Platform Certification

Platform

Certify once, inherit across deployments

Overview

Platform certification allows vendors to certify their platforms (e.g., AI orchestration frameworks, agent runtime environments) against a subset of ARA ACRs. When a deployment is built on a certified platform, the inheritable ACRs don't need re-evaluation — they're inherited from the platform certification.

Key Concepts

Understanding the foundational ideas behind platform certification and how it relates to deployment-level assurance.

Platform vs Deployment

Platform certification covers the reusable infrastructure; deployment certification covers the specific system built on top of it.

Inheritance

Platform-certified ACRs are inherited if the platform certification is valid and the deployment operates within the platform’s reference environment.

Reference Environment

The certified conditions under which the platform was evaluated — including OS, runtime, and configuration parameters.

No Assurance Class

Platform certifications don’t carry an Assurance Class. Only deployment certifications receive a Class A, B, or C designation.

Eligibility

Not all software qualifies for platform certification. The following criteria must be met before an AVB can begin the platform evaluation process.

1

Platform must be a reusable software infrastructure (not a specific deployment)

2

Must be evaluable against at least 50 ACRs marked as platform-cert-eligible

3

Must define a clear reference environment

4

Must commit to version tracking and change notification

Certification Process

The platform certification lifecycle from initial registration through issuance and renewal.

1

Registration

Platform vendor registers with ARAF through an accredited AVB.

2

ACR Evaluation

AVB evaluates the platform against platform-cert-eligible ACRs using documented evidence and testing.

3

Reference Environment Seal

The reference environment is documented and sealed, defining the exact conditions under which the platform was evaluated.

4

Certification Issuance

Platform certification is issued containing: cert ID, vendor, platform name and version, covered ACRs, reference environment, and validity period.

5

Renewal

Platform certifications are valid for 12 months and are renewable through a streamlined re-evaluation process.

Inheritance Rules

The conditions under which deployment certifications can inherit ACR compliance from a platform certification.

Reference Environment

Deployment must operate within the platform’s certified reference environment.

No Re-evaluation

Inherited ACRs don’t need re-evaluation during deployment certification.

Active Certification

Platform certification must be active (not expired or suspended) at the time of deployment certification.

Lapse Consequence

If platform certification lapses, deployment certifications must address the inherited ACRs at their next renewal.

Override Option

Deployments can override inherited ACRs with deployment-specific evidence if needed.

Platform Certification vs Deployment Certification

Side-by-side comparison of the two certification types and how they differ in scope, requirements, and function.

Aspect
Platform
Deployment
ScopeReusable infrastructureSpecific system deployment
Assurance ClassNoneA, B, or C
ACR ScopePlatform-eligible subsetFull profile
CAPO RequiredNoDepends on class
InheritanceProvides ACRs to deploymentsInherits from platform
Validity12 months12 months

Continue Reading