Back to Frameworks

ISO/IEC 27566-1:2025

International (ISO/IEC JTC 1/SC 27)

v2025

6 domains

37 controls

A framework for age assurance systems and their core characteristics, including privacy and security, for age-related eligibility decisions. Published edition 1, 29 pages, free from ISO. The clause record here is read from the public working draft WD2.0 and is our own statement.

Unverified

ISO/IEC 27566-1:2025 is a compliance framework from International (ISO/IEC JTC 1/SC 27) with 6 domains and 37 controls. The largest domains are 4 Characterisation (11 controls), 6 Indicators of confidence (9 controls), 7 Privacy objectives (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated 21 October 2026Published standard

Get the official standard. This page is a source-grounded companion to the published text, not a replacement for it.

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

4 Characterisation

11 controls

Clauses of the published framework, read from the public working draft.

Controls in the 4 Characterisation domain of ISO/IEC 27566-1:2025: 11 controls
Code	Title	Description
iso-iec-27566-1-2025::4.1	The parts of an age assurance system	The framework builds an age assurance system from one or more assurance components plus a processing sub-system. The com...
iso-iec-27566-1-2025::4.1.1	Age assurance components	A component establishes an age attribute from something a person knows, possesses or is, from a trusted attestation, or...
iso-iec-27566-1-2025::4.1.2	Primary and secondary credentials	A primary credential comes from a body with the recognised authority to issue or hold the attribute. A secondary credent...
iso-iec-27566-1-2025::4.1.3	The processing sub-system	The processing sub-system gathers components, guards against attacks, handles contra-indicators, combines sources, suppo...
iso-iec-27566-1-2025::4.2	Guidance for policy makers	A policy maker sets the eligibility rule, the permitted assurance approaches, the criteria providers must meet and the a...
iso-iec-27566-1-2025::4.3.1	Age verification	Verification computes age from the difference between the current date and a date of birth held in a document or authori...
iso-iec-27566-1-2025::4.3.2	Age estimation	Estimation derives age from features or behaviour inherent in the person, often through biometric analysis. The framewor...
iso-iec-27566-1-2025::4.3.3	Age inference	Inference derives an age attribute from a credential or fact that implies age, such as a marriage certificate or a paren...
iso-iec-27566-1-2025::4.4	Practice statements	A provider documents the operational practices behind its assured age attributes, and a relying party documents the appr...
iso-iec-27566-1-2025::4.5	Age assurance service providers	A provider can stand between the person and the relying party, derive the attribute and disclose only the minimum. Where...
iso-iec-27566-1-2025::4.6	Acceptability to the individual	A person should be able to form a view on whether a solution meets their privacy and security expectations. Each solutio...

5 Attribute

1 controls

Clauses of the published framework, read from the public working draft.

Controls in the 5 Attribute domain of ISO/IEC 27566-1:2025: 1 controls
Code	Title	Description
iso-iec-27566-1-2025::5	The age assurance attribute	The framework counts age in years as a real number since birth. A relying party can ask for an actual age, an over-age,...

6 Indicators of confidence

9 controls

Clauses of the published framework, read from the public working draft.

Controls in the 6 Indicators of confidence domain of ISO/IEC 27566-1:2025: 9 controls
Code	Title	Description
iso-iec-27566-1-2025::6.1	The five indicators of confidence	The framework sets five core indicators: asserted, basic, standard, enhanced and strict. It does not fix their technical...
iso-iec-27566-1-2025::6.1.1	Asserted age assurance	Asserted assurance is the age a person claims, with no component used to validate it. It is a low indicator of confidenc...
iso-iec-27566-1-2025::6.1.2	Basic age assurance	Basic assurance is the first level above an unvalidated claim. The public working draft on benchmarking gives it an exte...
iso-iec-27566-1-2025::6.1.3	Standard age assurance	Standard assurance sits in the middle of the scale. The public working draft on benchmarking gives it an external benchm...
iso-iec-27566-1-2025::6.1.4	Enhanced age assurance	Enhanced assurance is a high point on the scale. The public working draft on benchmarking gives it an external benchmark...
iso-iec-27566-1-2025::6.1.5	Strict age assurance	Strict assurance is the top of the published scale. The public working draft on benchmarking gives it an external benchm...
iso-iec-27566-1-2025::6.2.1	Indicators for verification systems	For a verification system the indicator reflects the authority of the record, the integrity of the document and the bind...
iso-iec-27566-1-2025::6.2.2	Indicators for estimation systems	For an estimation system the indicator reflects the measured error, the challenge age, the demographic spread and the re...
iso-iec-27566-1-2025::6.2.3	Indicators for inference systems	For an inference system the indicator reflects the validity of the credential and the strength of the rule that turns it...

