AIUC-1 certification is the third-party assurance route for AI agents, and the standard behind it was revised again on October 15, 2026, which makes the version a certificate was audited against part of the evidence a buyer should ask for. The Artificial Intelligence Underwriting Company (AIUC) updates the standard every quarter, and the latest release added controls for open-weight models, broadened third-party testing across the domains, and made human approval of sensitive tool actions a core control. For organizations that build AI agents, readiness work built on last quarter’s version needs a check against the current one. For organizations that buy agents, a certificate is only as informative as its scope and its version. This article covers what AIUC-1 is, its six domains, how certification works, what changed in 2026, and how to prepare or verify.
What AIUC-1 Is and Who Stands Behind It
A Standard for the Agent, Not the Company
AIUC-1 is the standard for AI agent security, safety, and reliability. To earn certification, an agent must pass all applicable AIUC-1 requirements, validated by an accredited auditor, and go through evaluations that cover the top enterprise risks. A certificate typically covers specific products, not the full range of an organization’s products and practices. The standard is also AI-focused: AIUC states that it does not duplicate the work of frameworks such as SOC 2, ISO 27001, or GDPR, which address non-AI risks.
Who Issues the Certificate
Only AIUC can issue the official AIUC-1 certificate. Accredited auditors validate the evidence, and AIUC works with a community of service providers, GRC platforms, and evaluation providers that help organizations close gaps. AIUC also states that certification verifies and complements an organization’s own safety and security practices, so an organization cannot rely on the process to build those practices from scratch. The standard is developed with the AIUC-1 Consortium, which AIUC describes as having more than 300 members. Elevate Consult prepares organizations for AIUC-1 and does not issue the certificate.
The Six AIUC-1 Domains
AIUC-1 organizes its requirements into six domains, lettered A to F. The table gives AIUC’s description of each domain and an example of a requirement inside it.
| Domain | What it covers | Example requirement |
|---|---|---|
| A. Data & Privacy | Data use policies, IP and trade secrets, PII and cross-customer exposure, secrets leakage | A003 limits what data an agent can reach; A008 prevents leakage of credentials and secrets |
| B. Security | Adversarial testing, input filtering, access controls, endpoint protection, secure code patterns | B006 prevents unauthorized agent actions, including limiting which MCP servers an agent can use |
| C. Safety | Risk taxonomy, pre-deployment and third-party testing, harmful and out-of-scope outputs | C001 defines an AI risk taxonomy; C002 requires pre-deployment testing |
| D. Reliability | Hallucination prevention and testing, restricting unsafe tool calls | D001 prevents hallucinated outputs; D003 restricts unsafe tool calls |
| E. Accountability | Failure plans, ownership, vendor due diligence, logging, transparency, quality management | E001 to E003 set AI failure plans; E015 requires logging of AI system activity |
| F. Society | Preventing AI-enabled cyber misuse and catastrophic misuse | F001 covers cyber misuse, with a control added in October 2026 for assessing modified open-weight models |
AIUC labels every requirement as mandatory or optional and every control as mandatory or supplemental, and an agent has to pass the requirements that apply to it. Applicability follows the agent’s capabilities: some requirements apply to externally facing agents, for example, and others to agents that generate code or media. The scoping conversation with an auditor therefore decides how much of the standard an organization is assessed against.
Agent-Specific Controls Worth Knowing
Several controls address the ways agents differ from other software. Tool use is covered by D003, which asks for tool allowlists and parameter validation, rate limits and transaction caps for autonomous tool use, a log of every tool call, and human approval for sensitive operations such as financial transactions or deleting records. Identity and permissions are covered by A003.2 and A003.3, which describe a unique, verifiable identity for each agent, standard federation with OAuth 2.0 or OIDC, just-in-time permissions scoped to subtasks, and no silent inheritance of elevated permissions from orchestrating agents. Logging is covered by E015, whose supplemental controls add full execution chains of agentic workflows and tamper-evident logs. The identity, permission, and execution-chain controls are supplemental, while tool authorization, rate limits, tool call logging, and human approval of sensitive operations are mandatory. Elevate’s guide to governing autonomous AI agents covers the wider governance picture.
How AIUC-1 Certification Works
AIUC-1 certification combines an audit of the agent’s controls with evaluations of the agent itself. AIUC describes a typical process with four phases:
- Scoping and kick-off (1 to 2 weeks). The organization defines the product scope, assigns team members, sets up the environment, and identifies initial evidence and gaps.
- Evidence collection (3 to 5 weeks). The organization gathers operational practices, legal and governance policies, and technical implementation evidence, and fixes the gaps it finds.
- Evaluations (3 to 5 weeks). The agent is tested for hallucinations, unsafe tool calls, adversarial attacks, and other risks, and the vulnerabilities found are mitigated.
