Valid-AI-ted: The AI-Scored STAR Level 1 Explained (2026 Guide)

Valid-AI-ted is the Cloud Security Alliance’s AI-scored variation of STAR Level 1: a provider submits its CAIQ self-assessment, CSA’s large-language-model tool evaluates it against a standardised scoring model derived from the Cloud Controls Matrix, returns near-instant feedback with revision guidance whether the result is a pass or a fail, and on passing awards a Valid-AI-ted badge on the STAR Registry. It costs $595 for up to ten scoring attempts, is free to CSA corporate members, and since 20 November 2025 the same mechanism applied to the AI-CAIQ — combined with an ISO/IEC 42001 certificate — earns STAR for AI Level 2. It is the first assurance scheme in which the assessor is a model, and the ten attempts make it a scoring loop rather than an exam. This guide sets out what the tool scores and how, the difference between a Valid-AI-ted badge and a Level 2 audit, the submission process and what to prepare, how it feeds STAR for AI, and how to use the ten attempts well.

What Valid-AI-ted is

CSA’s STAR page describes it in one sentence: “an optional enhancement to STAR Level 1, using AI to automatically evaluate CAIQ v4 submissions”, with “near-instant feedback and guidance — plus a Valid-AI-ted badge on the STAR Registry upon passing”. The overview document CSA published on 9 June 2025 explains the mechanism: an LLM-based tool that evaluates the self-assessment, provides automated, actionable feedback, supports continuous improvement, and awards the badge. Four features are listed on the STAR page — up to ten scoring attempts for the $595 fee, a standardised scoring model based on the CCM, detailed feedback and revision guidance for both pass and fail results, and the badge. Our guide to STAR Level 1 covers the tier it sits inside.

What the scoring model looks at

CSA has not published the weights, but the inputs are the CAIQ itself, and the tool is scoring what a human reviewer would: whether each answer is supported by a justification that describes a real control, whether the shared responsibility allocation is coherent, whether not-applicable answers are explained, and whether the answers across a domain are internally consistent. The practical difference from a human review is speed and uniformity — every submission is measured against the same model — and the practical difference from a Level 2 audit is that nothing is tested. The badge says the self-assessment is well-formed and complete against the CCM; it does not say an auditor examined the controls. Our guide to the Cloud Controls Matrix covers the 207 objectives the model is derived from.

Badge against audit

How to submit

1. Complete the submission version of CAIQ v4.1 — not the CCM + CAIQ reference bundle, which CSA says cannot be submitted.
2. Write justifications for every answer, including N/A, naming the control, the system and the evidence; the model is scoring completeness and coherence.
3. Submit for scoring through the registry submission route and pay the fee, or use corporate membership.
4. Read the feedback — it identifies the answers that failed the model and why.
5. Revise and resubmit, up to ten times; the badge is awarded on passing and appears on the registry entry.

The AI-scored route into STAR for AI

The same mechanism runs on the AI Controls Matrix. An AI-CAIQ self-assessment against the AICM earns STAR for AI Level 1; since 20 November 2025 an organisation can combine a Valid-AI-ted AI-CAIQ with an ISO/IEC 42001 certification to earn STAR for AI Level 2, listed on the registry as “ValidAIted + 42001”. That makes the scored self-assessment a component of a Level 2 designation for the first time — an organisation pursuing ISO 42001 is most of the way to STAR for AI Level 2 and may not know it. Our guide to the AI Controls Matrix covers the 247 objectives and the AI-CAIQ.

Using the ten Valid-AI-ted attempts

• Do not spend the first attempt on a draft. The feedback is most useful on a submission you believe is complete; use it to find what you missed, not what you skipped.
• Fix by domain. Feedback clusters; a weak justification pattern in one domain usually repeats across it.
• Do not write to the model. Answers tuned to pass scoring but not matched by controls are public, permanent and comparable with the next audit; the badge does not protect an overclaim.
• Keep the feedback reports. They are the gap analysis for Level 2.
• Refresh annually, and rescore when the CCM version changes.

Frequently asked questions

What is Valid-AI-ted?
CSA’s optional, AI-powered evaluation of a STAR Level 1 CAIQ submission: an LLM-based tool scores the self-assessment against a standardised model derived from the Cloud Controls Matrix, returns feedback and revision guidance, and awards a Valid-AI-ted badge on the STAR Registry on passing.

How much does it cost?
$595, including up to ten scoring attempts; free to CSA corporate members.

Is it a certification?
No. It is a scored self-assessment; independent testing is STAR Level 2. The badge tells a buyer the self-assessment is complete and well-formed, not that an auditor examined the controls.

Does it apply to AI?
Yes. A Valid-AI-ted AI-CAIQ against the AI Controls Matrix, combined with ISO/IEC 42001 certification, has earned STAR for AI Level 2 since 20 November 2025.

Can buyers see the score?
They see the badge and the published CAIQ; the detailed feedback report is the provider’s.

Where this leaves you

Use the tool as the scoring loop it was built to be: submit a complete CAIQ, read the feedback, fix by domain, resubmit, and take the badge — without writing to the model, because the entry is public. Keep the feedback as the Level 2 gap analysis, and if ISO 42001 is on the roadmap, run the AI-CAIQ through it too.

References

• Cloud Security Alliance: STAR programme — Valid-AI-ted description, the four features, the $595 fee and corporate-member exemption, and the STAR for AI Level 2 route from 20 November 2025.
• Cloud Security Alliance: Valid-AI-ted Overview (9 June 2025) — The LLM-based mechanism, feedback and badge.

More on CSA STAR

• Valid-AI-ted — you are here
• STAR Level 1: the self-assessment
• CSA STAR: the levels, Valid-AI-ted and STAR for AI
• AI Controls Matrix and STAR for AI
• STAR Level 2: certification vs attestation
• Cloud Controls Matrix v4.1 and the CAIQ

The CAIQ v4.1 Self-Assessment Workbook, the Registry Submission Pack, the Evidence Repository Index and the Customer Trust Page Content Pack are in the CSA STAR Cloud Security Toolkit, or start with the free templates.