AI-ready certification

A data asset that is AI-ready is one your organization has certified as fit and safe to hand to an AI model or agent. Measured Cloud certifies each asset from what it already knows about it: its data quality, how recently it was checked, and its sensitive data. It re-checks after every run and every profile.

Statuses

Status	Meaning
AI-ready (certified)	The asset meets every criterion below.
Not AI-ready (not_certified)	It misses at least one. The reasons say which, in plain words, for example "2 sensitive columns without a passing security check: email, ssn."
Not evaluated (not_evaluated)	Nothing is known about it yet: its checks have never run and it hasn't been profiled.

The status shows on the asset's page (AI-ready certification, with the reasons) and in the AI-ready column of the Data Assets list, which you can filter.

The criteria

An asset is certified when all of these hold. Super admins set them in Settings → AI → AI-ready certification; changing them re-checks every asset.

Criterion	Default
Its health score (the share of its checks that passed in the last 30 days) is at least the minimum	95 %
Its checks ran within the last N hours	168 hours (7 days)
Every sensitive column its profile suggests has been reviewed: tagged, or marked not sensitive	On
Every sensitive column has a security check (a value check, or a masking policy in the warehouse), and its latest run passed	On

A column marked not sensitive doesn't count toward the last two.

When it's re-checked

• After every validation run, asset run or single-rule run that checks the asset, here or on a Privacy Agent.
• After every completed profile.
• When the criteria change (every asset).
• When someone clicks Re-check now on the asset's page (editor role).

Certifying by hand

A workspace admin (or a super admin) can certify or decertify an asset by hand with a reason, for example after a security review. The override wins over the computed status until someone clears it, and the asset's page shows both: the override with its reason, and what the criteria say underneath. Setting and clearing an override are recorded in the audit log (asset.ai_ready_overridden, asset.ai_ready_override_cleared), as is every change of status (asset.ai_ready_changed).

The AI usage policy

The AI usage policy says: AI accounts may only read data assets certified AI-ready. Super admins turn it on in Settings → AI → AI usage policy. It is report-only: nothing is blocked or revoked in your warehouse.

A data asset violates the policy when an AI account can read its table and the asset isn't certified AI-ready. The policy has three options:

Option	Default
Count service accounts as well as AI accounts	Off
Count accounts only suggested as AI (not just ones someone confirmed)	On
Only data assets with these tags	None: every data asset

A violation shows:

• on the asset's Who can read this table card, naming the accounts;
• on the sensitive data map, as a Policy badge in the Readers column, with a filter and a count;
• through alert rules on the AI usage policy violated or resolved trigger, when it starts and again when it's resolved.

It's re-checked after every grant scan and certification change, when someone changes an account's kind, and for every asset when the policy changes. Each new violation and each resolution is recorded in the audit log (asset.ai_policy_violation, asset.ai_policy_violation_resolved).

To resolve a violation, certify the asset (or fix what keeps it from being certified), or remove the AI accounts' access in the warehouse.

Where else it shows

• AI agents. The AI-readiness check (mc_asset_ai_readiness) reports the certification under checks.certification.
• Data catalogs. The catalog sync webhook carries it on every result's asset (ai_ready), and sends an asset.ai_ready_changed event when it changes.