What the register is
A single public list of every certificate issued under the CDSW scheme, current and withdrawn.
Custorian writes and maintains the standard. It does not audit and does not certify. Assessments are carried out by independent certification bodies accredited to ISO/IEC 17065 and licensed by Custorian, and each certificate is issued by the body that carried out the assessment.
Custorian publishes the register so that a claim of certification can be checked by anyone: a parent, a procurement officer, a journalist, a regulator. The organisation that holds a certificate does not control its entry, and cannot remove it by leaving the scheme. Certificates that are suspended or withdrawn stay on the register, marked as such.
What an entry shows
Every entry carries the same fields, so two certificates can be compared directly.
| Field | What it tells you |
|---|---|
| Certificate holder | The legal entity that holds the certificate, not a brand or a parent group. |
| Named service | The specific service assessed. A certificate covers what is named and nothing else. |
| Scope | The platform profile and the boundary of the assessment, including anything excluded. |
| Level | The level of conformity reached: L1 Baseline, L2 Standard or L3 Advanced. |
| Certification body | The accredited body that carried out the audit and issued the certificate. |
| Standard edition | The edition of CDSW in force at the date of audit. Certificates are assessed against a stated edition. |
| Issued and valid to | The date of issue and the date the certificate expires. |
| Status | Current, suspended or withdrawn, with the date the status changed. |
Scope is the field most often misread. A certificate held by a group does not extend to every service that group operates, and a certificate for one service does not extend to a successor product.
How to check a claim
If someone tells you a service is CDSW certified, three checks settle it.
- Find the entry. Search the register for the named service. If there is no entry, there is no certificate, whatever the website says.
- Read the scope. Confirm the service you are asking about is the one named, and check what the assessment excluded.
- Check the status and the date. A certificate that has expired, been suspended or been withdrawn is not a current certificate, and the entry will say so.
Any claim that cannot survive those three checks should be treated as unverified. Custorian will confirm the position on any entry on request.
What a certificate does not mean
One misunderstanding is worth correcting before it spreads.
- It is not a finding of legal compliance. A certificate does not establish compliance with the Digital Services Act, the GDPR, any online safety legislation or any other law. Only the competent regulator or a court can determine compliance.
- It is not regulatory approval. No regulator has endorsed, approved or recognised the scheme, a certificate or a certified organisation. Custorian holds no such endorsement and does not seek to imply one.
- It is not a guarantee of safety. No certificate can promise that no child will come to harm on a service. It records what an independent body found, at a stated scope, on a stated date.
- It does not cover what was never examined. Anything outside the stated scope was not assessed, and a certificate can be suspended or withdrawn at any time.
Current status
The standard is in expert review ahead of public consultation, and no certification body has yet issued a CDSW certificate. Any claim of CDSW certification made today is incorrect.
The first certificates are expected to come out of the pilot, which is run jointly with a certification body holding ISO/IEC 17065 accreditation from a national accreditation body. A pilot assessment is not certification, and a pilot statement says so on its face.
Reporting misuse
The mark belongs to Custorian and may only be used inside the terms of a live certificate.
Not permitted: any claim that certification demonstrates or supports compliance with a named law or code; any use of a regulator’s name or logo alongside the mark; any claim of regulatory approval or recognition; and any use of the mark outside the certified scope.
Misuse of the mark, including a compliance claim, is a ground for suspension or withdrawal of the certificate by the certification body that issued it, and for withdrawal of mark usage rights by Custorian as scheme owner.