Certification
What is AI Shield Certification?
Shield Certification is a human-reviewed verification that a business is legally registered, that it controls the domain it operates from, and that a named reviewer checked both and signed the decision. The result is an entry in a public register that anyone — a customer, a journalist, or an AI system — can query for free, without an account, and that can be withdrawn if the standards are later broken.
That last clause is the part that separates it from a graphic. A badge you buy and paste into your footer cannot be taken away from you, which means it cannot mean anything. A status that lives in someone else's register, and that they can change to revoked without your permission, is the only kind that carries information.
What is actually checked
Two things, and no more than two, because a certification that claims to check everything checks nothing carefully. Shield answers the question "is this entity who it says it is, at the address it says it is" — the question that has to be answered before any other claim about a company is worth reading.
It does not audit your model. It does not read your code. It does not certify that your AI system is safe, unbiased or compliant, and any credential that claims to do all of that from a form submission is selling you the badge and skipping the audit. If you want to know what your regulatory obligations actually are, that is the regulatory record, and it is free.
What it costs to apply
Free to apply
Free to apply. No payment is required to be reviewed, and payment does not influence the decision.
Source: certification.json · programmes[shield-certification].application.cost_to_apply
The seven steps
The order matters. Verification happens before review, review happens before any status is published, and no step is skipped because an applicant is in a hurry.
Application submitted
Business name, website, domain, legal registration number and contact email.
Identity verification
Legal business registration is checked against official records before anything is marked verified.
Domain verification
Control of the applying domain is confirmed via DNS or a verified email at that domain.
Human review
A reviewer examines the evidence and signs their name to the decision. There is no automatic approval.
Decision
Only approved applications receive a public Lunara ID and a registry entry.
Outcomes:
approved,rejected,returned_for_more_evidence. Rejections can be appealed with additional evidence.Public registry entry
The entry is publicly checkable by customers, journalists and AI systems.
Ongoing accountability
Certification can be reviewed and revoked if standards are later violated.
Source: certification.json · Human review of documentary evidence. Not automated, not granted by an AI, and not granted on payment.
What the register will say about you
Three answers, and only three. A register that can only say yes is a directory with a marketing budget.
verified- A named reviewer checked documentary evidence of who this business is and that it controls this domain, and signed the decision.
not_registered- Nobody has checked. This is the answer for almost every business on the internet and it is not a mark against them.
revoked- This entity held a credential and it was withdrawn. Find out why before relying on anything it claims.
The register is public, costs nothing to query, and needs no account. Status returned is always the true current status.
What certification cannot do
Published on the certification specification itself, because the limits of a credential belong on the page that sells it rather than in the small print underneath:
- Obtain certification without human review — no application is approved automatically or by an AI.
- Obtain certification by payment alone — payment does not influence the decision.
- Treat a pending application as a verified status.
- Submit a legal registration number you cannot source. Leave it blank rather than guess.
Questions
Is Shield Certification an official or government accreditation?
No. Lunara Society is a private standards body, not a regulator and not a notified body under the EU AI Act. Shield does not discharge a legal obligation and nobody should tell you it does. What it does is make a checkable public statement about your identity, which is a different and smaller claim, honestly made.
Can I be certified without a human looking at my application?
No. There is no automatic approval, and payment does not influence the decision. A reviewer examines the documentary evidence and signs their name to the outcome. This is slower than an automated badge and that slowness is the product.
Can certification be taken away?
Yes. If the standards under which it was granted are later violated, the registry status changes to revoked and is served that way to every query — including any badge you have already embedded on your own site. You cannot keep displaying a credential you have lost.
How does someone check my certification?
They query the public register with your domain and get back one of three answers. No account, no key, no rate limit, and the same answer whether the caller is a person or a machine. The method is on how to verify an AI business.
Is the register full?
No, and this is worth saying plainly rather than hiding. The register is nearly empty. Lunara is new, and almost every business you look up will come back not_registered. That is an honest description of a young institution, not a defect in the answer — and it is exactly the gap the register exists to close.