Certification Lifecycle
The ARA v1.1 certification lifecycle defines the end-to-end process for achieving and maintaining certification under the two-axis model. It consists of 10 phases spanning from initial intake through ongoing ecosystem participation. Each phase produces specific outputs that feed into subsequent phases.
Phase Details
Intake & Scoping
The certifying organization submits a formal intake request to an Authorized Validation Body (AVB). The AVB reviews the system description, determines the applicable system profile (F/S/A/C), and establishes whether the certification will be a Deployment Certification or Platform Certification.
Key Activities
- →Submit system scope definition and deployment context
- →AVB determines applicable system profile and certification type
- →Engagement agreement formalized with timeline and fees
Risk Classification
The AVB conducts a mandatory 7-factor risk assessment to determine the appropriate Assurance Class (A, B, or C). The seven factors are: autonomy level, decision impact, data sensitivity, operational environment, human oversight capacity, reversibility, and scale. The determined class sets the ongoing monitoring intensity for the certified system.
Key Activities
- →AVB evaluates each of the 7 risk factors
- →Assurance Class (A/B/C) determined and documented
- →Risk classification rationale recorded for audit trail
Evidence Collection
The organization prepares evidence across four categories: Lifecycle Process (LP), Technical Implementation (TI), Operational Performance (OP), and Third-Party (TP). For systems built on certified platforms, ACR inheritance claims are documented and validated against the platform certification.
Key Activities
- →Assemble evidence portfolio across LP, TI, OP, and TP categories
- →Document platform certification inheritance claims (if applicable)
- →AVB conducts preliminary gap analysis on evidence completeness
ACR Evaluation
The AVB evaluates each applicable ACR using its designated evaluation method: Automated Testing (AT), Human Simulation (HS), Evidence Inspection (EI), Continuous Monitoring (CM), Third-Party Attestation (TP), or Operational Proof (OP). Domain scores are calculated based on risk-weighted ACR results.
Key Activities
- →Execute evaluation for each applicable ACR using designated method
- →Calculate risk-weighted domain scores
- →Document non-conformance findings with severity classification
Adversarial Testing
For L2 Operational and L3 Comprehensive certifications, structured adversarial evaluation validates system resilience. L2 requires structured red team exercises. L3 requires independent red team assessment by ARAF-approved evaluators with minimum 80 hours of testing.
Key Activities
- →Red team exercises targeting adversarial robustness controls
- →Multi-turn attack sequence and manipulation resistance testing
- →Independent red team validation for L3 certifications
Scoring & Determination
Final certification scores are calculated across all applicable domains. The risk-weighted composite score is compared against level thresholds to determine pass/fail. Blocking ACR failures result in automatic denial. Conditional certification is available for minor non-conformances on conditional ACRs.
Key Activities
- →Consolidate all evaluation results into certification scorecard
- →Compare domain scores against certification level thresholds
- →Render certification decision: Certified, Conditional, or Denied
Certification Issuance
The certification designation is issued (e.g., "L2-B Deployment"). A living badge is generated with operational state tracking. The system is registered in the ARA public registry. For Assurance Class B and C, CAPO engagement is initiated.
Key Activities
- →Issue certification designation with level, class, and type
- →Generate living certification badge
- →Publish registry entry and initiate CAPO onboarding (Class B/C)
Continuous Monitoring
Post-certification monitoring intensity is determined by the Assurance Class. Class A: periodic self-assessment with annual review. Class B: monthly CAPO check-ins with telemetry integration. Class C: 24/7 CAPO oversight with real-time alerting and immediate escalation pathways.
Key Activities
- →Monitor behavioral drift against certified baseline
- →CAPO telemetry integration and alerting (Class B/C)
- →Investigate monitoring alerts indicating compliance deviations
Renewal & Revalidation
Certification validity varies by level: L1 Foundation (24 months), L2 Operational (18 months), L3 Comprehensive (12 months). Revalidation is triggered by material changes, assurance class lapse, or version updates. The Express Pathway is available for L1 renewals meeting eligibility criteria.
Key Activities
- →Scheduled renewal evaluation before certification expiry
- →Material change assessment and revalidation when triggered
- →Version migration evaluation when standard is updated
Ecosystem Participation
Certified organizations participate in the broader ARA ecosystem including insurance partnerships through Recognized Insurer Partners (RIPs), consortium membership, regulatory equivalence claims via framework crosswalk mappings, and marketplace listings.
Key Activities
- →Insurance eligibility assessment with RIP partners
- →Consortium membership and working group participation
- →Regulatory framework equivalence claims via crosswalk mappings
Duration Estimates
Total time from intake to certification varies by level, system profile, and certification type. The Express Pathway is available for L1 Foundation.
| Level | Typical Duration | Validity |
|---|---|---|
| L1Foundation | 3-4 weeks (Express) / 8-12 weeks | 24 months |
| L2Operational | 12-20 weeks | 18 months |
| L3Comprehensive | 18-32 weeks | 12 months |