As AI adoption spreads rapidly, companies are being asked to clarify which AI tools they use, under what rules, and to what extent.
This time, Stitch Co., Ltd. worked to obtain C Certification (AI Governance Core Certification) in order to establish internal governance for AI use, with an eye toward future business growth and stronger client trust.
In this article, we spoke with Yohei Hosoya, Representative Director of Stitch Co., Ltd., and Tanaka and Mibu, who led the C Certification project, about their motivation for pursuing certification, the process of getting there, their experience with Elith's support, and their outlook for the future.
Background to pursuing C Certification
Could you tell us what led you to want to obtain C Certification?
Hosoya: Since around the start of this year, I'd been thinking about how to set our guidelines. Inside the company, more and more tools were showing up—ChatGPT, Claude Code, Figma AI, Adobe's AI features, and so on—and I had a vague sense that we needed to figure out how to decide what's okay and what isn't.
Right around then, we received an announcement from JDLA that a new C Certification program was launching, with an information session to explain it, and I thought, this is exactly it. Honestly, from the moment we attended the briefing, I wanted to pursue it as long as the cost made sense.
Were there any concerns going into the C Certification process?
Hosoya: The first hurdle I anticipated was resources. I was worried about whether we could balance regular work with the C Certification project. When we asked Tanaka and Mibu to take it on, I was sure their managers would have something to say about it.
On the other hand, once the project actually got underway, the two people in charge say the workload turned out to be lighter than expected.
Tanaka: When it was decided that we'd take this on, I was worried we'd have to handle everything ourselves. Once we actually got started, Elith helped with everything from drafting templates for our internal rules to telling us exactly which documents to prepare, so personally it took less time and effort than I expected.
Mibu: They set up the framework for us, so it was really just a matter of following it, which made things very easy to move forward with.
Process and structure leading up to certification
What kind of structure did you use to run the C Certification project?
Tanaka: When it was decided that we'd start the C Certification project, Mibu and I—both of whom had passed the G Certification exam—were asked to take it on.
In terms of dividing the work, I mainly served as the point of contact with Elith, while the actual tasks were handled together with Mibu, Representative Director Hosoya, and employees who were driving AI use within the company.
What did you find most challenging during the process, and how did you resolve it?
Tanaka: We hadn't been managing our internal AI usage very well up to that point, so deciding how to identify all the AI tools in use was especially difficult.
After discussing it internally, we added a feature to our employee directory app that let each person register the AI tools they use, asked every employee to fill it in, and then compiled the results.
Was there anything about working with Elith on the C Certification process that was especially helpful?
Tanaka: Managing tasks through regular meetings, and having our respective roles and instructions laid out clearly, was a huge help at a time when we weren't sure what to do next. Getting fast answers to questions that came up as we worked through things was also extremely helpful.
Above all, since C Certification is a new program, I think both our company and Elith were dealing with a lot of firsts. Being able to support each other whenever something got overlooked, and ultimately make it through the review, meant a great deal.
Effects expected from obtaining C Certification
How did you feel when you learned that certification had been granted?
Hosoya: I don't see getting C Certification as the goal—the real starting point is now, after obtaining it. The biggest outcome of this certification is that we've finally been able to put internal guidelines for AI use in place.
At the same time, while I was glad to have obtained certification, during the review I found myself thinking a lot about how we'll need to adjust over the next two years. In an AI industry that changes this fast, two years is a long time, and I expect the review criteria and security standards will keep evolving. My honest impression is that we'll need to keep gathering information and adapting to whatever standards apply at each point in time.
How would you like to make use of C Certification going forward?
Hosoya: The concerns we had around using AI in our work, and the need for guidelines, are probably shared by many of our clients as well. I'd like to actively share what we did here and, in doing so, help bring the whole industry along with us.
In our industry—digital marketing and creative—up until last year the attitude was 'let's try using generative AI,' but now using it has become the norm. Without guidelines, though, you don't know what you're allowed to use or how. If unmanaged 'shadow AI' keeps spreading, it can turn into a real problem once it's discovered later. Eliminating that kind of risk and putting usage guidelines in place is something I think our clients want just as much as we do.
By obtaining C Certification as proof that we built a proper AI governance structure at an early stage, we can demonstrate that we're a company actively embracing AI. As a result, I believe it will help us earn our clients' trust and let them feel more comfortable entrusting work to us.
What we want to convey to clients, our company, and the market
Do you feel AI governance will become necessary for every company going forward?
Hosoya: Guardrails for AI use—that is, AI governance—will, I believe, become necessary for every company going forward, regardless of size or industry. If AI use spreads without clear rules or a management structure in place, 'shadow AI' will proliferate inside the company. That, in turn, can make it impossible to control risks around safety, information leaks, and copyright.
That said, no matter how much governance you build and communicate internally, you can't hedge the risk of each individual AI tool unless you first know what's actually being used. Going through this certification process, I strongly felt that simply knowing which AI tools are in use within the company is something every company will need to do going forward.
This is just my personal view, but I think a certification system for AI use will become just as essential as the Privacy Mark (P Mark) is for personal information. I'd especially recommend it for small and medium-sized companies.
What does holding C Certification mean for a company?
Hosoya: Twenty years ago people used to say, 'do we really need a P Mark?' but today there are very few companies handling personal information that don't have one. I think we'll see a similar shift over the next five to ten years. Having certification isn't a guarantee on its own, but I think it will matter for whether a company is seen as one clients can safely entrust their work to.
Do you have any message for companies that are now considering pursuing C Certification?
Hosoya: Speaking as someone who obtained certification early, I'd say it's something you'll need eventually, so it's better to get it sooner rather than later. That said, I don't think you need to overthink how difficult it will be to obtain. Having a partner to walk alongside you makes it much less daunting, and that's the kind of role Elith plays.
Another benefit of having that kind of support is being able to stay on top of information. When it comes to managing AI tools, it's often hard to research everything on your own. Getting insights like, 'many companies manage it this way,' including examples from other companies, and being able to update our own management approach based on that, is, I think, the biggest reason to have a partner walking alongside you.
A message from Elith to Stitch Co., Ltd.
Thank you very much for taking part in this valuable interview.
We're truly glad we were able to work through this new C Certification program together, feeling our way as we went. As mentioned in the interview, C Certification involved many firsts for us as well, and there were times when the right answer wasn't clear. Even so, Hosoya, Tanaka, and Mibu always shared their questions and concerns openly with us, and whenever something was overlooked, we supported each other along the way. We're truly happy that the review was ultimately completed successfully.
Preventing 'shadow AI' and building an environment where AI can be used with peace of mind is never a challenge for just one company. The governance structure Stitch Co., Ltd. has built through this process should serve as a valuable guidepost for the industry as a whole. Going forward, we at Elith hope to continue walking alongside Stitch Co., Ltd. as a partner, together leading the way in creating environments where AI can be used safely.
About the company that took part in this interview
■ Stitch Co., Ltd.
The company operates around three core businesses: customer experience (CX), career development support, and regional value co-creation.
From planning, producing, and operating websites and digital content for companies and local governments, to supporting organizations in building internal capabilities, to developing digital talent and employment support in regional communities, Stitch works to connect people and society through experience.
Company name: Stitch Co., Ltd.
Representative: Yohei Hosoya, Representative Director
Business: IMC (Integrated Marketing Communications), consulting, various types of production, system development, project site maintenance and operation, and advertising agency services
Corporate site: https://stitch.co.jp/