TL;DR: AIUC-1 is the first certification standard built specifically to test how AI agents actually behave, not just what policies a company has written down. It combines an audit of organizational controls with adversarial testing across six domains, refreshed quarterly as new threats emerge. This guide covers what AIUC-1 tests, how it compares to ISO 42001, what certification actually involves, and why its Accountability and Safety domains put credentialed human evaluators at the center of compliance.
What is AIUC-1?
AIUC-1 is the world's first certification standard built specifically for AI agents, created by the Artificial Intelligence Underwriting Company (AIUC). Most AI governance content up to this point has been about policies and management systems: what you've documented, what committee approved it, what your risk taxonomy says. ISO 42001 audits that layer well, and it doesn't cut corners doing it. What it can't tell you is whether your AI agent actually behaves safely once someone starts pushing on it for real.
AIUC-1 takes a different approach. It tests actual agent behavior against thousands of adversarial and operational scenarios, then retests quarterly as new threats emerge. Think of it as the SOC 2 for AI agents: a familiar compliance model, applied to a brand of risk nobody had to worry about a few years ago. The standard is also backed by an insurance model through Lloyd's of London, which changes the incentive structure behind the audit itself. Put plainly: the auditor has real skin in the game too.
The standard carries weight because of who built it. AIUC-1 was developed through a consortium of more than 100 Fortune 500 CISOs and security leaders, with technical contributors from Stanford's Trustworthy AI Research Lab, MIT, MITRE, Cisco, Google Cloud, and the Cloud Security Alliance, among others. That combination of enterprise security leadership and academic AI safety research is part of why the standard has moved quickly from launch to adoption.
The six domains AIUC-1 tests
AIUC-1 organizes its requirements into six domains. Think of them as six different report cards an agent has to pass, each grading something a little different.
- Data & Privacy covers what data an agent can access and how it handles that access: preventing cross-customer data exposure, PII leakage, and leakage of credentials or secrets.
- Security is the adversarial-resistance domain. It includes third-party testing of adversarial robustness, detecting and filtering malicious input in real time, and preventing what the standard calls unauthorized AI agent actions, cases where an agent takes a step outside its intended scope. This domain is where prompt injection shows up directly: an attack where malicious instructions are hidden inside content an agent processes, tricking it into ignoring its original instructions and following the attacker's instead. It's one of the risk categories mapped in MITRE ATLAS, a knowledge base of real-world adversarial tactics against AI systems, and in the OWASP Top 10 for LLM Applications, a widely referenced list of the most critical security risks in large language model deployments. AIUC-1 builds directly on both.
- Safety covers whether an agent produces harmful, out-of-scope, or otherwise high-risk outputs, and requires third-party testing specifically for these categories.
- Reliability tests for hallucinated outputs and unsafe tool calls, the kind of failure where an agent takes an action it shouldn't have based on a flawed or fabricated premise.
- Accountability is the governance layer: assigning clear human ownership of AI failures, maintaining an AI failure plan for security breaches, harmful outputs, and hallucinations, and documenting vendor due diligence and regulatory compliance.
- Society addresses broader misuse risk, the possibility of an agent being used for cyber exploitation or catastrophic harm at a societal scale.
The rest of this guide zeroes in on Accountability and Safety, since those are the two that matter most. And they both come down to the same thing, who's actually doing the work.
How AIUC-1 differs from ISO 42001
The clearest way to understand AIUC-1 is by contrast with ISO 42001, the international standard for AI management systems. ISO 42001 asks whether your organization has the right policies, risk assessments, and governance structure in place, a management-system audit, similar in spirit to ISO 27001 for information security. It's a solid check on an organization's paperwork. ISO 42001 was never built to answer a different question: would this specific AI agent actually resist a jailbreak attempt, or leak customer data the moment someone applies real pressure?
AIUC-1 fills that gap by testing agent behavior directly, running technical evaluations against the live system and repeating them every quarter, on top of the annual audit. The two standards work well together. A company holding both ISO 42001 and AIUC-1 can show two different things at once: how it manages AI risk on paper, and how the AI actually holds up under pressure. Holding one without the other leaves a real gap, and increasingly, enterprise buyers and regulators are starting to notice and ask for both. For more on how these frameworks sit alongside broader regulatory obligations, see our guides to the EU AI Act and US AI regulations.
