CREST AI Charter: CREST launches AI Charter for cybersecurity providers. Here’s why trusted, governed AI matters – AI is moving quickly into everyday cybersecurity work, but speed of adoption is not the same thing as maturity. Many providers are already using AI to accelerate reporting, scanning, analysis, and workflow tasks, yet buyers still face a basic question: how do you know that AI is being used responsibly? That is what makes the launch of the CREST AI Charter more than just another industry announcement.
It is an attempt to define what trustworthy AI-enabled cybersecurity should look like before the market becomes even more uneven.
According to CREST, the Charter is designed to support the “responsible use of AI across cybersecurity services” and is backed by “more than 60 founding signatory cybersecurity organisations.” The initiative is paired with a set of nine AI Principles intended to create clearer expectations around accountability, transparency, control, security, and resilience.
For SMEs, this is not an abstract governance debate. If your business relies on external cyber specialists for testing, managed security, incident response, or advisory work, AI is increasingly part of the service you are buying — whether it is visible or not.
What CREST has launched
The announcement centres on two linked elements:
* the CREST AI Charter
* the CREST AI Principles
What the Charter is trying to do
CREST says the Charter “commits organisations to support responsible AI adoption and trusted AI-enabled cybersecurity services.” That wording is important because it frames AI not just as an efficiency tool, but as something that must be governed in a way that clients can rely on.
According to the materials provided, the Charter was developed in response to demand from:
* industry
* government
* buyers
The goal is to create greater confidence as AI becomes more embedded in cybersecurity delivery.
What the source says about adoption
The supporting release includes some useful figures that show how normalised AI use is becoming in cyber services.
CREST states:
* 69% of providers are now utilising AI in daily service delivery and workflows
* 76% of providers have increased their AI use over the past year
* in penetration testing, 47% are using AI for reporting
* 44% are using AI for vulnerability scanning and enumeration
Those numbers matter because they shift the conversation. The question is no longer whether AI is entering cybersecurity services. It already has. The real question is whether its use is consistent, accountable, and transparent enough to deserve client trust.
Why this matters for SMEs
Many SMEs buy cybersecurity as a specialist service rather than building large internal teams. That means provider governance matters a great deal.
1. AI is becoming part of the service stack
An SME may commission:
* penetration testing
* vulnerability assessments
* managed detection
* incident response
* threat intelligence
* security reviews
Increasingly, AI may sit behind parts of those services, especially in:
* report drafting
* triage support
* data analysis
* vulnerability identification
* workflow automation
That can create real benefits:
* faster turnaround
* broader analysis
* improved consistency
* lower manual burden
But it also creates new questions:
* how much human review is involved?
* what data is processed by AI tools?
* where is that data handled?
* what records exist of AI use?
* how are hallucinations, errors, or overreach managed?
For SMEs, those are procurement and trust questions, not just technical ones.
2. “Responsible AI” needs to mean something practical
One of the strongest parts of the CREST initiative is that it tries to translate responsible AI from a vague aspiration into operational principles.
The nine principles cover:
* accountability and governance
* transparency of use
* documentation and assurance
* boundaries and control
* data, sovereignty and client control
* security and confidentiality
* secure development of AI tooling
* supply chain assurance
* resilience and business continuity
That is useful because smaller businesses often struggle to judge AI claims made by suppliers. A provider saying “we use AI” tells you almost nothing on its own. A provider showing how it manages control, confidentiality, assurance, and client data tells you much more.
3. Trusted AI matters more in cybersecurity than in many other services
Cybersecurity providers often have access to:
* sensitive networks
* internal systems
* source code
* vulnerability data
* security logs
* confidential business information
That makes AI governance particularly important. If AI tools are used carelessly in this context, the risks may include:
* data leakage
* weak auditability
* unreliable outputs
* insecure tooling
* uncontrolled third-party dependencies
CREST’s release makes this point directly, noting that providers are often granted “privileged access to sensitive systems, networks and data” and that responsible AI use is therefore “critical to maintaining trust, accountability and reducing risk.”
