Your service has been certified by an approved Conformity Assessment Body (CAB) and is listed on the GOV.UK register of digital identity and attribute services. You want to tell people about that.
How should you do that? What should you say and what shouldn’t you?
What the rules say
The trust framework and its certification processes require that service providers take steps to represent accurately the certified or registered status of their services. Failure to do this can risk losing your certification and appearance on the GOV.UK register.
These rules apply to you as a service provider in all of your activities. In your service. In your marketing materials. Everywhere.
They also apply to any other parties that you have partnered with; you must manage your relationship with them to protect trust in the ecosystem as a whole.
Say things like this
What does that look like in practice? When you are talking about your certification, you could say things like:
“Our service is certified against the UK digital identity and attributes trust framework.”
“We are independently certified against government rules for digital identity services.”
“We are trust framework certified.”
When you are talking about your service being on the GOV.UK register, you could say things like:
“Our service is on the GOV.UK register of digital identity services.”
“We are registered with government as a digital identity service provider.”
Don’t say things like this
Don’t say you’re “certified by government”
Certification of digital identity services is independent from government. We set the rules and independent conformity assessment bodies decide whether your service meets them.
Don’t say that your service is “government approved”
Being on the GOV.UK register does not mean government has approved or endorsed a service: it means you meet the rules and criteria for being on the list.
Don’t use Crown or Government logos, or anything like it
Use of government logos and the Crown are reserved and must not be used without prior permission. Don’t create your own versions that could give a false impression either. In the near future, digital identity services on the GOV.UK register will be permitted to use an official ‘trust mark’ on their services instead.
Don’t misrepresent your status
Maintaining trust in the digital identity services is a shared responsibility across OfDIA, CABs and providers. You must avoid doing anything that might be considered misleading in relation to your certification or appearance on the GOV.UK register, or that might damage trust in the ecosystem.
If we identify service providers using marketing that could be misleading in these ways, we will ordinarily write to the provider to ask them to stop. We will also refer the issue to the relevant CAB. Failure to take appropriate action may result in certification being suspended or withdrawn by your CAB, and a provider being removed from the register.
Leave a comment