Every figure on this page is counted from the control set itself. The requirements are published, the assessment is carried out by an independent accredited body, and the result goes in a public register.
Each control carries a mandatory, recommended or not-applicable value for every profile. Every not-applicable carries a recorded rationale.
02
How it works
The association that writes the rules is structurally barred from deciding who passes them.
The standard is published. Every control, its test type and its authority are open. Nothing that decides a certificate is behind a paywall.
A platform is assessed against it. The assessment is carried out by an independent certification body accredited to ISO/IEC 17065 by a national accreditation body, not by Custorian.
The certification body decides. Custorian maintains the scheme and licenses the mark to qualifying bodies. It never audits or certifies a platform itself.
The result is public. Certificates, their scope and their withdrawals appear in a public register, because a claim nobody can check is not accountability.
Why the separation matters. If the body that writes a standard also sells the certificate, every commercial pressure runs one way. Separating the two is the difference between a standard and a logo.
03
How certification works
The association that writes the rules is structurally barred from deciding who passes them.
01
Published
Every control, its test type and its legal authority are open. Nothing that decides a certificate is behind a paywall.
02
Assessed
An independent body accredited to ISO/IEC 17065 by a national accreditation body carries out the assessment.
03
Decided
That body decides the outcome. Custorian maintains the scheme and licenses the mark. It never audits or certifies a platform.
04
Public
Certificates, their scope and their withdrawals appear in a public register. A claim nobody can check is not accountability.
04
What it is anchored to
Every control cites a named authority. The Authority Register holds more than 140 instruments, each with its duty-bearer recorded, because a requirement addressed to a company cannot rest on an instrument that binds only States.
Binding on the platform Binds States Technical standard Proposed, not yet law
Only the top-right quadrant can be the sole authority for a control. Everything to the left of the vertical axis binds a State rather than an undertaking, so it is carried as normative rationale and interpretive aid. Everything below the horizontal axis is a technical reference or a proposal, and a proposal is never normative in the register.
Each point opens the umbrella entry for that instrument. Controls cite the register at article level, for example DSA Article 14 or GDPR Article 5, and those article-level anchors are the load-bearing ones.
Jurisdictional coverage
National detail sits in Regulatory Overlays, so the core standard stays portable. The standard is anchored in EU law, where the binding obligations on services used by children are sharpest, and the overlay mechanism is how it reaches further without the core being reopened.
Overlay coverage: Covered today: EU (27) · United Kingdom Next: AU · US · BR · IN · CA · SG · CN Not yet mapped
The Authority Register already carries instruments for every jurisdiction shown. Custorian starts at EU level by design and is built to go further: the overlay mechanism exists so a jurisdiction can be added without reopening the core standard. An overlay is shown as covered only once it has been read against primary sources, which is why the map says what it says.
05
Three levels, one gate
Conformity is graded, not pass or fail. Every level carries a hard gate on child sexual abuse and exploitation controls.
1
Baseline
Level 1
All applicable Foundational controls in place, every CSAE Foundational control operating, a documented child-safety case, and transparency reporting at Tier 1 depth.
Not sufficient for a designated VLOP or VLOSE
2
Standard
Level 2
All Foundational controls operating, at least 80% of Core controls in place, independent assurance, and effectiveness actually measured rather than asserted.
Minimum level for a designated VLOP or VLOSE
3
Advanced
Level 3
All Foundational and Core controls operating, at least 60% of Advanced controls in place, demonstrated risk reduction evidenced in the safety case, and external audit.
Published transparency at Tier 3 depth
06
Be certified first
We are selecting a small founding cohort of platforms to be assessed against the Custorian standard before anyone else. First movers shape the certification scheme, gain a head start on the DSA, the EU AI Act and the bloc's incoming child-safety rules, and earn the right to say they were verified safe for children before it was required.
Run jointly with a certification body. The pilot is a joint assessment with a certification body that holds ISO/IEC 17065 accreditation from a national accreditation body, so the method is tested by the people who will have to operate it. A pilot assessment is not certification: the scheme is not yet accredited, and a pilot statement says so on its face.
Founding-member discount, greater discounts for non-profits. Limited places.
07
What it is built against
Thirteen harm classes, mapped to 95 catalogued risks in CDSW. Every critical risk carries a foundational control.
