The Clause Exclusion Problem
Most management system standards allow certain clauses to be excluded from the scope of certification when they are not applicable to the organization's activities. ISO 9001:2015 Clause 4.3 explicitly permits exclusions, but only for requirements within Clause 7 (specifically 7.1.5.2 for measurement traceability, 8.3 for design and development, and similar application-dependent requirements). Other clauses are mandatory and cannot be excluded under any circumstances.
Getting clause exclusions right matters because an incorrect exclusion undermines the validity of the entire certification. If a CB excludes a mandatory clause, the resulting certificate does not actually demonstrate conformity to the standard. If an accreditation assessor discovers that a CB has been excluding clauses that should not be excluded, the finding affects not just one client file but potentially every file where the same error was made.
Historically, clause exclusion decisions are made by auditors and planners based on their understanding of the client's scope and the standard's requirements. This works well when the professional has deep experience with the specific standard. It works less well when the volume of audits is high, when multiple standards are in play, and when the professional is less experienced with the specific exclusion rules for a particular standard.
The Risk of Unconstrained AI
Artificial intelligence has obvious potential to help with clause exclusion analysis. Given information about a client's scope, an AI model could analyze which clauses are likely not applicable. The problem is what happens when the AI gets it wrong.
Large language models can hallucinate. They can produce confident, well-reasoned justifications for excluding a clause that must never be excluded. A model might suggest that a service company can exclude Clause 8.5.1 (Control of production and service provision) because they "do not have a production facility," ignoring that service provision falls under the same clause. The suggestion would sound reasonable. It would be wrong. And if the planner accepts it without sufficient scrutiny, a flawed exclusion enters the certification.
The danger is amplified because AI suggestions carry an authority that manual suggestions do not. When a colleague suggests an exclusion, the planner naturally applies professional skepticism. When an AI system presents a list of recommended exclusions with justifications, there is a psychological tendency to accept the output, especially when the workload is heavy and the suggestions seem plausible.
Certiva's Constrained Approach
Certiva uses AI for clause exclusion suggestions, but with a critical architectural constraint: the AI does not operate in open space. It works within boundaries enforced by deterministic code.
The System-Approved Candidate List
For each supported standard, Certiva maintains a curated list of clauses that are legitimately candidates for exclusion. This list is defined by the CB's technical team based on the standard's requirements and accreditation body guidance. Clauses that are mandatory under all circumstances are never included in the candidate list.
For ISO 9001:2015, the candidate list might include Clause 8.3 (Design and development) and specific sub-clauses where exclusion is permissible depending on the organization's activities. Clause 4.1 (Understanding the organization and its context), Clause 5.1 (Leadership and commitment), and other mandatory requirements are not in the list and cannot be suggested, regardless of what the AI model might think.
AI Suggests, Code Filters
The process works in two stages:
- 1. AI Analysis. The AI model analyzes the client's scope description, industry, and activities to determine which clauses from the candidate list are likely not applicable. The model generates suggestions with reasoning.
- 2. Code-Level Filtering. Before the suggestions reach the planner, they pass through a deterministic code filter that re-validates every suggestion against the approved candidate list. If the AI somehow suggests a clause that is not on the candidate list, the filter removes it. The planner never sees it.
This two-stage approach means the AI can contribute its analytical capability — understanding that a pure service company probably does not perform design activities, for example — while the code layer ensures that only permissible exclusions are ever presented.
Planner Confirmation Required
Even after filtering, the AI's suggestions are exactly that: suggestions. They appear in the planning interface as recommendations, not as decisions. The planner reviews each suggestion, considers whether it is appropriate for the specific client, and either confirms or rejects it. No exclusion is applied automatically.
This human-in-the-loop step is essential. The AI might correctly identify that Clause 8.3 is a candidate for exclusion, but the planner knows from the application that the client recently added a product design division. The AI did not have that context. The planner does. The suggestion is rejected, and the exclusion is not applied.
Standards Coverage
Certiva's clause exclusion system supports the major management system standards:
- •ISO 9001:2015 — Quality management systems, where design and development exclusions are most common.
- •ISO 14001:2015 — Environmental management systems, which have more limited exclusion possibilities.
- •ISO 45001:2018 — Occupational health and safety management systems.
- •ISO 27001:2022 — Information security management systems, where Annex A control applicability is addressed through the Statement of Applicability rather than clause exclusion, but the AI assists with SoA analysis.
- •ISO 22000:2018 — Food safety management systems, with sector-specific applicability considerations.
- •ISO 13485:2016 — Medical devices quality management systems, where exclusion rules are particularly strict due to regulatory implications.
Each standard has its own candidate list reflecting that standard's specific rules about what can and cannot be excluded. The AI and the code filter both operate with standard-specific logic.
Why "Constrained AI" Is the Right Label
In public discourse, AI in certification is often presented as either a miracle solution or a dangerous risk. Certiva's approach avoids both extremes.
The AI is genuinely useful. Analyzing a scope description against dozens of clauses to identify likely exclusions is time-consuming work that benefits from pattern recognition. The AI reduces the time a planner spends on this analysis from significant to minimal.
But the AI is constrained. It cannot suggest excluding a mandatory clause because the system prevents it at the code level. It cannot apply an exclusion without human confirmation. It cannot override the candidate list that the CB's technical experts have defined.
The result is defensible exclusions. When an accreditation assessor asks how the CB determined clause exclusions for a specific client, the answer is clear: the AI analyzed the scope against the approved candidate list, the code filter validated the suggestions, and the planner confirmed each exclusion. Three layers, each with a defined role, producing a result that is both efficient and safe.
Ready to see how constrained AI makes clause exclusion analysis faster and safer?
Book a demo at getcertiva.com and see how Certiva's AI suggests exclusions without the risk of dangerous errors.