Home Custorian
How it works

What the standard asks, and who gets to check.

Every figure on this page is counted from the control set itself. The requirements are published, the assessment is carried out by an independent accredited body, and the result goes in a public register.

Enter invitation key
01

What the standard contains

Every figure below is counted from the control set itself, not estimated.

267Auditable controls
10Control domains
11Platform profiles
160+Legal instruments
D1Governance & Accountability29
D2Age Assurance & Access34
D3Data Protection & Privacy29
D4Content Safety35
D5CSAE: abuse and exploitation35
D6AI & Algorithmic Safety24
D7Design, Advertising & Commercial31
D8Reporting, Complaints & Redress14
D9Empowerment, Autonomy & Wellbeing24
D10Device & IoT12
Controls per domain, CDSW 3 v0.6267 total

The eleven platform profiles

Each control carries a mandatory, recommended or not-applicable value for every profile. Every not-applicable carries a recorded rationale.

02

How it works

The association that writes the rules is structurally barred from deciding who passes them.

  1. The standard is published. Every control, its test type and its authority are open. Nothing that decides a certificate is behind a paywall.
  2. A platform is assessed against it. The assessment is carried out by an independent certification body accredited to ISO/IEC 17065 by a national accreditation body, not by Custorian.
  3. The certification body decides. Custorian maintains the scheme and licenses the mark to qualifying bodies. It never audits or certifies a platform itself.
  4. The result is public. Certificates, their scope and their withdrawals appear in a public register, because a claim nobody can check is not accountability.
Why the separation matters. If the body that writes a standard also sells the certificate, every commercial pressure runs one way. Separating the two is the difference between a standard and a logo.
03

How certification works

The association that writes the rules is structurally barred from deciding who passes them.

04

What it is anchored to

Every control cites a named authority. The Authority Register holds more than 140 instruments, each with its duty-bearer recorded, because a requirement addressed to a company cannot rest on an instrument that binds only States.

In forceNot in force
Binds StatesBinds the platform
Binding on the platform Binds States Technical standard Proposed, not yet law

Only the top-right quadrant can be the sole authority for a control. Everything to the left of the vertical axis binds a State rather than an undertaking, so it is carried as normative rationale and interpretive aid. Everything below the horizontal axis is a technical reference or a proposal, and a proposal is never normative in the register.

Each point opens the umbrella entry for that instrument. Controls cite the register at article level, for example DSA Article 14 or GDPR Article 5, and those article-level anchors are the load-bearing ones.

Jurisdictional coverage

National detail sits in Regulatory Overlays, so the core standard stays portable. The standard is anchored in EU law, where the binding obligations on services used by children are sharpest, and the overlay mechanism is how it reaches further without the core being reopened.

MaltaSingapore
Overlay coverage: Covered today: EU (27) · United Kingdom Next: AU · US · BR · IN · CA · SG · CN Not yet mapped

The Authority Register already carries instruments for every jurisdiction shown. Custorian starts at EU level by design and is built to go further: the overlay mechanism exists so a jurisdiction can be added without reopening the core standard. An overlay is shown as covered only once it has been read against primary sources, which is why the map says what it says.

05

Three levels, one gate

Conformity is graded, not pass or fail. Every level carries a hard gate on child sexual abuse and exploitation controls.

1
Baseline
Level 1
All applicable Foundational controls in place, every CSAE Foundational control operating, a documented child-safety case, and transparency reporting at Tier 1 depth.
Not sufficient for a designated VLOP or VLOSE
2
Standard
Level 2
All Foundational controls operating, at least 80% of Core controls in place, independent assurance, and effectiveness actually measured rather than asserted.
Minimum level for a designated VLOP or VLOSE
3
Advanced
Level 3
All Foundational and Core controls operating, at least 60% of Advanced controls in place, demonstrated risk reduction evidenced in the safety case, and external audit.
Published transparency at Tier 3 depth
06

Be certified first

We are selecting a small founding cohort of platforms to be assessed against the Custorian standard before anyone else. First movers shape the certification scheme, gain a head start on the DSA, the EU AI Act and the bloc's incoming child-safety rules, and earn the right to say they were verified safe for children before it was required.

Run jointly with a certification body. The pilot is a joint assessment with a certification body that holds ISO/IEC 17065 accreditation from a national accreditation body, so the method is tested by the people who will have to operate it. A pilot assessment is not certification: the scheme is not yet accredited, and a pilot statement says so on its face.

Founding-member discount, greater discounts for non-profits. Limited places.

07

What it is built against

Thirteen harm classes, mapped to 95 catalogued risks in CDSW. Every critical risk carries a foundational control.

08

Stress-test the standard

A standard nobody has attacked is not a standard, it is a draft with confidence. CDSW is stress-tested by outside expert peer reviewers.

Public review is now closed. Sign-up is by invitation key.

Reviewers are independent specialists who have no stake in the outcome: child-rights practitioners, trust and safety leads, regulators, academics, clinicians, law enforcement, engineers and young people’s advocates. You choose the domains you are qualified to review and the depth you can give, from a targeted read of one section to a deep dive across the control set.

  1. Pick your domains. Ten control domains and eleven platform profiles. You review only what you actually know.
  2. Comment on the record. Comments are submitted clause by clause in the ISO and CEN convention: general, technical or editorial, with the change you propose and the reason for it.
  3. Every comment gets an answer. Each one is dispositioned with a stated reason, accepted or not. Nothing is quietly dropped.
What we ask, and what we do not. Review is unpaid and independent. It is not an endorsement, it does not make you an advisor, and it confers no certification advantage on any organisation you work for. Conflicts are declared at sign-up and recorded. You are credited by name and interest category only if you consent.

If you were not invited and want to take part, write to info@custorian.org.