Semantic Model Certification for AI

Last updated October 8, 2026 by Errin O'Connor, Founder & Chief AI Architect, EPC Group

EPC Group is a Houston-based Microsoft consulting firm operating since 1997, with six Microsoft Solutions Partner designations.

GMS-9 is the certification rubric behind surface 5 of TAR-8.

The semantic layer became a compliance surface, and nobody re-scoped the controls

For fifteen years the semantic model was an engineering artifact. A modeling defect produced a wrong number on a report, a human looked at the report, and a human caught it. The control was the reader.

That control is gone. When a business user asks Copilot "what was margin in the eastern region last quarter," the answer is generated from the model schema, the linguistic schema, measure DAX, field descriptions, format strings, and data category — a documented list of grounding inputs published by Microsoft. No human reads a report first. The model is the answer. A semantic model with an ambiguous field name used to be untidy. It now determines what an AI system asserts to an employee, a regulator, or a customer, with no intermediate review. A Fabric data agent honors row-level and column-level security faithfully — but it honors your definition, correct or not.

Governance frameworks written before 2024 govern workspaces, licences, and sprawl. They do not govern the specific properties of a model that determine whether an AI grounds correctly. That is the gap this standard closes. EPC Group's position across every Microsoft Fabric consulting engagement is four words: multiple models, one truth. Language models rotate quarterly. Governance and accountability are the constants.

What Microsoft actually ships, and where the standard has to start

Microsoft gives you three endorsement badges — Promoted, Certified, and Master data. Promotion requires only write permission. Certification requires authorization by a Fabric administrator, and can be delegated per domain so a Finance domain names Finance certifiers. Master data marks an item as the authoritative source for core entities such as customer or product, and is also restricted to named reviewers.

Microsoft also ships the surface that makes a model answerable: Prep data for AI, on the Home ribbon in Power BI Desktop and on the semantic model page in the service. It holds AI data schemas (deselect fields Copilot should not see), AI instructions (business context, terminology, prioritization), and verified answers (human-approved visual responses bound to trigger phrases, stored on the model so they apply to every report built on it). The model can then be flagged Approved for Copilot.

What Microsoft does not ship is the standard. Its own governance guidance goes no further than suggesting a certification policy "might" include data accuracy validation and a security review. That is a category list, not a control: an auditor has nothing to test and a data team has nothing to fail against. So the standard has to be yours, it has to be numbered, and every gate has to produce an artifact.

The Groundable Model Standard (GMS-9)

EPC Group certifies semantic models against nine gates. A model is either GMS-9 certified or it is not. There is no partial credit, and no gate is optional for a model that Copilot or a Fabric data agent is permitted to answer from.

Gate 1 — One named owner. A single person, not a team alias, accountable for the model's correctness, named in the item description and the certification record. Certification tooltips already surface the certifier's name in discovery; the owner must be equally visible.

Gate 2 — Single-definition KPIs with a written business definition. Every measure exposed to AI carries a description stating the definition, the grain, the exclusions, and the approving business owner. Two measures may not compute the same concept differently in one model, and no measure name may carry different logic across two certified models. This is where certification programs fail, and it is a business exercise, not a technical one.

Gate 3 — Tested RLS and OLS, with a named test method. RLS roles are validated with Test as role, including unexpected values, not only expected ones. Microsoft's guidance shows why: a rule written as IF(USERNAME()="Worker", [Type]="Internal", TRUE()) returns every row for any typo. OLS is defined through TMDL and tested per role. Test as role does not cover Copilot, Q&A, or quick insights, and fails for DirectQuery models with SSO — so the gate requires a second, manual test: sign in as a real Viewer-role user and run a fixed Copilot prompt set.

Gate 4 — Sensitivity label applied, with inheritance verified. The model carries a Microsoft Purview label. Downstream inheritance is verified in lineage view and the 80-item ceiling is checked — above 80 downstream items no inheritance runs at all, a silent failure in large estates. Inheritance from labelled upstream sources is enabled.

