Methodology

A fixed rubric, applied the same way every time.

SSAI publishes what the Trust Score measures and how the process works without publishing detailed rubric thresholds or weightings.

How the score is calculated.

Each dimension is evaluated against a fixed maturity rubric. Inputs are converted into dimension results and then into the 300–850 Trust Score. The same inputs produce the same score. Higher-risk AI use requires stronger controls to support the same level of trust.

1. Measure exposure

Consider data sensitivity, operational importance, autonomy, affected people, regulated impact, and dependency.

2. Measure controls

Evaluate implemented controls across the seven Trust Score dimensions.

3. Apply fixed scoring

Use the same deterministic scoring rules, thresholds, control caps, and score-band logic for equivalent inputs.

The seven dimensions.

1. Data SecurityHow business and client data is protected when AI tools are used.
2. Human OversightHow people review, approve, and stay accountable for AI outputs.
3. ComplianceHow AI use meets legal, regulatory, and contractual obligations.
4. TransparencyHow clearly the business discloses its AI use to clients and staff.
5. Incident ResponseHow the business detects, handles, and learns from AI-related problems.
6. Vendor ManagementHow AI tools and providers are reviewed, approved, and monitored.
7. Staff TrainingHow employees learn to use approved AI tools safely and correctly.
300–579Needs Attention
580–669Developing
670–799Strong
800–850Exemplary

Mapped to NIST AI RMF.

The methodology is mapped to the NIST AI Risk Management Framework functions: Govern, Map, Measure, and Manage. ISO/IEC 42001 principles also inform the approach to management systems, accountability, documentation, and continual improvement.

Govern

Accountability, policies, roles, training, and oversight.

Map

AI uses, data, vendors, context, and affected parties.

Measure

Control maturity, review, monitoring, testing, and evidence.

Manage

Prioritization, remediation, incident response, and reassessment.

Trust Score methodology is informed by NIST AI RMF and ISO/IEC 42001 principles. It is a proprietary assessment, not a third-party certification.

Detailed rubric protection: SSAI does not publish detailed scoring thresholds or weightings so the assessment is harder to game. The score-band thresholds are public: 300–579 Needs Attention, 580–669 Developing, 670–799 Strong, and 800–850 Exemplary.