One question we get on almost every sales call: "are you HIPAA-certified?" The honest answer is that HIPAA does not certify products. Vendors can be compliant with HIPAA's safeguard requirements, but no government body issues a "HIPAA-certified" stamp.
The same pattern shows up with GDPR, the EU AI Act, ISO 27001, and SOC 2. Some of these have certification bodies (ISO, SOC 2). Some have certification pathways (EU AI Act, MDR). And some are pure regulatory frameworks that the company has to design for and audit themselves against.
Our internal rule: we describe our posture honestly. We use these words and not those words.
We say "implemented" when a control is live in the product and we can demonstrate it. We say "readiness pathway" when we are doing the work to obtain a certification but do not yet hold it. We say "designed to support" when we have built for a framework but the framework itself does not certify products. We do not say "certified", "compliant", or "audited" without naming the specific certification body and the date of the audit report.
The discipline matters because we are a clinical AI vendor and the words we use in marketing materials end up in clinic procurement reviews. When a buyer trusts our description of our posture, they should be able to take it at face value.