Four states, no grey zone
Public claims are labelled implemented, internally evidenced, limited or planned. Every entry states its verification basis and deliberate boundary.
- Internal tests are not an external audit
- Pilot readiness is not general availability
- EU operation is not automatic compliance
Next maturity step
Independent cryptographic and implementation review, penetration testing and concrete operational acceptance remain separate external assurance engagements.
CONTROLLED ESCALATION
Evidence CenterReview the claim independently.
Review the Evidence Center, documentation and operational status together.