Responsibility and legal identity
Responsibility plan, real legal entity and location allocation, documented assumption of responsibility.
Roles and economic interests
Remuneration structures, intermediary relationships, bias and disclosure.
Information and communication
Understandable information on services, risks, costs and responsibilities.
Decision making process
Advice, questions, justified decisions not to treat and referral.
Handovers and documentation
Mandatory interfaces and completeness checks.
Aftercare and escalation
Availability, cover arrangements, escalation routes and responsibilities.
Qualification and competence management
Checking actual permissions and assigning tasks.
Data protection and confidentiality
Data flows, access controls and data minimisation.
Complaints and safety learning
Protected, traceable processing and documented improvement.
Internal verification
Effectiveness control, deviation management and implemented changes.
External partners and continuity
Limits of responsibility for platforms, partners and cross-border processes.
Transparent evaluation of results
Understandable definitions and open handling of uncertainty.
Requirements with verifiable evidence
Each criterion specifies its purpose, mandatory requirement, applicability, acceptable evidence, sampling approach and assessment instructions. Findings, severity and deadlines are documented transparently.
No offsetting of critical deficiencies
A positive certificate requires compliance with all applicable mandatory requirements. “Not applicable” requires justification and independent clearance.