International · Certifiable agent standard
AIUC-1 for AI agents: requirements and evidence
AIUC-1 is a certifiable standard for AI agents, maintained by the Artificial Intelligence Underwriting Company. Its requirements sit under six principles: data and privacy, security, safety, reliability, accountability, and society. It is updated every quarter, on 15 January, April, July and October, and the latest release is dated 15 October 2026. Certification runs through scoping, technical evaluations and an audit by an accredited auditor, is valid for one year, and includes quarterly retests against the version locked at scoping.
In the FairMind catalogue: 50 requirements mapped to 81 workflows.
Source: AIUC-1; AIUC-1 changelog
AIUC-1: what it asks of AI systems
The parts most relevant to governing AI systems and agents, summarised from the AIUC-1 AI agent standard.
- AData & Privacy
- 9 active requirements, A001 to A009. Policies for input and output data, limits on what agents can access, and protection against leaks of personal data, IP and secrets.Mapped to: AI policies, Agent identity, access and permission bounding, Data governance and provenance, Evaluation and testing, IP, copyright and liability, Privacy and data residency, Release, change and retirement, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities
- BSecurity
- 10 active requirements, B001 to B010. Adversarial testing, input filtering, access control, and prevention of unauthorised agent actions.Mapped to: AI inventory and intake, Agent identity, access and permission bounding, Evaluation and testing, FairMind agent self-assurance, Monitoring and logging, Responsible design and secure development, Threat modelling, guardrails and vulnerabilities, Transparency and disclosure
- CSafety
- 10 active requirements, C001 to C010. A risk taxonomy, pre-deployment testing, and controls against harmful, out-of-scope and high-risk outputs.Mapped to: AI inventory and intake, Agent identity, access and permission bounding, Bias and fairness, Data governance and provenance, Evaluation and testing, Human oversight and intervention, Incidents, concerns and reporting, Monitoring and logging, Prohibited, manipulative and misuse risks, Release, change and retirement, Responsible design and secure development, Risk criteria, assessment and treatment, Threat modelling, guardrails and vulnerabilities
- DReliability
- 3 active requirements, D001 to D004. Preventing hallucinated outputs and restricting unsafe tool calls, with recurring third-party testing.Mapped to: Accountability and oversight bodies, Agent identity, access and permission bounding, Evaluation and testing, FairMind agent self-assurance
- EAccountability
- 16 active requirements, E001 to E018. Failure plans, named accountability, activity logs, vendor due diligence, disclosure and regulatory documentation.Mapped to: AI inventory and intake, AI policies, Accountability and oversight bodies, Data governance and provenance, Documented information, Evaluation and testing, FairMind agent self-assurance, Human oversight and intervention, IP, copyright and liability, Incidents, concerns and reporting, Management review and internal audit, Monitoring and logging, Privacy and data residency, Regulatory applicability and change, Release, change and retirement, Responsible design and secure development, Third parties and suppliers, Transparency and disclosure
- FSociety
- 2 active requirements, F001 to F002. Preventing cyber and catastrophic misuse of the AI system.Mapped to: AI inventory and intake, Data governance and provenance, Prohibited, manipulative and misuse risks
Evidence FairMind helps you produce
FairMind links technical evidence to AIUC-1 obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- Third-party testing records for each principle, scheduled every quarter
- Agent permission bounding and access review records for unauthorised-action requirements
- AI incident response plans and serious incident records for the failure-plan requirements
- Vendor and model due diligence, AI policies and change approvals with named owners
AIUC-1 questions
Can FairMind certify my agent against AIUC-1?
No. Certification comes from an accredited auditor through the AIUC-1 process. FairMind produces and organises the evidence that audit reviews, and records which person approved each piece.
Which AIUC-1 release does FairMind map?
The 15 October 2026 release, with 50 active requirements. Retired requirements stay in the catalogue as history. Because AIUC-1 changes every quarter, confirm which release your certification is scoped to.
How does AIUC-1 relate to the OWASP Agentic Top 10?
OWASP describes the risks; AIUC-1 turns agent risks into requirements an auditor can test. FairMind maps both to the same common controls, so one workflow run can count toward each.