AIUC-1 Agent Certification Guide: What the Standard Covers and How Assessment Works

Buyers are starting to see "AIUC-1 certified" in AI agent sales conversations, and most security teams do not yet know what that certificate does and does not prove. AIUC-1 is a certification standard for AI agents that combines an audit of policy, operational and technical controls with technical evaluations of the agent itself, renewed every year and revised every quarter. This guide explains the six risk domains, the requirements that matter most for identity and agent access, how scoping, evals and audit fit together, and how the standard relates to ISO/IEC 42001, the NIST AI RMF, the EU AI Act and OWASP. It is for vendors preparing for certification and for buyers and assurance teams deciding how much weight to put on a certificate. Everything here was checked against the AIUC-1 sites on 27 October 2026, when the current release was the Q4 2026 version of 15 October 2026; requirements change quarterly, so confirm against the live standard.

Key takeaways

• AIUC-1 certifies an agent, not an organisation. Scope is a specific agent in a specific deployment context, so check which agent and which use the certificate covers.
• Six domains, mandatory and optional requirements. Data and Privacy, Security, Safety, Reliability, Accountability and Society, each with requirements marked Mandatory or Optional and controls marked Mandatory or Supplemental.
• Testing is built in. Several domains require third-party testing at least every three months, and certification includes technical evals such as prompt injection, jailbreak, data leakage and unsafe tool call scenarios.
• Identity controls are present but partly supplemental. Agent service access restrictions and tool authorisation are mandatory controls, while unique agent identities and just-in-time credentials appear as supplemental controls.
• It complements, not replaces, other frameworks. AIUC-1 publishes crosswalks for 14 frameworks but states they are informational; a certificate is evidence for, not proof of, EU AI Act or ISO/IEC 42001 conformity.

What it is and who it applies to

AIUC-1 is maintained by the Artificial Intelligence Underwriting Company (AIUC) with a consortium of security leaders, and describes itself as a certification standard for AI agents covering security, safety and reliability. The first release was published on 22 July 2025. Since then releases have followed on 1 October 2025, 15 January 2026, 15 April 2026, 15 July 2026 and 15 October 2026, and the changelog schedules the next for 15 January 2027. The Q4 2026 release added controls for open-weight model deployments, expanded third-party testing (new testing requirements A009 for data and privacy and E018 for accountability), and consolidated disclosure controls.

It is a voluntary, market-driven scheme rather than a law or an international standard. It applies to organisations that build or deploy AI agents and want independent assurance to show customers, insurers or regulators. Organisations listed on the AIUC-1 site as certified or adopting include AI application vendors and enterprises; the list changes and you should verify a vendor's status directly rather than relying on sales material.

Structure and key requirements

The standard has three layers. Requirements carry an ID such as A003 and are labelled Mandatory or Optional. Under each sit controls with evidence IDs such as B006.1, labelled Mandatory Control or Supplemental Control. Each control lists the evidence an auditor reviews, typed as Documentation, Config, Logs, Demonstration or Evals. An Optional requirement can still contain a mandatory control that applies once the requirement is in scope (B002 Detect adversarial input is an example).

Counting the non-retired requirement IDs on the six domain pages on 27 October 2026 gives 9, 10, 10, 3, 16 and 2 respectively. Several older items are marked retired and merged into others (for example C011, C012, D002, E007 and E014), so expect IDs to shift between releases. The third-party testing requirements (B001 is described as at least every three months, as is E018) are the feature that most distinguishes AIUC-1 from management system standards.

Identity and NHI requirements

AIUC-1 does not have a separate identity domain, but agent identity and access sit inside the Data and Privacy, Security and Reliability requirements. The evidence page shows the controls below; note which are mandatory.

Two further mandatory requirements touch identity directly: A008 Prevent leakage of credentials and secrets, and B007 Enforce user access privileges to AI systems, which calls for access controls and admin privileges aligned with organisational policy. Read their current controls on the live standard.

The practical reading: an agent can be certified with mandatory gateway restrictions, tool allowlists and logging in place while still sharing credentials with other agents, because unique identities and just-in-time credentials are supplemental. Buyers who care about non-human identity hygiene should ask specifically whether supplemental controls A003.2 and A003.3 were assessed. For what good looks like, see the Agent Identity and Access Guide and the Identity Governance for AI Agents Guide.

Implementation steps

AIUC-1 publishes a four step certification path: scoping, evals, audit and certification. Preparation before engaging is where most effort goes.

1. Choose the agent and context: pick the agent, its deployment (customer facing, internal, embedded) and its tools. Scope creep into "all our AI" makes evidence unmanageable.
2. Gap assessment: AIUC describes a 48-hour gap assessment at scoping. Run your own first against the domain pages: list every mandatory requirement and control and the evidence you have today.
3. Close identity and tool gaps first: B006.1, B006.2 and D003.1 to D003.4 need configuration evidence. Put an allowlist in front of tools and MCP servers, log every tool call with server, tool name, inputs and timestamp, and add approval gates for high impact actions. Implement unique agent identities even though the control is supplemental.
4. Write the policies: input and output data policies (A001, A002), the AI risk taxonomy (C001), the three failure plans (E001 to E003), the acceptable use policy (E010) and accountability assignments (E004).
5. Build your own evals: before external testing, run internal suites for injection, data leakage, hallucination and unsafe tool calls so the formal evals are not your first test. See the AI Security Evaluations Guide.
6. Engage the scheme: AIUC runs evals (the site cites typically 1,000 to 5,000 red team scenarios), then an accredited auditor reviews controls across the domains, and the audit report and certificate are issued.
7. Operate for renewal: plan for quarterly retests, track each quarterly release for new requirements, and prepare for annual re-certification against the version you locked or a newer one.

