While the adoption of generative AI is spreading rapidly, companies are expected not only to benefit from its convenience but also to accurately grasp the risks and manage them on an ongoing basis.
This time, IGPI became an early recipient of C Certification (AI Governance Core Certification), JDLA's third-party AI governance certification program.
In this article, we spoke with Matsuoka and Kii, who led the effort to obtain C Certification, about the background to pursuing certification, the work involved along the way, the effects they expect from certification, and their outlook for the future.
Background to pursuing C Certification
What prompted you to pursue C Certification, and what was your objective?
Matsuoka: Learning about C Certification during an information session on early certification is what prompted us to pursue it. We had already been taking certain measures in-house regarding AI-related risks, but a major objective was to have a third party objectively confirm those efforts.
We have been promoting the use and adoption of AI tools for several years, and since then we have gradually put in place the rules and management methods needed as usage evolved. That said, I feel the tide has shifted somewhat since 2026. Until now, discussions centered on moving AI adoption forward, but with the spread of AI agents in particular, there are more situations where AI carries out tasks more autonomously, and I think the importance of risk management has come to be discussed even more.
Amid these changes, we wanted to objectively confirm our own efforts and reach a state where we could explain externally that we manage AI risk in line with a defined standard.
Before obtaining C Certification, were there any challenges or concerns you felt might become hurdles?
Matsuoka: One was taking stock of the AI tools used within the company. We had already identified and managed tools to a certain extent, but we needed to work out, in light of the certification requirements, to what level of detail we should additionally check. We anticipated that comprehensively reconfirming usage across the whole company, including individual use, would require a certain amount of time and coordination.
In addition, with various projects underway, the resources available to drive certification were limited. Since this was also a new certification program, we needed to work out early on what certification process to follow and what to prepare.
Efforts and structure leading up to certification
What internal structure and division of roles did you use to pursue certification?
Matsuoka: Since we were already the members driving AI-related initiatives, we ended up taking the lead on this AI governance certification effort as well. In terms of role division, Kii mainly handled administrative matters such as contracts, while I primarily led the concrete work of pursuing certification. We proceeded while coordinating with other stakeholders as needed.
Kii: Since I was in a position promoting AI adoption alongside Matsuoka, I saw establishing governance, not just advancing adoption, as our role as well. To steadily advance AI adoption, convenience and risk management need to be considered as two wheels of the same cart. We recognized that building a structure to continuously face risk would, in turn, also support the advancement of AI adoption.
What were the points you found particularly challenging as you carried out this work?
Matsuoka: Because this was a new certification program, it took time in the early stages to work out how the requirements corresponded to our internal processes. There was some difficulty in specifying when to collect the necessary information and in what order to proceed with internal procedures, and then fitting all of that into an overall schedule.
Was there anything in your interactions with JDLA and Elith that particularly helped you?
Kii: It helped that, early on, Elith and JDLA showed us the broad outline of things like what perspectives this certification would look at and what scope it would cover. Once the scope was clear, it became easier to sort out what we were already doing internally versus what additionally needed to be addressed. Even within this new undertaking of early certification, having the review criteria and scope shared with us early on made it easier to move forward with concrete preparations.
Effects expected from obtaining C Certification
What was your honest reaction when it was decided that you would obtain C Certification?
Matsuoka: Honestly, our first reaction was relief. How this certification program will develop and gain social recognition going forward remains to be seen, but we believe there is great significance in having been able to engage with it from an early stage as one of the first companies to obtain certification.
Kii: We were reassured to confirm that the efforts we had continuously built up over time met a certain standard even when measured against the main criteria of this certification. Over the past two to three years, we repeatedly discussed and responded to new features and risks as they emerged, and we were able to confirm that our existing efforts already addressed many of the key items required for certification.
With the technologies and risks surrounding AI changing rapidly, being able to bring in a third-party perspective in addition to our own internal knowledge, and to confirm the direction and validity of the efforts we had been making, was a major source of reassurance. Beyond obtaining certification itself, we also feel a real sense of accomplishment in having been able to check our past efforts against an objective standard.
What effects has obtaining C Certification had on your internal structure and operations?
Matsuoka: A major effect has been that our rules and documentation on risk management were reorganized, allowing us to systematize what we had been operating and record it more clearly in writing. We had already been taking certain measures, but there is value in itself in listing and managing them, and in formalizing them as rules. Having the rules and documents we organized this time in a state where they can be continuously referenced and updated has made them easier to put to use in our ongoing operations.
Kii: Since we have not yet announced this C Certification to all employees, we cannot say at this point what the company-wide effect has been. That said, I believe it gave the people involved in this process an opportunity to reconsider AI governance.
What effect do you expect this to have on your company's customers?
Matsuoka: Because certification lets us demonstrate, in an easy-to-understand form, that we are continuously working on AI risk management, we believe it can offer our clients a certain sense of reassurance.
Kii: In the AI field, which keeps evolving day by day, circumstances differ from company to company, and there are situations where it is difficult to judge which response is appropriate. C Certification is not the only correct answer when it comes to safety, but we see it as one objective standard that can serve as a starting point for discussion with clients. Being able to have that conversation after obtaining certification makes it easier for clients to understand our thinking and efforts, and we hope it will make discussions about AI adoption easier to move forward concretely.
How do you want to connect your AI governance efforts to business growth going forward?
Kii: We believe that establishing an environment where AI can be used safely forms the foundation for advancing AI adoption. As AI capabilities continue to expand, the risks companies need to consider will keep changing. That is precisely why it is important to build a proper management foundation and be in a position to advance AI adoption while keeping risk under control. We believe that moving closer to that state contributes to raising corporate value, both in terms of driving AI adoption internally and in providing support to clients.
What they want to convey to customers, employees, and the market
Through obtaining C Certification this time, is there a message you would like to convey to customers, employees, and the market?
Kii: I think AI governance is still an area of ongoing trial and error for many companies. Amid that, through this certification process we were able to speak with the reviewers and learn how they view AI risk and what perspectives they emphasize.
Being able to check our own efforts against an objective standard was, we feel, extremely meaningful. We believe there is value in first understanding your company's current state and starting the necessary efforts.
Do you have any advice for companies that will be pursuing C Certification going forward?
Matsuoka: I think how much preparation you have done before applying makes a big difference to the scope and length of the response required. It is important to first organize the AI tools you are using and any related rules, and make the current state visible. On top of that, we recommend having a policy in place beforehand for maintaining a set of organization-approved tools and rolling them out internally.
Also, buy-in and understanding from management are important, and whether or not you have that makes a big difference in how smoothly the effort progresses. We found that sharing concrete examples, such as recent AI incidents happening in the world, and aligning our understanding with management as we went, allowed us to advance the effort more smoothly.
Kii: Before starting work toward certification, I think it's important to confirm your cooperation structure, both internally and externally. Since you need to gather information across the whole company, sharing the purpose and approach with relevant departments and collaborators in advance makes the process much smoother.
A message from Elith to IGPI
Thank you very much for taking part in this valuable interview. We are deeply grateful that you joined this new undertaking of early certification and steadily followed through to obtain certification.
Throughout the certification process, IGPI candidly shared their efforts and challenges, and worked carefully through the necessary reviews and documentation. We are delighted that, through ongoing dialogue among everyone involved, certification was successfully obtained.
We believe that the AI governance efforts IGPI has built up over time, together with this objective confirmation, will serve as a valuable example for other companies advancing AI adoption in the future. Elith will continue to work alongside IGPI as a partner, moving forward in building an environment where AI can be used with confidence.