Approve a provider on what its report says about service, region, period and any deviations. Then add the controls your own organisation must carry. A provider's general security claims, ours included, do not replace reading that report.
The question behind every such tender is this:
Does the C5 report for this LLM API actually cover what our tender requires?
You ask it when a security officer opens the evidence file. The answer sits in the report, not on a product page. The report ends with the auditor's conclusion, which is called the attestation.
We are Lyceum, a sovereign European AI inference provider for open-source models. Our serverless inference runs in Paris and Finland, and we have no data centre in Germany. We hold no C5 attestation. The checks below work on us and on every other provider.
Identify the requirements that bind this project
The requirements that bind your project come from your tender and the rules your public body follows. C5 itself is a recommendation. The BSI says it has a recommendatory character, although some sectors require it by regulation.
One such regulation is the BSI minimum standard for external cloud services. It tells federal agencies to request proof of C5 fulfilment from the cloud provider. It has a defined scope: the federal administration. For a state or municipal project, your tender and the rules your body follows decide.
Write down four things before you ask any provider for evidence:
- the C5 version the tender names, if it names one
- the exact service you will call
- the period of use
- the evidence the tender accepts
We use one running example, and its inputs are hypothetical. A public body buys an LLM API that summarises documents. The contract starts on 1 March 2027 and runs for 24 months.
Check which cloud service and region the report covers
A C5 report covers named cloud services in defined regions, never the provider as a whole. The BSI says the customer must first ensure that the services they use are covered.
For the summarisation example, ask two questions. Is the LLM API itself named as an audited service? And does the report name the regions where the documents are processed?
Every C5 report also states where data is processed. Read that part first, because it shows the region at a glance.
Two points keep you out of trouble. There is no C5 certificate, because the BSI runs no certification procedure. A provider can only hold an attestation. And the report belongs to the provider. In principle you have no right to it, so request it early.
Read the audit period, exceptions and shared controls
An attestation confirms compliance over a period of 3 to 12 months in the past. A report is either for one specified date or for a specified period. Ask which one you hold. The BSI says customers typically want evidence for the whole period of use, so a one-date report is thin evidence.
Take the hypothetical example. Its newest report covers 1 July 2025 to 30 June 2026, a 12-month period. The calculation below shows the gap between that report and the months of use.
Report period ends: 30 June 2026
Contract starts: 1 March 2027
Gap at contract start: 8 months (July 2026 to February 2027)
Gap at end of month 12: 20 months (July 2026 to February 2028)A report looks backwards, so it never covers the months you will actually use the service. The BSI describes the usual fix. On first use, customers request the report for the last expired period, and the contract commits the provider to send all later reports. The example assumes one clean report, which makes the gap look smaller than a messy case would. It shows no real report or provider.
Check the C5 version too. C5:2020 has 121 criteria and C5:2026 has 168. The newer version applies to audit periods that begin on or after 1 June 2027. Earlier adoption is permitted. Our example period began in 2025, so a C5:2020 report is normal. Do not treat it as obsolete.
Then read the auditor's opinion. A deviation is a place where the provider did not meet a criterion. If the deviations are serious, the auditor issues a qualified opinion. Otherwise the opinion is unqualified, but that does not mean "no deviations", because minor ones can still sit inside it. The BSI does not check audit reports. For each deviation, judge whether it touches your service, your region or your data.
Last, look at subcontractors. The same criteria apply to them. The report lists the controls each subcontractor must provide for the provider's service to meet C5. Check that the subcontractors behind your service appear there. The report also shows which tasks stay with you.
Assess the LLM application beyond the cloud attestation
An infrastructure provider's attestation does not automatically cover the LLM API running on top of it. The attestation names its audited services. If the layer that runs the model is not one of them, the report says nothing about it. Ask for the exact scope statement of the report you hold.
Then match the protection need. In the example, the body must classify its documents by how sensitive they are before it sends any to the API. Whether the audited security level is enough for those documents stays your decision.
A report also cannot tell you how a provider treats prompts (see our guide to data residency for LLM APIs). For that you need first-party facts. Here is what we can say about ours:
- Prompts and outputs are processed, not stored, and never used for training. That is our own statement, and no third-party attestation backs it.
- Our data processing agreement (DPA) and the ISO 27001 engagement letter are open to read on our trust page. The list of our technical and organisational measures comes on request, and so does the subprocessor list, by email.
- The same page states "ISO 27001 audit in progress". That is not a certificate.
- The data centres we run in hold ISO certificates at facility level. They belong to the operators, not to us, and we can supply them on request.
- We hold no SOC 2 attestation either. SOC 2 is another audit report on security controls.
Ask every provider for the same list. Treat a missing answer to any of these as a gap, not as a pass.
Resolve missing mandatory evidence before procurement
When mandatory evidence is missing, you do not approve on that basis. Record the gap and decide who closes it. The table shows the example, with hypothetical findings.
| Requirement (hypothetical tender) | Evidence to request | Gap in the example |
|---|---|---|
| C5 attestation for the service you call | Report naming the LLM API and its regions | Report names only the hosting layer |
| Evidence for the whole period of use | Report period and the date of the next report | 8 months between period end and contract start |
| Deviations assessed | Auditor's opinion and every listed deviation | Opinion not yet read |
| Subcontractors covered | Subcontractor controls listed in the report | Model host not named |
| Your own controls | The tasks the report assigns to you | Document classification not done |
The BSI says that, for public authorities, an auditor's attestation report is currently the only evidence that reaches the minimum required level. It adds that ISO 27001, which audits a provider's management system, is not optimally suited to audit the C5 criteria. So an ISO 27001 certificate, ours when it arrives or anyone's, does not replace a C5 report that your tender asks for.
If your tender sets no C5 duty, the BSI says other methods such as self-disclosures are possible. Your legal team reviews the framework case by case.
For a gap you cannot close, you have three routes. Ask the provider for the missing report. Narrow the project to a service that is covered. Or choose another provider. Send us your required assurance evidence through our Trust page and our compliance team will check fit.
Where your tender sets no C5 duty, we offer open-source models on European-run inference in Paris and Finland. Prompts are processed, not stored, and never used for training, and our Trust page shows what we can and cannot evidence today.