Policy for the forthcoming implementation of the New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which introduces new regulatory requirements for the independent certification and testing of age assurance methods used by online platforms operating within the State of New York.

Certification Policy Notice

Notice Number: CPN-2026-01

Issue Date: July 21, 2026

Applies to:

• Current holders of ISO/IEC 27566 and/or IEEE 2089.1 certification
• Organisations currently undergoing certification
• New certification applicants
• Online platforms intending to operate their own in-house age assurance methods

1. Purpose of this Notice

This Certification Policy Notice advises organisations of the forthcoming implementation of the New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act, which introduces new regulatory requirements for the independent certification and testing of age assurance methods used by online platforms operating within the State of New York.

The proposed regulations establish, for the first time globally, a statutory requirement that qualifying age assurance methods are independently certified by an accredited Conformity Assessment Body (CAB) and satisfy specified technical testing requirements in addition to recognised international standards. The proposed regulations define certification as confirmation by an accredited third party that an age assurance method meets:

• ISO/IEC 27566:2025 (or IEEE 2089.1-2024 or an equivalent industry standard);
• the prescribed statutory accuracy requirements; and
• the testing requirements specified in Section 700.5(b) of the regulations.

2. Regulatory Background

The SAFE for Kids Act applies to operators of covered online platforms providing services within the State of New York.

The proposed regulations require operators using age estimation, age verification or age inference (“age assurance methods”) to obtain independent certification before those methods may be relied upon for compliance with the Act.

Following publication in the New York State Register, the regulations are expected to provide a 180-day implementation period before becoming enforceable.

As the only accredited Conformity Assessment Body currently offering certification against ISO/IEC 27566 and IEEE 2089.1, we have established the transition arrangements described below.

3. Organisations affected

This notice applies where an organisation provides an age assurance method that is, or is intended to be, relied upon by:

• social media platforms;
• online services;
• online applications;
• mobile applications; or
• other online platforms

that fall within the scope of the SAFE for Kids Act and operate in the State of New York.

The notice also applies where an online platform intends to operate its own age assurance method internally rather than relying upon an external provider.

4. Transition Policy

A. Existing Certified Clients

Organisations currently holding valid certification under ISO/IEC 27566 and/or IEEE 2089.1 will not be required to undergo a completely new certification assessment.

Instead, they may apply for an Extension to Scope to incorporate the additional statutory requirements of the SAFE for Kids Act.

Applications for Extension to Scope should be submitted within 90 days of publication of the regulations.

This allows sufficient time for:

• application review;
• planning;
• assessment of the additional statutory requirements;
• any corrective actions; and
• issuance of updated certification before the expiry of the 180-day transition period.

B. Organisations Currently Undergoing Certification

Applicants already progressing through certification may amend their existing application to include compliance with the SAFE for Kids Act.

To facilitate completion during the transition period, requests to amend the application should be received within 45 days of publication of the regulations.

This avoids duplication of work and enables the additional statutory requirements to be incorporated into the existing certification programme.

C. New Certification Applicants

New applicants wishing to obtain certification for use within New York may apply immediately.

To maximise the likelihood of certification before the regulations become fully effective, complete applications should be submitted within 30 days of publication of the regulations.

This policy also applies to online platform operators intending to certify an internally developed age assurance method rather than using a third-party provider.

D. Applications Received After These Dates

Applications submitted after the recommended deadlines will continue to be accepted.

However, owing to assessment, testing and certification timescales, we cannot guarantee that certification will be completed before the end of the statutory transition period.

Organisations submitting later applications should plan accordingly.

5. Scope of Assessment

Certification under the SAFE for Kids Act will build upon existing certification against ISO/IEC 27566 and IEEE 2089.1 while incorporating the additional statutory requirements introduced by the New York regulations.

The assessment will include, as applicable:

• compliance with the relevant international standard(s);
• verification that the age assurance method satisfies the statutory performance thresholds;
• assessment of the mandatory testing requirements prescribed by Section 700.5;
• review of supporting technical evidence;
• evaluation of governance, quality management and change control arrangements;
• confirmation that independent testing has been undertaken in accordance with the regulatory requirements; and
• verification that the certified scope accurately reflects the deployed age assurance method and intended use.

Existing certified organisations will generally only require assessment of the additional statutory requirements not already covered by their current certification.

6. Certification Outcome

Successful applicants will receive an updated certificate identifying that the certified age assurance method has been assessed against the applicable international standard together with the additional requirements necessary to support compliance with the New York SAFE for Kids Act.

Where appropriate, the certificate scope will expressly identify the inclusion of the SAFE for Kids Act requirements.

Please note that certification is subject to demonstration of objective evidence of requirements in the regulations and certification cannot be guaranteed.

7. Further Information

Detailed application guidance, assessment criteria, testing requirements and supporting documentation will be published following formal publication of the final regulations.

Organisations wishing to begin planning should contact us as soon as practicable.