RISE has certified Berget AI AB to SS-EN ISO/IEC 27001:2023. The certificate gives our customers an independent assessment of how we manage information security for our services. For organisations evaluating an AI provider, the certificate is evidence that we're serious about risk and information security.
Months of groundwork, 29 days to certificate
RISE issued the certificate on 11 November 2026, 29 days after the initial Stage 1 assessment, but we've been laying the foundation since the beginning of 2026.
- On 13 October 2026, RISE carried out the Stage 1 assessment.
- On 15 October 2026, the planning dialogue closed and we scheduled Stage 2.
- On 26–28 October 2026, RISE visited our offices for the Stage 2 audit. The outcome was 7 minor non-conformities, and we resolved them within a week.
- On 11 November 2026, RISE issued the certificate.
In the rest of this article, we'll share where we are today and how the team works with structured risk management.
An agent-first way to manage the ISMS
Our Information Security Management System (ISMS) lives in a version-controlled Git repository where policies and living registers exist together as Markdown documents. Framework folders map individual standards to those documents, while compliance records preserve evidence of what happened and when. Employees, auditors, and managers have separate entry points into the same material.
The Git repository gives us traceability, and plain-text Markdown documents make it easy for our agents to read across the documentation so we can check that it's accurate and up to date. Anyone from our team can ask an agent to find inconsistent statements and locate the authoritative reference.
We already use GitOps to prevent configuration drift between our infrastructure repository and the production environment. We've extended that idea to include the ISMS. Automated agent reviews validate our infrastructure and identify gaps in our policies and processes on a regular cadence.
Automated compliance checks keep us honest
Git also preserves the review trail around document changes: for approved ISMS documents, a pull request modifying the document required management approval on its current head commit, and a new push required fresh approval. By a human. While agents help us with the tedious work of getting our documentation up to date, all changes are still reviewed and signed off by one of us.
On top of all this, the same material also makes training and supporting employees in their everyday work easier. Employees can ask their agent to explain a process or check their understanding at their own pace, and get support in the moment it matters. Even during the audit, our agents helped draft updates and findings, which we could verify against live systems to confirm that the documentation matched reality.
What we learned
Build the foundation early. We didn't want to postpone risk-management and compliance work until a larger organisation or a procurement deadline forced it on us. The model catalogue is what customers see, but the ability to explain and verify our working practices sits underneath it.
Verify, don't assume. A policy can exist without matching the system it describes, and a control can appear in a document without enough evidence to support its status. Agents will happily generate a fictional world that looks great but doesn't hold up to reality. Checking live systems and reconciling documents to authoritative references exposed gaps that a documentation-only review could miss.
Agents don't approve. They can search, explain, draft, and check, but a person still has to decide whether a finding is valid, a document is ready, or a risk is acceptable. Certification doesn't finish that work because an ISMS needs continued maintenance and improvement after the certificate arrives.
Review the evidence and talk to us
Our Data Processing Agreement is public. You can also request the current Statement of Applicability through a procurement conversation, subject to the normal confidentiality process.
Contact sales to discuss the certificate, DPA, or Statement of Applicability.
The certificate records the result of the external assessment, and our working records continue to track the reviews, evidence, and approvals that maintain the system behind our services.