AIUC-1 Explained. A Guide to The Newest AI Compliance Framework

Organizations are moving beyond traditional software and adopting AI systems that take on increasingly complex tasks and workflows. The same capabilities that make AI agents powerful also create new enterprise risks. As these systems gain greater access to data, workflows, and business applications, the consequences of failure grow with them. A hallucinated response can put misinformation in front of a customer. An agent connected to enterprise systems can expose sensitive information, trigger unauthorized actions, or disrupt a critical business process.

The first wave of AI adoption was driven by technical capability. The next one will be gated by something else: trust.

For AI developers and providers, that means demonstrating their systems are built with appropriate security and governance practices. For enterprises adopting AI, it means having confidence that the systems they depend on were designed and are managed responsibly.

What Is AIUC-1? 

AIUC-1 is an AI compliance and assurance standard designed specifically for AI agents and autonomous AI systems. It was created by the Artificial Intelligence Underwriting Company (AIUC).

AIUC-1 is an assurance standard built specifically for AI agents. It was developed by the Artificial Intelligence Underwriting Company with contributions from Orrick, MITRE, the Cloud Security Alliance, Stanford, and a consortium of enterprise security leaders. Rather than inventing a new governance model, it operationalizes existing AI frameworks into measurable, auditable requirements, with published crosswalks to ISO 42001, the NIST AI Risk Management Framework, the EU AI Act, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.

It covers six domains:

• Data and Privacy: what data the agent can reach, and preventing cross-customer exposure, PII leakage, and credential disclosure
• Security: adversarial robustness testing, input filtering, and preventing unauthorized agent actions
• Safety: risk taxonomy, pre-deployment testing, and preventing harmful or out-of-scope outputs
• Reliability: preventing hallucinated outputs and restricting unsafe tool calls
• Accountability: AI failure plans, assigned ownership, acceptable use policy, activity logging, and vendor due diligence
• Society: preventing cyber misuse and catastrophic misuse

What distinguishes it from most assurance frameworks is that certification requires both a governance audit and adversarial technical testing of the agent itself. A policy review alone will not produce a certificate. Something has to try to break the agent, and the results become part of the evidence.

The standard is also refreshed quarterly rather than annually, which is appropriate given how fast agent architectures are moving. Recent cycles have added requirements around MCP and A2A protocol security, non-human identity, and agent access management.

Why Was AIUC-1 Created? 

Most existing security and compliance frameworks were not built to address the unique risks introduced by AI agents. 

Traditional software follows predetermined logic, but AI agents operate differently. They can access enterprise systems, use tools and APIs, and interact with sensitive data as part of their workflows. In more advanced use cases, they may also make recommendations, take autonomous actions, or execute complex processes with limited human oversight. 

These capabilities introduce risks that traditional frameworks do not fully address. For example, AI agents may be vulnerable to prompt injection attacks or jailbreak attempts that manipulate how they behave. They can also create operational risk when they execute unauthorized tools, take hallucinated actions, or operate with excessive permissions. Without strong governance, organizations may also face data leakage, unapproved model training practices, and limited accountability for AI-driven decisions. 

AIUC-1 was developed specifically to provide a structured, auditable framework for managing these emerging risks.  

How AIUC-1 Compares to ISO 42001 and SOC 2

The most common question Tevora gets is whether this overlaps with frameworks organizations already hold. Mostly it does not, and that appears to be deliberate. AIUC-1 was built to avoid re-covering ground that SOC 2, ISO 27001, and GDPR already handle, and it publishes crosswalks to ISO 42001, the NIST AI Risk Management Framework, the EU AI Act, MITRE ATLAS, and the OWASP Top 10 for LLM Applications.

SOC 2 attests to controls at the service organization. It tells a buyer that the company running the system has sound security practices. It says nothing about how the AI behaves. A vendor with a clean SOC 2 report still cannot use it to answer whether their agent resists prompt injection, leaks data across tenants, or invents a refund policy under pressure. Those are different questions requiring different evidence, and AIUC-1 exists to answer them.

ISO 42001 is the closer comparison and the one people conflate most often. ISO 42001 certifies an AI management system: the organizational processes, governance structures, and continual improvement machinery for managing AI responsibly. AIUC-1 certifies a specific agent, combining governance assessment with technical evaluation of how that agent performs.

They are complementary, but not interchangeable in either direction. AIUC-1 incorporates the majority of ISO 42001’s controls, yet AIUC’s own published crosswalk identifies full gaps at several clauses, including interested parties, AI objectives and planning, internal awareness and training, responsible AI development objectives, and customer expectations, with only partial coverage of AI system impact assessment. An organization that certifies against AIUC-1 has not thereby met ISO 42001, and one pursuing both should plan for the management system work AIUC-1 will not produce on its own.

The cleanest way to hold the three apart is to ask what question each one answers for a buyer.

Organizations That Should Consider AIUC-1 Certification

Organizations building AI products.

• Software vendors developing autonomous agents, agentic workflows, or SaaS platforms where an agent is part of what the customer buys.

Organizations deploying AI agents internally.