08
Stress-test the standard
A standard nobody has attacked is not a standard, it is a draft with confidence. CDSW is stress-tested by outside expert peer reviewers.
Public review is now closed. Sign-up is by invitation key.
Reviewers are independent specialists who have no stake in the outcome: child-rights practitioners, trust and safety leads, regulators, academics, clinicians, law enforcement, engineers and young people’s advocates. You choose the domains you are qualified to review and the depth you can give, from a targeted read of one section to a deep dive across the control set.
Pick your domains. Ten control domains and eleven platform profiles. You review only what you actually know.
Comment on the record. Comments are submitted clause by clause in the ISO and CEN convention: general, technical or editorial, with the change you propose and the reason for it.
Every comment gets an answer. Each one is dispositioned with a stated reason, accepted or not. Nothing is quietly dropped.
What we ask, and what we do not. Review is unpaid and independent. It is not an endorsement, it does not make you an advisor, and it confers no certification advantage on any organisation you work for. Conflicts are declared at sign-up and recorded. You are credited by name and interest category only if you consent.
A small founding cohort of platforms will be assessed against the standard before anyone else, jointly with a certification body holding ISO/IEC 17065 accreditation from a national accreditation body. A pilot assessment is not certification: the scheme is not yet accredited, and a pilot statement says so on its face.
✓
Thank you.
Your application has been received. Places in the founding cohort are limited and each application is reviewed alongside the certification body running the joint assessment. We will be in touch either way.
Get involved in governance.
The Governance Board is Custorian’s primary governing body, holding ultimate fiduciary and safeguarding accountability across the association, without directing day-to-day operations. Seats are filled by resolution of the sitting Board and presented to the general assembly for ratification (Articles § 3.4 and § 5.1), for renewable two-year terms, unpaid, with four to six Board meetings a year, held virtually. At least two directors must be independent. Directors are expected to bring a strong professional network and help open doors to funding and partnerships. You cannot be employed by, or hold a financial interest in, a platform subject to the standard, or have any employment, contractual, or financial relationship with any Custorian arm, its commercial technology company, or a recognised Certification Body within the last 36 months.
The Advisory Board is a roster of ten to twelve named experts who provide ad hoc, per-task input on the standard, its ethical dimensions, and child-facing content, drawn from child rights, legal, technology & security, academic, clinical, law enforcement, and youth backgrounds. There is no fixed meeting cadence: work happens as discrete review tasks, formalised through an individual MOU. It advises. It does not govern.
✓
Thank you.
Your interest has been received. The foreningen reviews expressions of interest as it constitutes the Board and the Advisory Board roster. We will be in touch if there is a fit.
Become a member.
Support Membership is the association’s voting membership class. The fee is set by who is applying, not by what it buys: the rights are identical at every level. Applying registers your request, it is not a payment. Applications are reviewed quarterly by the Board; if accepted you receive a payment link by email.
✓
Application received.
Applications are reviewed quarterly by the Board. We will be in touch by email.
In peer review
The standard is in peer review
The full Child Digital Safety and Wellbeing Standard is being reviewed by independent experts before publication.
When it is published, this button will take you straight to it through its DOI, a permanent link that will not change.
This is a reference summary for context, not clinical or legal advice. If a child is in immediate danger contact local emergency services. Report CSAM or exploitation to your national hotline, for example the NCMEC CyberTipline, the IWF, or an INHOPE member.
Registration is now by invitation.
Open registration closed 15 September 2026, 23:59 CET. The peer review round is still running. It is now open only to reviewers Custorian has invited directly.
If we invited you, your invitation email contains an access key. Enter it below to open the sign-up form. If you were not invited and would still like to take part, write to info@custorian.org and tell us which of the ten CDSW domains you are qualified to review.
Stress-test the standard.
Deadline: 15 September 2026, 23:59 CET. Applications received after this time will not be considered for this review round.
Before we finalize the CDSW Standard, we are opening its outline, the domain structure and scope, not the finished control language, to experts, academics, and child-safety organisations for independent review. Every piece of incorporated input is credited by name in the published standard, unless you ask to remain anonymous.
✓
Thank you.
Your peer review application has been received. We verify identity and domain fit before assigning access. We will follow up by email with next steps for your preferred format.