- Audit report (1 to 3 weeks). The evidence is combined into a final report, the report is signed off, and AIUC issues the certificate.
The phase ranges add up to more than the total AIUC quotes, which suggests that the phases overlap. AIUC gives a typical total of four to eight weeks on its certification page and five to ten weeks in its FAQ, and it notes that organizations starting from zero may take longer. At the end, the organization receives the certificate, a comprehensive audit report with third-party attestation and evaluation results, and a badge for its trust center or sales material.
What Keeps a Certificate Valid
A certificate is valid for 12 months. Evaluations have to run at least every three months to keep it valid, and all technical, operational, and legal controls are re-audited annually. AIUC is explicit that a certificate is a point-in-time assessment of controls, not a warranty of future performance, and that it should not replace independent risk assessment and ongoing monitoring.
AIUC-1 Changes Every Quarter, So the Version Matters
AIUC publishes the standard on a fixed calendar, on January 15, April 15, July 15, and October 15 of each year, and keeps a public changelog. The table lists the releases and the focus of each one.
| Release | Focus |
|---|---|
| July 22, 2025 | First launch of the standard |
| October 1, 2025 | Quarterly revision |
| January 15, 2026 | Quarterly revision |
| April 15, 2026 | MCP security, agent permissions, and third-party risk |
| July 15, 2026 | Coding agents, with new requirements for secrets management and secure code generation, and technical guidance for auditors |
| October 15, 2026 | Open-weight model deployments, expanded third-party testing, and developer and deployer guidance |
| January 15, 2027 | Next scheduled release |
Each release has a theme, and the themes follow how agents are being deployed: protocols and permissions in April, coding agents in July, and open-weight models and independent testing in October. The cadence also means that any description of the standard has a short shelf life, which is why the version is worth stating whenever a certificate is cited.
What the October 2026 Release Changed
The October 15, 2026 release added 5 requirements and 5 controls and retired 3 requirements. The largest change is in third-party testing. Five of the six domains now have their own mandatory requirement for a third-party evaluation report: data and privacy (A009) and accountability (E018) are new, and the security, safety, and reliability testing requirements (B001, C010, and D004) were renamed and broadened to cover each domain’s risk as defined in AIUC’s risk taxonomy. Three narrower testing requirements (C011, C012, and D002) were retired and folded into the broader ones. AIUC also released a public incident database and a risk and attack taxonomy that inform the scope of the testing.
The second change concerns open-weight models. New supplemental controls cover regression testing after changes such as fine-tuning, quantization, or inference engine updates (C002.4), verification of a model’s source, integrity, and licence before use (E006.2), and assessment of cyber misuse capabilities after a model is modified (F001.3). Vendor due diligence was renamed vendor and model due diligence to make clear that it extends to model provenance. The third change is that human approval for sensitive tool operations (D003.4) moved from a supplemental control to a core control, to address browser agents that can transact, delete records, or change settings in real accounts. AIUC also published guidance on how the developer and the deployer of an agent platform typically meet the controls.
Why the Audited Version Matters
AIUC says the certified party’s report states the scope of the certification, the version of the standard used, and the specific practices the organization follows. A certificate is valid for 12 months, so it can span several quarterly releases, and AIUC notes that existing certifications remain valid during transition periods. For a buyer, the version is therefore a fact to ask for. For a vendor, it is the reason a readiness program built against one release has to be checked against the next.
AIUC-1 Compared With SOC 2, ISO 42001, and NIST AI RMF
AIUC-1 is often described as the SOC 2 of AI agents, but the comparison only holds in part. The table shows how AIUC positions it against the frameworks organizations already know.
| Framework | Focus | Relationship to AIUC-1 |
|---|---|---|
| SOC 2 | Security and related controls of a service organization, not specific to AI | AIUC-1 covers AI-specific risks and does not duplicate SOC 2; AIUC publishes a SOC 2 crosswalk and describes a combined SOC 2 and AIUC-1 engagement |
| ISO 42001 | An AI management system and governance framework | AIUC says ISO 42001 establishes governance while AIUC-1 validates the robustness of safeguards through independent evaluations; AIUC publishes a crosswalk |
| NIST AI RMF | A voluntary framework for managing AI risk across the lifecycle | AIUC-1 turns its principles into agent-specific controls, per AIUC’s crosswalk |
AIUC also publishes crosswalks to the EU AI Act, MITRE ATLAS, and the OWASP Top Ten for agentic systems. In practice, the work splits in two. The controls half is governance work: policies, ownership, records, and evidence. Existing evidence from an ISO 42001 or NIST AI RMF program can support that half. The testing half requires evaluations of the agent itself, and documentation cannot replace it.
