Security & Access Control
Please provide evidence demonstrating the security controls used to protect the product, systems and data. Your evidence should, where applicable, explain: who can access production systems; how access permissions are granted; how privileged access is controlled; whether multi-factor authentication (MFA) is used; how access is removed when employees or contractors leave; how sensitive information is protected; how security incidents are identified and handled; whether security testing is conducted. External security certification is not mandatory — FAIR assesses whether reasonable security controls exist and are implemented in practice.
0 pts
C5
AI Models, Cloud Services & Third-Party Dependencies
Please identify the major external providers, AI models, cloud services and other third parties on which the product depends. For each major dependency, please provide, where known: provider name; service, model or technology used; purpose; type of data shared or processed; processing or hosting region; whether the dependency is critical to the operation of the product.
0 pts
C6
User & Stakeholder Engagement
Please provide evidence showing how users, communities or other relevant stakeholders have been involved in the design, development, testing or improvement of the product. Your evidence should, where applicable, demonstrate: who the relevant stakeholders are; whether intended users were consulted; whether local communities or affected groups were engaged; whether local language, cultural or accessibility needs were considered; what feedback was received; whether stakeholder feedback resulted in changes to the product; how users can continue to provide feedback after deployment. FAIR considers not only whether consultation took place, but whether stakeholder input meaningfully influenced the solution.
0 pts
C7
Complaints, Incidents, Appeals & Human Review
Please provide evidence explaining what happens when the product produces an incorrect, disputed, harmful or otherwise problematic outcome. Your evidence should, where applicable, explain: how users can submit complaints; who receives and investigates complaints; expected response times; escalation procedures; how AI-related incidents are recorded and addressed; whether users can challenge AI-generated or AI-supported decisions; when human review is available; how corrective action is taken. For products that make or materially support decisions affecting individuals, please specifically address: can an affected person challenge an AI-supported decision and obtain meaningful human review?
0 pts
C8
Sustainability & Social / Local Impact
Please provide evidence describing the environmental, social, economic and local impact of the product, where applicable. Depending on the nature and scale of the product, this may include: benefits delivered to users or communities; measurable social or economic outcomes; local employment created or supported; workforce displacement or employment impacts; training and local capacity building; support for local SMEs or suppliers; accessibility and inclusion; environmental impact; computing and energy requirements; measures taken to reduce negative impacts. Evidence requirements should be proportionate to the size and nature of the applicant and product — small companies and early-stage innovators are not expected to produce the same level of documentation as large multinational organisations.
0 pts

A pillar score is the sum of its sub-indicator scores. The total score is the sum of the four pillar scores. Detailed level descriptors for each sub-indicator are provided to applicants in the Applicant Portal.

Rating tiers

Ratings are awarded on total score and pillar floors. A weakness in any single pillar limits the overall rating — the weakest-pillar principle. Where the total meets a tier threshold but a pillar floor is not met, the rating is the highest tier whose floors are satisfied.

TierTotal scorePillar floor
FAIR Certified 0 – 100 Every pillar at least 0 / 0
Not certified Below 0 Or any pillar below 0 / 0

Applicants that are not certified may reapply after 0 months. The decision notice states the pillar-level reasons and the improvements required.

Documentation requirements

Core documentation is mandatory. Where the core documentation for a pillar is missing or materially incomplete, the score for that pillar is capped at 15 points regardless of the quality of other evidence, which in most cases precludes a Gold or Silver rating. Supplementary documents are optional, maximum two per pillar.

C1
Product & Solution Documentation
C2
Technical Architecture & Data Flow
C3
Privacy & Data Governance
C4
Security & Access Control
C5
AI Models, Cloud Services & Third-Party Dependencies
C6
User & Stakeholder Engagement
C7
Complaints, Incidents, Appeals & Human Review
C8
Sustainability & Social / Local Impact

Accepted formats are PDF, DOC/DOCX and common image formats. Each file must not exceed 15 MB. Documents may be submitted in any official UN language; AIFOD may request certified translations where necessary.

Process and safeguards
  • Stage 1 — completeness check. Automated review of mandatory fields, attachment readability, contact-email consistency, and the presence of core documentation. The assessment clock starts only when this passes.
  • Stage 2 — AI-assisted scoring. Three independent runs, median per pillar adopted. Advisory only.
  • Stage 3 — examiner interview. Intensity is proportionate to the provisional tier. Gold cases are interviewed by two examiners — one from the applicant's sector, one from the applicant's region.
  • Impartiality. No examiner may assess an application from an organisation with which they have a current or recent professional, financial or family relationship. All examiners file a conflict-of-interest declaration before assignment.
  • Auditability. The complete case file — application, attachments, AI assessment runs, interview records and examiner conclusions — is retained for the validity period of the certification plus two years.
  • Appeals. An applicant may appeal a decline or a tier award within 30 days. Appeals are reviewed by an examiner with no prior involvement in the case. The appeal decision is final.
  • Service standard. The target from completeness check to final decision is four to 6 weeks.
  • Publication. Certified systems are entered in the public registry showing the organisation, the AI system, the tier awarded and a four-pillar profile. Numeric scores are not published.