What Is AIUC-1?

From customer service to coding, AI agents are taking on ever increasing roles in today’s enterprises. With the ability to act independently and access to sensitive information, AI agents bring significant risks along with their impressive capabilities. But until recently, the only AI assurance standards have been at the level of organizational governance, not individual agents and agent systems. There has been no independent oversight of AI agents, with enterprises and consumers having to rely only on vendor claims of safety and security.

AIUC-1 rectifies this, providing the first standard for independent assurance of AI agents. Founded in 2025 by the Artificial Intelligence Underwriting Company, AIUC-1 involves a rigorous evaluation procedure, including extensive review and adversarial testing, over six domains:

AIUC conducts technical evaluations of the agents, followed by independent testing of the supporting controls by an accredited auditor. Once applicable requirements are satisfied, AIUC issues the certificate, demonstrating conformity with the standard within the defined scope.

AI agents have evolved beyond simple chatbots. Today, they help customers, automate business processes, assist employees, and even write software. As these systems take on more responsibility and operate with greater autonomy, organizations need a way to verify that they are secure, reliable, and ready for real-world use.

Each agent deployment brings its own risks. Prompt injection can hijack an agent through hidden instructions in an email, web page, or document. Data leakage can expose customer or company information. Hallucinations can put wrong answers in front of customers or into code. Unauthorized actions and tool misuse can turn a mistake into a real financial or operational consequence.

Internal testing and vendor claims are not enough to protect against these risks because a vendor’s assurance that its product is safe gives a buyer nothing to verify. With AIUC-1, the goal is to give buyers evidence, not just policy assertions, about how an agent behaves when someone tries to manipulate it or push it past its authorized limits. As a result, enterprises get a common benchmark for comparing vendors, and vendors get a credible way to show that their agents have been tested under pressure.

AIUC-1 evaluates agents across 6 domains: data & privacy, security, safety, reliability, accountability, and society.

The Data & Privacy domain addresses what AI agents can see, retain, and share. It protects users and enterprises from data leakage, exposure of intellectual property, and the use of customer information to train models without permission. To do this, it requires clear data policies that define how information is collected and used, access controls that limit what an agent can reach, and technical safeguards that detect and block sensitive data from leaving the system.

The Security domain addresses attacks and unauthorized use of AI agents, including prompt injection, adversarial inputs, endpoint scraping, and unauthorized actions. It covers safeguards that restrict agent and user permissions, protect the deployment environment, and evaluate resistance to relevant threats through third-party testing. Additional measures, such as real-time input filtering, may support these protections depending on the system and applicable requirements.

The Safety domain aims to keep agents from producing harmful, out-of-scope, or high-risk outputs. It relies on pre-deployment testing to catch problems before launch, comprehensive red-teaming that probes the agent with realistic misuse scenarios, and ongoing monitoring once it is live. When a situation is too sensitive or uncertain for the agent to handle alone, human-in-the-loop review ensures a person can step in and make the final call.

The Reliability domain addresses hallucinated outputs and unsafe tool calls. It evaluates safeguards designed to limit unsupported responses and prevent agents from taking unauthorized actions, accessing restricted information, or operating beyond their intended scope. Depending on the system, safeguards may include grounding responses in trusted information, restricting tool permissions, and requiring human approval for sensitive operations. Third-party evaluations test how these safeguards perform against relevant reliability risks.

The Accountability domain makes sure someone is answerable when an agent goes wrong. It requires organizations to define who is responsible for the agent’s behavior, manage changes to models, prompts, and tools through sound change management, and maintain enough observability to see what the agent did and why. It also calls for consistent assessment of third-party vendors, so risk introduced by outside components is evaluated rather than assumed.

The Society domain looks beyond individual deployments to the wider harm AI agents could enable. It addresses AI cyber misuse, where agents are used to carry out attacks, and agents used in manipulation attacks. It also covers catastrophic misuse, meaning scenarios with severe, large-scale consequences. The aim is to ensure agents are not turned into tools for damaging people, organizations, or public safety.

AIUC-1 is designed for organizations that develop, deploy, or rely on AI agents. The following groups stand to benefit most:

Organizations that build and sell AI-powered products face increasing pressure from enterprise buyers to demonstrate security, reliability, and governance. AIUC-1 provides independent validation that helps answer complex security and procurement questionnaires.

Why it matters: Builds customer trust and shortens enterprise sales cycles.

Companies integrating AI agents into existing platforms must address new risks related to data access, tool usage, and autonomous actions. Customers need assurance that these capabilities have been thoroughly tested.

Why it matters: Demonstrates that AI features are secure, controlled, and ready for production use.

Chatbots, virtual assistants, and support agents interact directly with customers and represent the organization’s brand. Failures such as hallucinations, manipulated responses, or data exposure can quickly become public incidents.

Why it matters: Reduces reputational and operational risk.

Organizations using AI agents for finance, HR, IT, or other internal workflows should evaluate how those agents access systems and perform actions. Weak controls can lead to unauthorized changes, data exposure, or difficult-to-trace errors.

Why it matters: Helps ensure AI agents operate safely within critical business processes.

Healthcare, financial services, government agencies, and other regulated sectors manage sensitive data and must meet strict compliance requirements. These organizations often need objective evidence that AI systems behave predictably and securely.

Why it matters: Supports vendor due diligence, governance programs, compliance initiatives, and audit readiness.

AIUC is designed to be complementary to other adjacent frameworks that preceded it. It does not replace other standards; organizations typically need AIUC-1 in addition to other certifications they may already have or want to pursue.

ISO 42001 and AIUC-1 address different layers of AI assurance and work best together.

ISO 42001 is an organization-wide AI management system standard. It focuses on the governance, policies, risk management, and oversight needed to manage AI responsibly across the business.

AIUC-1 focuses on individual AI agents and use cases. Rather than evaluating management processes alone, it assesses how a specific agent behaves in practice through technical testing, adversarial evaluations, and ongoing quarterly assessments.

Because AIUC-1 is cross-walked to ISO 42001, organizations can build on existing governance efforts instead of starting from scratch. ISO 42001 provides the foundation for responsible AI management, while AIUC-1 delivers independent, agent-level validation that AI systems are secure, reliable, and ready for real-world use.

In short: ISO 42001 helps organizations govern AI, while AIUC-1 helps prove that specific AI agents can be trusted.

SOC 2 and AIUC-1 answer different questions. SOC 2 reports on whether an organization’s controls over security and related criteria are designed and operating effectively, but it was built before autonomous agents were common. AIUC-1 exists because AI agents go beyond the limits that SOC 2 and ISO 27001 anticipated. It fills that gap without replacing SOC 2. It avoids duplicating the work of non-AI frameworks like SOC 2, ISO 27001, or GDPR.

In practice, organizations typically need both: SOC 2 for baseline security assurance and AIUC-1 for agent-specific risks.

As AI agents take on real work, from supporting customers to writing code, they bring risks that traditional frameworks never fully anticipated, including prompt injection, data leakage, and unauthorized actions. AIUC-1 closes that gap by pairing an audit of an organization’s controls with adversarial testing of the agent itself.

Rather than replacing SOC 2 or ISO 42001, it builds on them, adding proof of how an agent actually behaves. For AI product companies, SaaS providers, and regulated organizations, that means buyers get evidence instead of assurances.

Interested in AIUC-1 certification? Schedule a consultation with one of our AI assurance specialists.