How to Check a Vendor’s AIUC-1 Certification
A badge on a vendor’s website is the start of the check, not the end. AIUC tells buyers to contact the certified party for its report, and six questions help read it:
- What is in scope? Certificates typically cover specific products, so confirm that the agent you plan to use is the one that was assessed.
- Which version of the standard was used? Ask for the version and the audit date, and compare them with the current release.
- How recent are the evaluations? Evaluations must run at least every three months, so ask for the date of the latest one and for the evaluation report.
- Which capabilities were assessed? Requirements depend on the agent’s capabilities, so check that customer-facing use, tool use, voice, or code generation were in scope if you plan to use them.
- Which optional controls were implemented? Optional requirements and supplemental controls vary by organization, and the report lists the specific practices the vendor follows.
- How does the certificate fit your own risk assessment? AIUC states that a certificate should not replace independent risk assessment and ongoing monitoring.
Elevate’s guide to AI vendor risk assessment for procurement shows where these questions belong in a vendor review.
How to Prepare for AIUC-1
Organizations that build or deploy AI agents can prepare in five steps. AIUC says the timeline depends on how mature the organization’s AI safeguards and governance already are, so a team with an existing AI governance program starts further along.
- Scope the agent. Define which product, which capabilities, and which users are in scope, because scope decides which requirements apply.
- Check against the current version. Compare existing controls with the October 15, 2026 release, not with an earlier one.
- Build the evidence in four categories. AIUC groups evidence into technical implementation, legal policy, operational practice, and third-party evaluation.
- Plan the third-party testing early. After the October release, five of the six domains require a third-party evaluation report, and evaluations repeat at least every three months.
- Re-check every quarter. The next release is scheduled for January 15, 2027.
Elevate’s AIUC-1 readiness service prepares organizations for both halves of the certification, the controls work and the testing, and supports them through the independent certification engagement. The certificate itself is issued by AIUC after an accredited auditor validates the evidence.
Conclusion
AIUC-1 gives builders and buyers of AI agents a shared reference: six domains, an audit of controls, evaluations of the agent itself, and a certificate that AIUC issues and keeps current through quarterly revisions. The October 15, 2026 release made third-party testing a requirement in five of the six domains and brought open-weight models into scope, so the version matters as much as the badge.
Teams that build agents can Book a Readiness Call to check where they stand against the current release. Elevate prepares organizations for AIUC-1. The certificate is issued by AIUC after an accredited auditor validates the evidence, and Elevate does not issue it.
Key Takeaways
AIUC-1 is a moving target, and the useful questions are about scope, version, and evidence.
- AIUC-1 certifies the agent. It is a standard for AI agent security, safety, and reliability, and certificates typically cover specific products.
- Only AIUC issues the certificate. Accredited auditors validate the evidence, and the certificate is valid for 12 months with evaluations at least every three months.
- The standard changes every quarter. The latest release is October 15, 2026, and the next is scheduled for January 15, 2027.
- October 2026 expanded third-party testing. Five of the six domains now require a third-party evaluation report, and open-weight models are in scope.
- Ask for the report, the scope, and the version. A badge alone does not show what was assessed.
Frequently Asked Questions
What is AIUC-1?
AIUC-1 is a certification standard for AI agent security, safety, and reliability, published by the Artificial Intelligence Underwriting Company. It has six domains: data and privacy, security, safety, reliability, accountability, and society. An agent earns certification by passing the applicable requirements, validated by an accredited auditor, and by going through evaluations that cover the top enterprise risks.
Who issues AIUC-1 certification?
Only the Artificial Intelligence Underwriting Company can issue the official AIUC-1 certificate. Accredited auditors validate the evidence, and other providers can help organizations prepare. Elevate Consult prepares organizations for AIUC-1 and does not issue the certificate.
How long does AIUC-1 certification take, and how long does it last?
AIUC gives a typical timeline of four to eight weeks on its certification page and five to ten weeks in its FAQ, and organizations starting from zero may take longer. The certificate is valid for 12 months. Evaluations are required at least every three months, and the controls are re-audited annually.
What changed in the October 2026 AIUC-1 update?
The October 15, 2026 release added 5 requirements and 5 controls and retired 3 requirements. It made third-party testing a mandatory requirement in five of the six domains, added controls for open-weight models, and made human approval of sensitive tool operations a core control. The next release is scheduled for January 15, 2027.
Is AIUC-1 the same as SOC 2 or ISO 42001?
No. SOC 2 is not specific to AI, and AIUC-1 covers AI-specific risks without duplicating it. AIUC describes ISO 42001 as a governance framework and AIUC-1 as validation of safeguards through independent evaluations. AIUC publishes crosswalks to both, and evidence from an existing program can support the controls half of AIUC-1.