Cloud Security Alliance launches STAR for AI Level 2 to strengthen AI governance

What happened

• The CSA introduced a new tier, STAR for AI Level 2, as part of its Security, Trust & Assurance Registry (STAR) program.
• The tier is designed to map existing industry certifications to AI‑specific controls.
• It provides a structured assurance framework for AI system safety, security and responsible use.
• The announcement was made on 27 October 2026 in Seattle.

Why it matters

Organizations that already hold STAR or similar certifications can now leverage Level 2 to demonstrate AI‑specific governance, helping them meet client and partner expectations for trustworthy AI.

Business impact

Adopting STAR for AI Level 2 may require updating internal AI risk assessments and aligning existing security controls with the new AI criteria, potentially increasing audit scope and documentation effort.

What to check

1. 1

   map existing certificationsMedium priority

   Identify which current STAR or ISO certifications can be extended to meet Level 2 AI requirements.

2. 2

   conduct AI control gap analysisMedium priority

   Compare your AI governance practices against the STAR for AI Level 2 criteria and document gaps.