7 Privacy objectives

7 controls

Clauses of the published framework, read from the public working draft.

Controls in the 7 Privacy objectives domain of ISO/IEC 27566-1:2025: 7 controls
Code	Title	Description
iso-iec-27566-1-2025::7.1.1	The date of birth is not disclosed	The system should avoid disclosing a person's date of birth to the relying party. The age attribute can be delivered wit...
iso-iec-27566-1-2025::7.1.2	Non-disclosure of the age	Where the decision only needs an over-age or under-age result, the system should not disclose the exact age. The eligibi...
iso-iec-27566-1-2025::7.1.3	Unlinkability	The system should prevent an observer from linking two age assurance transactions to the same person when the service do...
iso-iec-27566-1-2025::7.1.4	Untraceability	The system should not let an observer trace a person's movements or activity through the age assurance service beyond wh...
iso-iec-27566-1-2025::7.1.5	Attributes minimisation	The system should process only the attributes it needs for the age decision. Extra identity data is a privacy cost with...
iso-iec-27566-1-2025::7.1.6	User awareness	The system should tell the person what is being checked, what is retained and what is disclosed, in language they can un...
iso-iec-27566-1-2025::7.1.7	Conditional attribute exchange	The system should release an attribute only when the condition for releasing it is met, rather than releasing it by defa...

8 Security objectives

6 controls

Clauses of the published framework, read from the public working draft.

Controls in the 8 Security objectives domain of ISO/IEC 27566-1:2025: 6 controls
Code	Title	Description
iso-iec-27566-1-2025::8.1.1	Binding to the correct individual	The system should bind the age determination to the person in front of it, so that a correct attribute cannot be used by...
iso-iec-27566-1-2025::8.1.2	Detection of collusion	The system should detect patterns in which people cooperate to defeat the assurance, such as one person supplying a cred...
iso-iec-27566-1-2025::8.1.3	Memorisation by a remote site	The system should limit the ability of a remote site to store and replay an age determination attribute.
iso-iec-27566-1-2025::8.1.4	Freshness of a credential	The system should let the relying party judge whether a credential or result is fresh enough for the decision at hand.
iso-iec-27566-1-2025::8.1.5	Forwarding only where allowed	The system should allow an age attribute to be forwarded to another provider only where the person or the policy permits...
iso-iec-27566-1-2025::8.2.1	Biometric presentation attacks	An estimation system that uses biometrics should resist presentation attacks. The framework points to the ISO/IEC 30107...

9 Attacks and contra-indicators

3 controls

Clauses of the published framework, read from the public working draft.

Controls in the 9 Attacks and contra-indicators domain of ISO/IEC 27566-1:2025: 3 controls
Code	Title	Description
iso-iec-27566-1-2025::9.1	Attack and contra-indicator analysis	The framework treats attacks and contra-indicators as a system concern. The provider should look for evidence that the a...
iso-iec-27566-1-2025::9.2	Attack vectors	An attack vector is a path by which someone tries to circumvent the process for a malicious outcome. The framework expec...
iso-iec-27566-1-2025::9.3	Contra-indicators	A contra-indicator is evidence that calls an age attribute into question. It can sit with the person, such as conflictin...

What is ISO/IEC 27566-1:2025 and who does it apply to?

ISO/IEC 27566-1:2025 is a compliance framework from International (ISO/IEC JTC 1/SC 27) with 6 domains and 37 controls. A framework for age assurance systems and their core characteristics, including privacy and security, for age-related eligibility decisions. Published edition 1, 29 pages, free from ISO. The clause record here is read from the public working draft WD2.0 and is our own statement. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO/IEC 27566-1:2025 actually require?

ISO/IEC 27566-1:2025 has 37 controls organised across 6 domains. The largest domains are 4 Characterisation (11 controls), 6 Indicators of confidence (9 controls), 7 Privacy objectives (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO/IEC 27566-1:2025 do I already cover?

ISO/IEC 27566-1:2025 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement ISO/IEC 27566-1:2025?

Start your ISO/IEC 27566-1:2025 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27566-1:2025 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,089 frameworks.

Get Started Free →

Free forever, no credit card required