AIUC-1 Certification Services

AIUC-1 is a standard for AI agent security, safety, and reliability. It includes technical and operational controls across data and privacy, security, safety, reliability, accountability, and societal risk.

To earn certification, an AI agent must meet all applicable requirements, undergo independent review by an accredited auditor, and complete comprehensive technical evaluations covering relevant enterprise risks.

AIUC-1 may be relevant for organizations developing or deploying AI agents in environments where security, safety, reliability, and independent assurance are important.

Examples can include customer-facing agents, internal automation agents, coding agents, and agents that access sensitive data, connect to business systems, use tools, or take actions on behalf of users.

AIUC-1 organizes its requirements across six areas:

• Data and privacy
• Security
• Safety
• Reliability
• Accountability
• Society

These areas address topics such as data exposure, adversarial attacks, prompt injection, harmful outputs, hallucinations, unsafe tool calls, logging, ownership, incident planning, vendor due diligence, and potential misuse.

Yes. Technical evaluation is a defining part of AIUC-1 certification. Controls are assessed through independent audit procedures, while the agent is evaluated against relevant risks and attack scenarios.

The testing is intended to determine whether safeguards work in practice, rather than relying only on policies or control descriptions.

ISO 42001 is an international management-system standard focused on how an organization governs the responsible development and use of AI. AIUC-1 focuses on the security, safety, reliability, and safeguards of specific AI agents.

The two can be complementary. An organization may use ISO 42001 to demonstrate an organizational AI management system and AIUC-1 to provide agent-specific evidence through controls, technical evaluation, and an independent audit. AIUC-1 explicitly maps to ISO 42001 and other governance frameworks.

Yes. Organizations do not need ISO 42001 certification before pursuing AIUC-1. However, an established AI governance program may provide documentation, responsibilities, risk-management practices, and controls that support AIUC-1 readiness.

Pursuing them together may help an organization address both organizational AI governance and the security posture of specific AI agents.

A readiness or gap assessment evaluates the organization’s current practices and evidence against the applicable AIUC-1 requirements before the final audit is completed.

It can help clarify scope, identify missing evidence, assign control ownership, and prioritize remediation. A readiness assessment does not itself result in certification.

The timeline depends on the agent’s scope, technical environment, organizational readiness, available evidence, and any remediation identified during testing or audit procedures.

A typical kickoff-to-certificate process lasts approximately eight to ten weeks, with scoping, evidence preparation, technical testing, and audit work overlapping. Actual engagement timing should be confirmed after scoping.

Evidence depends on the agent, its capabilities, and the applicable controls. It may include policies, risk assessments, architecture documentation, data-protection practices, access controls, logging and monitoring records, testing results, incident procedures, transparency materials, and evidence of governance and accountability.

Sensiba works with the organization during scoping and evidence preparation to identify the materials relevant to the engagement.

AIUC-1 audits are performed by auditors accredited by the Artificial Intelligence Underwriting Company. Accreditation evaluates consistency in applying AIUC-1 controls and technical capability in testing those controls.

Sensiba is an accredited AIUC-1 auditor supporting organizations through scoping, evidence review, technical evaluation, and independent audit procedures.

The first step is a conversation about your AI agent, its capabilities, its users, its data access, and your goals for certification.

From there, Sensiba can help determine the potential scope, identify relevant stakeholders, and discuss readiness and next steps.

AIUC-1 certification is valid for 12 months. Maintaining certification requires quarterly technical evaluations of the agents in scope and an annual independent audit to confirm that applicable requirements continue to be met.

Yes. The AICPA and AIUC are rolling out a joint SOC 2 + AIUC-1 offering that combines a SOC 2 examination and AIUC-1 certification through one CPA-led engagement and a unified report.

This approach brings together assurance over the systems and controls within the SOC 2 scope with independent evaluation of AI agent security, safety, and reliability. Coordinated evidence collection and audit procedures can reduce duplicate requests while addressing the requirements of both standards.