ACCS 1:2025 Certification Scheme for Age Assurance Systems and Components 4.9: Declare every data source, its authority, governing terms and third-party dependencies

What does 4.9 require?

The client declares all data sources the system or component uses and for each states whether it is authoritative (such as a government identity document, verified digital credential or accredited register) or non-authoritative and secondary (such as credit reference, mobile operator, social signals or self-asserted data), the conditions, contracts or trust frameworks governing its use, and any dependence on third-party services to access or validate it. The declaration sits in the scoping documentation and is reviewed at surveillance and recertification.