Gate 5 — Documented refresh SLA and freshness contract. The description states refresh frequency, expected data-as-of time, and the acceptable staleness window. Failure notifications go to a monitored alias, not only the owner. Platform limits set the boundary: 8 scheduled refreshes per day on Pro, 48 on PPU/Premium/Fabric capacity, effectively unlimited via XMLA. A model whose business promise exceeds its licensed refresh ceiling cannot be certified.

Gate 6 — AI instructions and verified answers configured. AI data schemas exclude helper columns, sort-order columns, and surrogate keys. AI instructions state vocabulary, synonyms, and priority tables. Verified answers cover the questions the business asks most. Only then is the model marked Approved for Copilot.

Gate 7 — Lineage documented and impact analysis run. Upstream sources and downstream dependents are recorded from lineage view. Impact analysis runs before any change; it reports affected workspaces, reports, dashboards, and 30-day viewer counts, and provides the notify-contacts path. Composite models are enumerated, because Microsoft's guidance is that the single-version-of-truth model should not itself be one.

Gate 8 — A review cadence with a calendar owner. Quarterly at minimum, plus on-change review for schema, security, KPI, or data source changes, logged each time. An uninspected certified model is worse than an uncertified one, because the badge is what the catalog and the AI surface prioritize.

Gate 9 — A published decertification trigger. Six triggers, listed below. Any one fires and the badge comes off the same day, before remediation begins.

The GMS-9 certification checklist

#	Gate	Named test method	Evidence artifact	Accountable
1	One named owner	Owner named in item description and certification record	Certification record entry	Domain data steward
2	Single-definition KPIs	Measure-description completeness scan; cross-model duplicate-name diff	Signed KPI definition register	Business KPI owner
3	Tested RLS/OLS	Test as role, expected and unexpected values; plus manual Viewer sign-in with a fixed Copilot prompt set	Role test log and prompt transcripts	Model owner + security lead
4	Label + inheritance	Label applied; inheritance confirmed in lineage view; downstream count checked against the 80-item ceiling	Lineage screenshot + label audit export	Information protection lead
5	Refresh SLA	30-day refresh history reviewed against the stated window; alerting confirmed	SLA statement + refresh history export	Platform operations
6	AI instructions + verified answers	Prompt-set regression run pre- and post-change	Prompt regression sheet with pass/fail	Model owner
7	Lineage + impact analysis	Impact analysis executed and archived before publish	Impact analysis output with viewer counts	Model owner
8	Review cadence	Calendar entry with a named person; last review within 90 days	Review log	Domain data steward
9	Decertification trigger	Trigger list published and monitored	Decertification policy document	Governance council

What an uncertified model does to a Copilot answer

This is the section that governance frameworks skip. These are grounding failures, not report bugs, and they are silent — the answer looks confident and formatted.

Symptom	Root cause	Fix
Copilot answers with a number nobody recognizes	Two measures compute the same concept differently; Copilot chose the one with the better-matching name	GMS-9 Gate 2. Deduplicate measures, write descriptions, remove or hide the loser
Copilot returns data a user should not see	RLS was authored but never validated for unexpected identity values; a `TRUE()` fallback returns all rows	GMS-9 Gate 3. Rewrite the rule to test each expected value explicitly and return `FALSE()` otherwise, then re-test
Copilot answers correctly in Desktop, wrongly in the service	Test as role was the only validation performed; it does not cover Copilot, and it fails for DirectQuery models with SSO	GMS-9 Gate 3. Add the manual Viewer sign-in prompt test to the gate
Copilot picks an obsolete field, a helper column, or a surrogate key	The full model schema is grounding data, including objects not used on any report; nothing was hidden or excluded	GMS-9 Gate 6. Hide unused fields, mark unused tables private, deselect fields in the AI data schema
Answers drift week to week for the same question	No verified answers exist, so every response is regenerated; Copilot output is nondeterministic by design	GMS-9 Gate 6. Bind the top business questions to verified answers on the model
The answer is right but the data is stale	No freshness contract; refresh failures notified only the owner, who was on leave	GMS-9 Gate 5. Publish the staleness window, alert to a monitored alias
A confidential figure is exported without protection	Label present on the model but the estate exceeded 80 downstream items, so inheritance silently did not run	GMS-9 Gate 4. Check the downstream count, label critical downstream items directly

