2026 Q4
VERBİS obligation assessment and registration
Assessing the registration obligation, data inventory, retention and destruction policy, registration if required
Preparation under way
Compliance
Our certification roadmap, with today's status
We do not hold a certificate for any standard today, and we do not hide it. Below we publish the quarter in which we aim to be ready for each standard and whether preparation has started. When an item is completed, this page is updated with the independent audit details.
Write to us
))}
)}
Compliance roadmap
None of these items is a completed certification. "Preparation under way" is used only where internal work with evidence has started; the rest are still plans. Quarters are targets and may change.
2027 Q1
ISO 9001
Quality management system, roadmap
Planned
2027 Q1
EU AI Act readiness
Assessment of risk classification and transparency obligations
Planned
2027 Q2
ISO/IEC 27001
Information security management system, roadmap
Planned
2027 Q3
ISO/IEC 27701
Privacy information management, roadmap
Planned
2027 Q4
ISO/IEC 42001
AI management system, roadmap
Planned
2027 Q4
SOC 2 Type II
Observation period and independent audit, roadmap
Planned
What the standards mean
The table explains the scope of each standard and what it changes for you. The status column shows today's reality.
| Standard | Scope | What it means for you | Status today |
|---|---|---|---|
| VERBİS obligation assessment and registration | Assessing the Data Controllers Registry obligation, a personal data inventory and registration if required | An official record of which data we process, why and for how long | Preparation under way |
| ISO 9001 | Quality management system | Defined and measured support, release and change processes | Roadmap |
| EU AI Act (2024/1689) | Risk-based rules for AI systems | Documented risk class and transparency obligations for the assistants | Readiness assessment |
| ISO/IEC 27001 | Information security management system | Independent audit of risk assessment, access, incident management and supplier controls | Roadmap |
| ISO/IEC 27701 | Privacy information management on top of 27001 | Audit of controls in both the controller and processor roles | Roadmap |
| ISO/IEC 42001 | AI management system | Responsible development and monitoring of AI features | Roadmap |
| SOC 2 Type II | Effectiveness of security and availability controls over a period | An auditor's report that the controls actually worked for months | Roadmap |
Frequently asked questions
Which certifications does Müşavir hold today?
None. Every item on this page is a roadmap item. When we obtain a certificate, we will announce it here with the certification body and scope.
What is the difference between "Preparation under way" and "Planned"?
"Preparation under way" marks items where published internal work has started; for VERBİS, retention periods are published in the privacy policy and the processing inventory is on the trust center. "Planned" is only a target. Neither is an independent audit result; we report progress with completed, concrete steps rather than percentages.
Can you answer our security questionnaire without a certificate?
Yes. We answer your questionnaire in writing based on the actual practices on our security and data processing pages; if we do not yet apply a control, we say so.
Why is SOC 2 Type II last?
A Type II report audits that controls worked throughout an observation period lasting months. The controls within the 27001 scope need to be in place first, then the observation period can start.
Help and recent changes
- Audit trail and sign-in history
What the Denetim İzi screen records, which plan includes it and what it does not do.
Related
Trust Center →
Security, KVKK and GDPR, subprocessors, backups and the compliance roadmap in one place.
Security →
Infrastructure, tenant isolation, encryption, access control and audit trail.
KVKK and GDPR →
Data subject rights, how to apply, cross-border transfer and AI processing.
Data Processing →
Controller and processor roles, data categories per module and retention.
Status and SLA →
Target 99.9% availability, maintenance windows, incident communication and support times.
Send us your compliance questions
Let us go through the documents and controls your procurement process asks for together.
Write to us