Decision guidance: a start-up selling one agent to enterprises may find AIUC-1 a faster, more specific trust signal than ISO/IEC 42001. A large organisation with an AI management system already in place may treat AIUC-1 as an agent-level complement for its highest risk agents. If you already hold SOC 2, the site mentions a joint SOC 2 and AIUC-1 offering through auditors.

Evidence and assessment

Evidence is typed, and auditors look for the type the control names:

• Documentation: policies, failure plans, risk taxonomies, vendor due diligence records, tool call log reviews.
• Config: gateway rules, network policies, MCP allowlists, rate limits, approval workflow settings, data access scoping.
• Logs: tool call logs, agent service call logs, alert records, third-party access logs (E009), AI system activity logs (E015).
• Demonstration: walkthroughs showing a control working, such as an approval gate blocking an action.
• Evals: results of technical testing, including third-party tests.

The methodology page shows eval results graded P0 to P3, with a sample report listing tests completed, critical failures and counts by grade, and coverage by risk and attack vector. It does not define which grades block certification, so ask the auditor how findings translate into pass or fail and what remediation window applies.

For buyers, five questions to ask a certified vendor:

1. Which agent, deployment context and standard version does the certificate cover, and when does it expire?
2. Which optional requirements and supplemental controls were in scope, especially A003.2, A003.3 and B006.3?
3. What were the critical and P1 findings in the latest evals, and how were they fixed?
4. When was the last quarterly retest, and did it use the latest attack categories?
5. How does the agent authenticate to our systems, and are its credentials unique, scoped and revocable by us?

Metrics to track readiness and ongoing assurance:

• Percentage of mandatory controls in scope with current evidence (target 100% before audit).
• Critical and P1 eval findings open, and median days to remediate.
• Share of agent tool calls covered by allowlists and logging.
• Days since the last third-party test for each domain that requires one (keep under 90).
• New requirements from the latest quarterly release not yet assessed.

Fold the buyer questions into vendor reviews using the Security Vendor Evaluation and RFP Guide.

Mapping to other frameworks

AIUC-1 publishes crosswalks to 14 frameworks and states that "Crosswalks are provided for informational purposes only". The wording matters: it describes operationalising, aligning or mapping, not satisfying.

For your own control library, the identity related requirements map naturally to NIST SP 800-53 Rev. 5 AC-6 Least Privilege, IA-9 Service Identification and Authentication, AU-6 Audit Record Review, Analysis, and Reporting and CA-8 Penetration Testing, and to NIST CSF 2.0 PR.AA-05 and ID.IM-02. These are our mappings, not AIUC-1's.

Common pitfalls

• Reading the certificate as organisation-wide: it covers a scoped agent. A vendor's other agents, or a new version with different tools, may be outside scope.
• Ignoring supplemental controls: unique agent identities and per-agent permission scopes are supplemental, so a certificate alone does not prove credential hygiene. Ask.
• Treating crosswalks as compliance: AIUC-1 itself says crosswalks are informational. Regulatory obligations still need their own assessment; see the Agentic AI Compliance Guide.
• Missing quarterly change: new requirements arrive every quarter and old ones are retired or merged. Track the changelog so renewal is not a surprise.
• First tests at certification time: organisations that have never run injection or tool misuse evals tend to fail the external evals on basics. Build internal suites first.
• Logs without review: tool call logs are mandatory evidence, but auditors will also expect alerting (B006.2) and periodic review; storing logs nobody reads is a gap.

Practitioner checklist

• Confirm the current AIUC-1 release and changelog before starting; note which version you will lock.
• Define the agent, deployment context and tools in scope, and keep the scope narrow.
• Map every mandatory requirement and control to evidence you hold, by evidence type.
• Implement tool and MCP allowlists, tool call logging with alerting and approval gates for high impact actions.
• Give the agent a unique, scoped identity and just-in-time credentials, even though the control is supplemental.
• Run internal evals for injection, leakage, hallucination and unsafe tool calls before external testing.
• Plan budget and owners for quarterly retests and annual re-certification.
• As a buyer, ask for scope, version, expiry, supplemental controls assessed and recent critical findings.

Standards and references

• AIUC: AIUC-1 overview and certification process
• AIUC-1: Changelog
• AIUC-1: Controls and evidence
• AIUC-1: Security domain
• AIUC-1: Crosswalks
• AIUC: Methodology
• AIUC-1: Certification
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Agentic AI Compliance Guide · AI Security Evaluations Guide · Audit, Assurance and Compliance Guide · AI Agent Identity Security Buyer's Guide · Singapore Model AI Governance Framework for Agentic AI Guide