# FTAI assessment preparation

Status: engineering preparation, not certified. Operator: Fisemarco OÜ; registry code: 14933422; location: Tallinn, Estonia; contact: hello@fisemarco.com. These details were supplied by the operator on 12 October 2026. The full registered street address and operational/legal assessment remain pending.

Organisations can use `/enterprise` → Governance centre → Assessment to record 14 preparation controls, evidence URLs, SHA-256 fingerprints, responsible member references and review dates. Export creates a signed, clearly labelled operator self-assessment. No checkbox grants an ISO badge or confirms legal compliance.

## Assessor handoff

1. Establish the legal entity, accountable management, scope and applicable obligations.
2. Complete risk assessment, treatment decisions, supplier/data-processing arrangements, privacy notices, retention and rights handling.
3. Demonstrate staff access controls, key custody, resource enforcement, incident handling, backups and a successful restore exercise.
4. Commission independent penetration/conformance testing, remediate findings and retain retest evidence.
5. Perform internal audit and management review; appoint an independent certification body for the chosen scheme and scope.

Repository evidence includes the source/lockfile, threat model, operational runbook, software inventory and reproducible integration tests. The 2026-10-01 governance update adds exact-task human approval, signed agent delegation, monitored authority activity, trend thresholds, verifier trust-anchor integration, SDK transport interoperability and a bounded testnet.

ISO/IEC 27001 concerns an organisation's information security management system. Certification is issued by an external certification body, not by ISO and not by this application: [ISO certification guidance](https://www.iso.org/certification.html), [ISO/IEC 27001](https://www.iso.org/standard/27001).

AI Act duties depend on provider/deployer role, intended use and risk classification. An agent passport is not blanket AI Act compliance: [European Commission guidance](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai).

The operator must verify production hosting region, subprocessors, transfer safeguards, administrator protections, restoration and response coverage with its actual providers. Local automated tests cannot establish these facts.


## FTAI-issued agent certificates

FTAI now operates the separate [Runtime Identity v1 scheme](/certification-scheme.md). Its automated technical checks and 24-hour credentials do not certify this management-system readiness assessment. An independent certification body is needed only when seeking an external certification claim; it is not needed to issue the clearly scoped FTAI product credential.