• Enterprises running agents that access sensitive data, automate business processes, interact with customers, or make recommendations that carry consequences.

Organizations that need third-party AI assurance.

• Companies looking to demonstrate responsible AI practices to customers, partners, investors, regulators, or procurement teams, often because someone has already asked.

As enterprise AI adoption accelerates, buyers increasingly want evidence that AI systems are governed and tested appropriately before deployment. That expectation is what turns assurance from a nice-to-have into a condition of sale.

One genuine limit applies across all three. Only agentic AI systems are eligible. Copilot-style assistants and one-off model API calls fall outside the standard, which surprises people more often than you would expect, and it is worth resolving early rather than mid-scoping.

Two other assumptions are worth correcting.

The first is that this is only for large companies. Certified organizations range from seed stage to publicly traded. Company size is not the variable. Scope is, and a small vendor with one sophisticated agent may face a larger assessment than a large enterprise with a narrow internal tool.

The second is that this is only for external, customer-facing agents. Internal automation, summarization, and image generation agents are all certified today. They generally scope smaller, because an internal agent with limited data access meets fewer controls than an externally facing agent wired into sensitive systems, but smaller scope is not the same as ineligibility.

What Does an AIUC-1 Assessment Involve?

Certification has two halves that run in parallel. An auditor collects and assesses evidence across operational, legal, and governance controls. Separately, the agent undergoes adversarial technical evaluation against hallucinations, unsafe tool calls, jailbreaks, and prompt injection. Both feed into a certification decision, and the resulting audit report is the artifact the organization uses to demonstrate its position to customers.

Most organizations complete initial certification in five to ten weeks. The largest variable is the maturity of the governance program already in place, which is another way of saying the work done before the audit determines how the audit goes.

One practical detail is worth establishing early because it materially affects effort. Agents reachable through an external API are considerably easier to evaluate than agents that only exist behind a platform interface, since the technical testing depends on programmatic access at volume. An agent that can only be exercised through a user interface requires a more manual approach.

Certification is valid for twelve months, with technical testing repeated at least quarterly to keep it current. This is not a one-time exercise, and the recurring cadence is the point. Systems that change continuously cannot be meaningfully assured by a single snapshot.

AIUC-1 Scope is a Decision, and How it Shapes What Your Certification Proves

Most explainers stop at the six domains. The more consequential part happens before any of them are assessed.

AIUC-1 certifies an agent, not a company, so the first real question in a certification project is which agent and where its boundaries fall. That decision drives the requirements that apply, the effort, the cost, and what the finished certificate is able to tell a customer. Scope is worked out across the agent’s capabilities, its architecture, and its deployment context, and the result is a Statement of Applicability, signed off by the auditor, recording exactly what was assessed and what was not.

There is real room to shape that document. Mandatory requirements and core controls apply by default, but a mandatory requirement can be excluded where the organization documents a business reason the auditor accepts, and a core control can be substituted by demonstrating a different route to the same outcome. Optional and supplemental controls work the other way, opted into because a customer or regulator has asked. The standard also does not define what an AI agent is, leaving the organization to determine what counts and which one to put forward. That flexibility is appropriate, since holding a narrow internal tool to the same standard as an agent wired into regulated systems would serve nobody. It also means two valid certificates can rest on quite different assessments.

Which is why scoping narrowly is a false economy. A certificate covering a peripheral agent will not satisfy a customer asking about the one entering their environment, and you will be back doing the work again with a deadline attached. Scope, exclusions, and opt-ins all appear in the certificate and the audit report by design, so anyone reading carefully will see the decision you made. The useful question is not how quickly you can obtain a certificate. It is which agent your customers are asking about.

Why AIUC-1 Matters in 2026 and Beyond 

The pattern is familiar. A new class of technology reaches enterprise scale, buyers ask how they are supposed to trust it, and an assurance standard emerges to answer them. It happened with cloud infrastructure. It is happening now with AI agents. 

What is different this time is the pace. Agent capabilities change quarterly rather than annually, and the assurance model has had to change with them. That is why AIUC-1 pairs a governance audit with recurring adversarial testing instead of a single annual review, and why the standard itself is refreshed every quarter. 

Adoption is still early, and the market has not fully settled. But the underlying demand is not in question. Enterprise buyers have started asking AI vendors for evidence that goes past a policy document, and vendors who can produce that evidence are moving through procurement faster than those who cannot. 

That is the part worth acting on. The work underneath AIUC-1, knowing which agents you run, what they can reach, how they fail, and who is accountable when they do is the same work every AI assurance framework asks for. Organizations that build it now will be ready for whichever standard their customers ask for, and they will be ready on their own schedule rather than a customer’s deadline. 

How Tevora Can Help

Tevora helps organizations build the governance foundation that AI assurance depends on, including AI risk assessments, ISO 42001 readiness, and third-party risk programs adapted for agentic systems. Whichever standard your customers end up asking for, the underlying work is the same, and it is easier to do before there is a deadline attached to it. 

If you are working out where your AI program stands, get in touch. Just give us a call at (833) 292-1609 or email us at [email protected].