What the certification actually involves
AIUC-1 certification typically runs four to eight weeks, depending on how mature an organization's existing AI governance already is. The process moves through four phases:
- Scoping and kickoff, where the specific agent, tools, and data flows under review get defined
- Evidence collection across legal, operational, and technical documentation
- Technical testing for hallucinations, unsafe tool calls, and adversarial attacks
- Final audit, combining everything into a certificate, a full audit report, and a badge companies can display to enterprise buyers
Two companies have already been through this, and their results make the stakes pretty concrete. Cursor, the AI coding assistant, became AIUC-1 certified after its agents went through thousands of technical evaluations across a dozen risk categories, including requirements written specifically for coding-agent risk. Harvey, built for legal teams, became the first legal AI company certified under AIUC-1 after its agentic platform passed more than 3,000 evaluations covering the specific risks legal professionals care about most, an appropriate bar given how little room legal work leaves for error.
AIUC-1 is already branching out into specific industries, starting with finance. AIUC and the Cyber Risk Institute (CRI), the financial sector's cybersecurity standards body, recently announced a collaboration to strengthen AI security specifically for financial institutions, preparing banks and other regulated firms for what's coming as agentic tools move deeper into financial workflows.
Why the Accountability and Safety domains put people at the center
This is where AIUC-1 stops being a purely technical framework and starts being a staffing question.
The Accountability domain requires assigning clear human ownership of AI failures. You can't satisfy this one with an org chart update and a name in a box. Someone has to actually be qualified to sit in that seat: to understand what a security breach, a harmful output, or a hallucination looks like in the specific operational context the agent runs in, and to own the failure plan that responds to it. An accountability structure with the wrong person named on it is a compliance gap wearing the appearance of a control. Our guide to AI governance breaks down the broader ownership and auditability pillars this domain sits inside.
The Safety domain goes further and requires third-party testing specifically for harmful outputs, and generic testing won't cut it here. Evaluating whether a clinical AI agent's recommendation is dangerous takes someone who actually understands clinical reasoning. Same story on the legal side: judging whether a legal AI agent's output creates liability takes someone fluent in that legal domain. A red teamer without that context can confirm an agent avoids obviously bad outputs, but can't reliably catch the subtler failures that only look wrong to someone who knows the operational territory.
Put together, these two domains turn AIUC-1 compliance into a people problem as much as a technical one. It requires credentialed people with real domain expertise: someone qualified enough to own accountability for an agent's failures, and domain experts qualified enough to red-team it against the operational risks specific to your industry.
Frequently asked questions
What is AIUC-1?
AIUC-1 is the world's first certification standard built specifically for AI agents. Created by the Artificial Intelligence Underwriting Company, it combines an audit of organizational controls with adversarial technical testing of the agent itself, across six domains: Data & Privacy, Security, Safety, Reliability, Accountability, and Society. It's backed by an insurance model through Lloyd's of London and refreshed quarterly.
How does AIUC-1 differ from ISO 42001?
ISO 42001 audits an organization's AI management system: its policies, risk assessments, and governance structure. AIUC-1 tests the actual behavior of a specific AI agent through adversarial scenarios, repeated every quarter. The two work together well. Holding both means you can demonstrate governance and technical validation at the same time.
What does AIUC-1 certification involve?
Certification runs roughly four to eight weeks through four phases: scoping the specific agent and data flows under review, collecting legal and operational evidence, running technical testing for hallucinations and adversarial attacks, and finalizing an audit report. Certified companies receive a certificate, a full audit report, and a badge, and must undergo technical retesting quarterly to maintain certification.
Who needs AIUC-1?
Organizations building or deploying agentic AI in high-risk use cases need AIUC-1 most: customer-facing agents where brand reputation is on the line, agents with access to confidential data, and agents handling critical workflows in regulated industries like legal, healthcare, and financial services. It's also increasingly relevant for any company that needs to demonstrate AI security to enterprise customers, boards, or regulators during procurement or due diligence. Right now, AIUC-1 is a voluntary, market-driven standard; no jurisdiction requires it by law. That's actually similar to how SOC 2 became a de facto requirement: enterprise procurement demanded it long before any regulation did. Its crosswalks to the EU AI Act and emerging US state laws make it useful for demonstrating regulatory readiness, even though certification itself remains voluntary.
What is prompt injection and why does AIUC-1 test for it?
Prompt injection is an attack where malicious instructions are hidden inside content an AI agent processes, tricking the agent into following the attacker's instructions instead of its intended ones. AIUC-1 tests for it directly under its Security domain because agents that call tools, access data, and take autonomous actions create a much larger attack surface for this kind of manipulation than a standard chatbot does.
What this means for your AI agent program
AIUC-1 changes what actually gets asked about AI agent risk. It's no longer just what's written down. It's what's actually been tested under pressure. Meeting its Accountability and Safety requirements starts with having the right qualified people in place.
Book a discovery call to talk about how PowerToFly's domain-expert network supports the human accountability and third-party evaluation requirements that AIUC-1 demands.
