News from the Wire

NCC Group becomes founding signatory of CREST AI Charter

Saturday, June 20, 2026 — 01:02:53 (UTC)

NCC Group becomes founding signatory of CREST AI Charter helping shape trusted AI in cyber security

Manchester, UK, June 19, 2026—NCC Group has become a founding signatory of the CREST AI Charter, joining a global movement to set the standard for responsible AI in cyber security.

Launched in June 2026, the Charter sets out a shared framework to support trust, transparency, accountability and assurance in AI-enabled cyber security.

As a signatory, NCC Group supports CREST’s nine AI Principles (at the bottom), guiding how AI is governed, deployed and overseen including human oversight, data protection and accountability.

This comes as AI adoption continues to accelerate across cyber security, from threat detection and analysis to testing and reporting, increasing demand from clients and regulators for clearer standards.

A commitment to trusted, human-led AI

Signing the Charter reflects NCC Group’s focus on enabling the safe, secure and responsible adoption of AI and combining human expertise with AI-powered capability to deliver trusted outcomes for clients.

As a founding signatory, NCC Group joins a global community of cyber security companies shaping how AI is applied in cyber security, ensuring innovation is supported by strong governance and professional standards.

Driving industry standards for AI-enabled cyber security

Matt Hull, VP Cyber Intelligence & Response, NCC Group: “AI is already transforming how cyber security services are delivered. What matters now is how it is governed, validated and applied responsibly. As organizations increasingly rely on AI-driven insight, maintaining trust in how these technologies are applied is critical. By signing the CREST AI Charter, we are reinforcing our commitment to combining deep human expertise with AI-driven capability in a way our clients can trust.”

Commenting from CREST International, Chief Product Officer Sebastian Madden added: "We welcome NCC Group as a founding signatory and are encouraged to see leading organizations helping shape the future of trusted AI-enabled cybersecurity. Whilst AI has the potential to transform cybersecurity, innovation alone is not enough - and as adoption accelerates, the industry must ensure that trust keeps pace.

The CREST AI Charter and Principles were developed to help provide that foundation, bringing together cybersecurity providers around common expectations for transparency, accountability and assurance. NCC Group's support demonstrates the growing recognition that trusted AI will require industry-backed collaboration."

CREST’s principles for AI-enabled activities

Accountability and governance

We define the scope and purpose of AI-enabled activities and assess how they may affect service delivery, client outcomes, data handling, decision-making or operational risk. We apply oversight, testing and governance controls proportionate to the nature, scale and risk of the AI use.

Transparency of use

We inform clients of relevant AI use in our tools, technologies, methodologies and automations, including internal and third-party solutions where this may affect the service, data handling, decision-making, contractual commitments or client risk. We explain how AI is used where relevant, including the potential benefits, limitations and risks to the client.

Documentation and auditability We document our AI use, including how services are delivered, conclusions reached, and standards met. We document validation, quality assurance and review processes to support reliable outcomes. Our AI use is traceable and reviewable, with records retained to support proportionate internal or external assurance where appropriate.

Boundaries and control

We ensure suitably competent personnel retain oversight of AI-enabled activities, including autonomous or semi-autonomous activities. They review outputs, challenge decisions and intervene where needed. AI-enabled activities operate within defined organizational controls and, where relevant, client-agreed scope and boundaries. We use technical and procedural controls to prevent AI from being used outside its authorized purpose.

Data handling, sovereignty and client control

We inform clients how AI-enabled activities may use their data, including whether data may be used to train models and whether data may be transferred outside their organization, our organization, or agreed jurisdictions. We handle client data in line with agreed legal, regulatory and contractual requirements. Client data is used and stored only within agreed purposes, controls and commitments. Security and confidentiality

We protect client data, prompts, outputs and AI-generated artefacts through appropriate technical and organizational controls. We are transparent with clients about how their data is secured where AI-enabled activities are used.

Secure development of AI tooling

We use secure development, integration and assurance practices for AI tooling. We review and maintain AI tools throughout their lifecycles to ensure they remain reliable and properly governed.

Supply chain assurance

We identify material third-party AI technologies and providers used in AI-enabled activities, and assess the associated security, compliance, resilience and operational risks. Where third-party AI use may materially affect service delivery, data handling, client commitments or continuity of service, we apply appropriate supplier governance and risk management controls. We are transparent with clients about relevant third-party AI dependencies where they may affect the service, contractual commitments or the handling of client data.

Resilience and business continuity

We identify material AI dependencies in service delivery and assess the impact if those systems fail or become unavailable. We maintain proportionate fallback or degraded operating arrangements where practical. We are transparent with clients about how AI disruption may affect service delivery, service levels, data handling, decision-making, reporting, continuity arrangements and recovery expectations.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.

Source: Company press release.

Categories: Announcement