Evidence and audit mapping

Certification is only worth building if it produces evidence someone else accepts. Each gate maps to a control family an internal auditor already tests — the same discipline EPC Group applies in SOC 2 readiness work across Microsoft 365.

GMS-9 gate	Control family	Evidence produced	Where it lives
1 Owner	Accountability / segregation of duties	Named owner and certifier, both recorded	Item metadata + certification record
2 KPI definitions	Data integrity / reporting accuracy	Signed KPI register with business approver	Governance repository
3 RLS/OLS	Logical access control	Role test log, prompt transcripts, role-to-group mapping	Test log + Entra group export
4 Sensitivity labels	Data classification and handling	Label audit export, lineage inheritance proof	Purview / OneLake Govern tab
5 Refresh SLA	Availability and processing integrity	Refresh history vs stated window	Refresh history export
6 AI configuration	AI system governance	AI instructions, verified answer inventory, regression results	Model metadata + regression sheet
7 Lineage	Change management	Archived impact analysis per change	Change ticket attachment
8 Review cadence	Monitoring	Dated review log	Governance repository
9 Decertification	Corrective action	Trigger events and badge-removal timestamps	Activity log

The OneLake catalog's Govern tab does part of this reporting: label coverage, unlabeled item percentages, endorsement coverage, and freshness, scoped by domain. One limitation before you build a control on it — admin insights refresh once per day, so there is up to a 24-hour lag between the estate's real state and the reported state.

The six decertification triggers

Publish these before you certify anything. A standard without a revocation path is marketing.

Owner departure with no named successor within 10 business days.
KPI redefinition without a corresponding model change and re-review.
Any RLS or OLS change not re-tested under Gate 3.
Two consecutive refresh SLA breaches, or any breach exceeding the published staleness window by more than one refresh cycle.
Schema change published without impact analysis, evidenced by the activity log.
Review overdue by more than 30 days past the quarterly cadence.

The badge comes off first; remediation follows. Reversing that order is how estates end up with a hundred certified models nobody trusts, which is functionally identical to having none.

What certification costs

There is no honest hours-per-model figure, and any firm quoting one is averaging engagements that do not resemble yours. Effort is driven almost entirely by Gate 2 — how many KPIs have contested definitions and how many business owners must agree. The technical gates are fast; the margin-definition argument is not.

What can be stated precisely are the published platform constraints that bound what you are allowed to promise:

Constraint	Published figure	Source
Scheduled refreshes per day, Pro / shared capacity	8	Learn
Scheduled refreshes per day, PPU / Premium / Fabric capacity	48	Learn
Refresh timeout	2 hours shared, 5 hours Premium (XMLA bypasses)	Learn
Scheduled refresh auto-disable	After 4 consecutive failures	Learn
Label downstream inheritance ceiling	80 items	Learn
Minimum capacity for Copilot	F2+ or P1+; no trial SKUs	Learn
Impact analysis metrics window	Trailing 30 days	Learn

Two licensing consequences follow. A certified model with a sub-daily freshness promise cannot sit on Pro — compare the Premium and Premium Per User options and the full licensing and cost picture before publishing an SLA. And Copilot is a capacity feature, not a per-user one, which changes the business case alongside Microsoft 365 Copilot licensing.

