What does 4.5 require?

For every client role the scope records the attack vectors known or expected to bear on the system or component under analysis, among them presentation attacks, injection attacks, deepfakes and other synthetic media, and iterative hill-climb probing.

ACCS 1:2025 Certification Scheme for Age Assurance...

Other controls in Clause 4: Scope of the system or component under analysis, boundaries, contexts of use, change control, data dependencies – ACCS 1:2025 Certification Scheme for Age Assurance Systems and Components

4.1-4.4 Define and record the certification scope by client role: provider, relying party or intermediary
4.10 Declare the assumptions the item depends on and the exclusions from its certification
4.6 Define repeatable scope boundaries with architecture, identification and an inclusions and exclusions statement
4.7 Define the contexts of use: sectors, channels, use type and jurisdictions
4.8 Keep certification current: three-year cycle, annual surveillance, continuous monitoring, change notification and the minor versus major change test
4.9 Declare every data source, its authority, governing terms and third-party dependencies

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ACCS 1:2025 Certification Scheme for Age Assurance Systems and Components controls