AI Safety Testing & Certification

Executive Summary

Regulation (EU) 2024/1689, the EU AI Act, is the world's first comprehensive AI governance law. It classifies AI systems by risk level and imposes binding obligations on providers and deployers of high-risk systems. From 2 December 2027, high-risk AI systems in sensitive areas — biometrics, employment, education, critical infrastructure — must complete conformity assessment, carry CE marking, and maintain full lifecycle risk management documentation.

The AI Omnibus (Regulation (EU) 2026/1744), which entered into force on 27 July 2026, extended the original high-risk deadline by 16 months but did not reduce the obligations. Fines remain severe: up to €35 million or 7% of global turnover for prohibited practices, and €15 million or 3% for high-risk requirement violations.

Alongside the AI Act, a commercial market for AI safety testing and red teaming services is emerging. Specialist platforms (Giskard, Holistic AI, Mindgard), major consultancies (EY, Deloitte, Accenture) and cybersecurity firms are building AI safety testing practices. Third-party market research reports estimate the global AI red teaming services market in the low single-digit billions, though estimates vary and are not independently verified.

This Topic Hub tracks whether an independent AI safety testing and certification services market is forming, who participates, what evidence supports the thesis, and what remains uncertain.

Why This Market Is Forming Now

• Regulation is enforceable. The EU AI Act is not a voluntary framework. It carries fines of up to €35 million or 7% of global turnover. The Commission has had enforcement powers over GPAI since August 2026. High-risk obligations follow in December 2027.
• Conformity assessment is mandatory. High-risk AI systems must undergo conformity assessment before being placed on the EU market. Some require third-party notified body assessment. All require CE marking, technical documentation and an EU declaration of conformity.
• Testing obligations are binding. High-risk AI systems face mandatory risk management, accuracy, robustness, cybersecurity and testing requirements under Article 15. For GPAI models with systemic risk, Article 55 additionally requires documented adversarial testing (red teaming). NIST AI RMF recommends pre-deployment red teaming. These are compliance evidence requirements, not suggestions — but the scope of adversarial testing obligations differs between high-risk systems and GPAI models.
• Commercial service activity is real. Specialist testing platforms, major consultancies and cybersecurity firms are actively building AI safety testing practices. Third-party market research reports estimate the global AI red teaming market in the low single-digit billions of dollars, though estimates vary and are not independently verified by EII. The core market-formation signal is binding regulation, compliance deadlines and real service provider activity — not market size estimates.
• Standards infrastructure is forming. ISO/IEC 42001 (AI management systems) is published and certifiable. ISO/IEC 42005 (AI system impact assessment) provides structured processes. These standards create the audit framework that safety testing services must map to.

Regulatory Timeline

Who Is Affected

What AI Safety Testing Requires

AI safety testing is not a single certification exam. It is a set of testing, evaluation and documentation activities that must be performed across the AI system lifecycle.

Emerging Service Ecosystem

Evidence Classification

What Could Break the Thesis

• Further delays. The AI Omnibus already extended deadlines by 12-16 months. Political pressure could trigger additional delays, reducing urgency for compliance investment.
• Enforcement inconsistency. Member states must designate competent authorities and notify conformity assessment bodies. If capacity varies widely, the level playing field may not materialise.
• Open-source exemption gap. If open-source AI models receive broad exemptions, a significant portion of AI development may operate outside the compliance framework, reducing the addressable market.
• Testing commoditisation. If automated scanning tools and open-source red teaming frameworks become sufficient for basic compliance, the premium testing and consulting market may be smaller than expected.
• Jurisdictional fragmentation. If different jurisdictions adopt conflicting AI governance frameworks, service providers may face complexity costs that limit market growth.

What Companies Should Prepare

1. Classify your AI systems — determine which fall under prohibited practices, high-risk (Annex III), limited risk or minimal risk categories
2. Map conformity assessment routes — determine whether your systems require internal control or third-party notified body assessment
3. Build risk management systems — establish lifecycle risk management processes covering design, development, deployment and post-market monitoring
4. Conduct adversarial testing — run red teaming exercises covering prompt injection, jailbreak, data extraction, bias and harmful output scenarios
5. Prepare technical documentation — compile the evidence required for conformity assessment including data governance, human oversight and transparency measures
6. Implement post-market monitoring — establish incident reporting, drift detection and continuous risk reassessment processes
7. Monitor notified body availability — check whether member states have designated conformity assessment bodies in your AI system's domain
8. Map to ISO/IEC 42001 — align your AI management system with the certifiable standard, which increasingly serves as the baseline for procurement requirements