What changed in 2026

Prep data for AI is authorable in both Power BI Desktop and the service. AI data schemas, AI instructions, and verified answers now save to the model in either environment and are consumed everywhere Copilot exists.
"Prepped for AI" was renamed "Approved for Copilot." Admins can also restrict standalone Copilot to approved items only.
The Master data badge joined Promoted and Certified, restricted to reviewers named by the Fabric admin and applicable only to items containing data.
Certification authority is delegable to Fabric domains, with a per-domain certifier list and documentation URL — which finally makes federated certification workable at scale.
The OneLake catalog absorbed the Purview Hub security insights into its Govern tab: label coverage, DLP evaluation, endorsement coverage, and freshness, scoped by domain.
Fabric data agents reached general availability and query semantic models with only Read permission on the model, no workspace access. RLS and column-level security still apply — which widens the blast radius of an untested security definition considerably.
Direct Lake on OneLake does not fall back to DirectQuery. Direct Lake on SQL endpoints falls back silently when guardrails are exceeded or SQL-level RLS is detected; Direct Lake on OneLake returns an error and visuals fail to render. Certification must record which mode a model uses, because the failure behavior is opposite.

Get your models certified before your AI answers from them

EPC Group runs GMS-9 certification as a fixed-scope engagement: model inventory, gate-by-gate assessment, remediation backlog with owners, and a certification record your auditors can read. Start with the models Copilot can already answer from. Talk to our Power BI consulting team or see how this fits the wider data governance program.

Frequently asked questions

What is semantic model certification in Power BI?

Certification is an endorsement badge applied to a semantic model by a reviewer explicitly authorized by a Fabric administrator. It signals that the model meets the organization's quality standards and is authoritative for enterprise use. Certified items are labeled in the UI, given precedence in lists, and prioritized in the OneLake catalog.

Who can certify a semantic model?

Only users specified by a Fabric administrator, and only if certification has been enabled for the tenant. Certification can also be delegated to domain administrators so each Fabric domain names its own certifiers. Any user can request certification, but nobody can self-certify without that authorization.

What is the difference between promoted and certified?

Promotion can be applied by any user with write permissions on the item and means the creator believes it is ready to share. Certification can only be applied by an authorized reviewer and means the item met an organizational standard. Promotion is an opinion; certification is a control.

Does Copilot respect row-level security?

Yes. Copilot and Fabric data agents operate under the signed-in user's identity, and row-level and column-level security continue to apply. The risk is not that security is bypassed — it is that an incorrectly authored RLS rule is faithfully enforced, producing a wrong answer that looks authoritative.

Can I validate Copilot answers using Test as role?

No. Microsoft states that Test as role does not validate all aspects of a report, specifically including Q&A visualizations, quick insights, and Copilot. It also does not work for DirectQuery models with single sign-on enabled. Validate Copilot by signing in as an actual Viewer-role user and running a fixed prompt set.

What are AI instructions and verified answers?

AI instructions are business context you write on the semantic model — terminology, priorities, domain logic — that Copilot uses as grounding. Verified answers are human-approved visual responses bound to trigger phrases. Both are stored on the model, so they apply to every report built on it, and both require Q&A to be enabled.

What does "Approved for Copilot" do?

It marks a semantic model as prepared for AI consumption, which removes the friction treatment standalone Copilot otherwise applies to answers from that model. Reports built on the model are treated as approved too. Changes usually reflect within an hour and can take up to 24 hours on models with many reports.

What should trigger decertification?

Owner departure without a successor, KPI redefinition without model re-review, any untested RLS or OLS change, two consecutive refresh SLA breaches, a schema change published without impact analysis, or a review overdue by more than 30 days. Remove the badge first, then remediate.

Do sensitivity labels flow automatically to reports built on a certified model?

Partly. A new report created from a labeled model inherits the label on creation regardless of tenant settings. Propagating a label change to existing downstream items requires downstream inheritance, which never overwrites manual labels, never applies a less restrictive label, and does not run at all if the model has more than 80 downstream items.

Semantic Model Certification: Making Power BI Safe for AI to Answer From

Key Facts