What changed this year
- Vendor security questionnaires have gained sections devoted to AI. SIG and CAIQ now publish dedicated extensions, and many enterprises have added their own.
- SOC 2 covers information security, not the governance of AI systems. It says nothing about model provenance, training-data rights, or human oversight boundaries.
- The result: sales cycles stretch while the team improvises answers in a spreadsheet, and some contracts are lost at vendor risk review.
What you get
A posture assessment
AI governance, data protection and cybersecurity. The AI part is structured in categories aligned to ISO/IEC 42001, the NIST AI RMF and the EU AI Act, and covers the Canadian federal directive on automated decision-making.
An attestation with a public identifier
Signed with an Ed25519 key whose public half is published, and sealed by a digest that changes if a single character moves.
A page you hand over
Your buyer enters the identifier and gets the result, the exact scope and the validity date. No account, no coming back to you, no taking your word for it.
Verify one right now
Below is a sample attestation, produced by the same engine as real ones. Its identifier is permanent. Open it in a private window if you like — there is nothing to sign in to.
Attestation is genuine
It genuinely comes from StructureClerk and has not been altered since issuance.
- Organization
- Fabrik Signal Technologies inc.
- Result
- 78%
- Issued
- September 5, 2026
- Valid until
- September 5, 2027
Declared by the organization
Self-declared assessment covering 174 of 174 questions.
Observed by StructureClerk
Automated observation of the public website on September 5, 2026: 22 pages read, 9 factual findings recorded. These were observed by StructureClerk, not declared by the organization.
ATT-DEMO-2F7K-9XQR
Fabrik Signal Technologies inc. is a fictional organization. The figures in this sample illustrate the format; they describe no customer.
The questions this lets you address
These are the formulations that recur in the AI sections of vendor questionnaires.
- Inventory of AI systems in production
- Model provenance and reliance on third parties
- Rights over training data
- Human oversight boundaries
- Escalation paths when the system does not rule
- Decision logging and audit trail
- Transparency towards the affected person
- ISO/IEC 42001, NIST AI RMF and EU AI Act alignment
What we do not do
An assessor who discovers a limitation afterwards stops trusting you. Better to write them here.
- We never declare an organization “compliant”. The attestation states what was assessed, not what is settled in law.
- We do not perform certification audits. Nobody has accredited us to issue one, and we do not pretend otherwise.
- We have no financial interest in the outcome: the score is not negotiable and does not change with the plan you buy.
- Legal judgment stays human, and it stays yours and your advisers'.
- Below 90% confidence the decision engine escalates rather than guessing, and says so explicitly in its response.
Let's spend fifteen minutes on your questionnaire
Tell us which section is blocking you. If we cannot help, we will say so in the reply rather than on the third call.
Or write directly to info@structureclerk.ca.