AIUC-1 readiness and implementation for the AI agents you sell

What AIUC-1 is, as of the Q4 2026 release

AIUC-1 is a certification standard for a specific AI agent: the product a customer actually deploys, with its model, tools, data and guardrails. It was published in July 2025 by the Artificial Intelligence Underwriting Company (AIUC) with contributors from Stanford, MITRE and industry. AIUC is an AI insurance company as well as the standard's owner: it certifies, audits and insures AI agents, and the first AIUC-1-backed insurance policy for AI voice agents went live in February 2026. Where ISO 42001 certifies an organisation's AI management system, AIUC-1 certifies one agent, and a company with three agents has three scopes.

Certification has two halves. An AIUC-accredited auditor examines governance and controls against the requirements. An accredited testing body runs adversarial technical testing against the agent itself: jailbreak attempts, red teaming and the other attack patterns the standard defines. AIUC's certification committee issues the AIUC-1 certification, which runs for 12 months with technical retesting every quarter and annual recertification after that.

The standard changes every quarter, with releases on 15 January, 15 April, 15 July and 15 October. This page describes the Q4 2026 release, published 15 October 2026, which added 5 requirements and 5 controls, retired 3 requirements and leaves 50 requirements in force. The Q3 2026 release before it updated 8 requirements and 41 controls. Earlier in 2026 the Q2 release added MCP and agent identity controls: agents may connect only to approved MCP servers, MCP server execution is sandboxed, and each agent needs a unique, cryptographically verifiable identity. A gap assessment is only useful if it is dated to a release, so ours always is.

Read the AIUC-1 changelog

The six risk categories

A. Data and privacy

How the agent handles personal and customer data, retention, training use and disclosure.

B. Security

Prompt injection, tool and connector permissions, secrets, access and incident handling.

C. Safety

Harmful outputs, misuse, guardrails and third-party adversarial testing.

D. Reliability

Hallucination controls, failure modes, monitoring and fallbacks.

E. Accountability

Ownership, human oversight, logging, change control and customer transparency.

F. Society

Wider harms, fairness and obligations beyond the direct customer.

What the last two releases changed

• Q3 2026: controls updated: 41
• Q3 2026: requirements updated: 8
• Q4 2026: requirements added: 5
• Q4 2026: controls added: 5
• Q4 2026: requirements retired: 3

Source: AIUC-1 changelog and the Q4 2026 release note, read 30 October 2026. Counts are as AIUC publishes them.

The 2026 release cycle

• 15 January 2026, Q1 2026: Voice-agent requirements added.
• 15 April 2026, Q2 2026: Agent protocol security and agent identity controls.
• 15 July 2026, Q3 2026: 8 requirements and 41 controls updated.
• 15 October 2026, Q4 2026: 5 requirements and 5 controls added; 3 requirements retired. Open-weight model controls and stronger third-party testing.
• 15 January 2027, Q1 2027: Next scheduled release.

Who is being asked for AIUC-1

No Australian law names AIUC-1. The pressure is commercial. Companies that sell an AI agent to enterprise customers, and above all to US customers, are finding the question in security questionnaires and procurement checklists next to SOC 2 and ISO 27001, usually under AI agent security or agentic AI security, and increasingly as a request for AI agent certification. The buyer wants to know that someone independent has examined the agent's controls and tried to break it, not just that the vendor has an AI policy. AI agent compliance, in practice, means being able to answer that question with evidence.

The second driver arrived on 19 October 2026, when the AICPA and AIUC announced a joint offering that pairs a SOC 2 report with AIUC-1 certification in one CPA-led engagement. The CPA firm performs the SOC 2 and AIUC-1 engagement and issues the report; AIUC or an accredited technical evaluation body performs the quarterly technical testing. It is being piloted at several CPA firms with full launch planned for early 2027. For a vendor that already holds SOC 2, that is the shortest path, and our SOC 2 readiness and AIUC-1 readiness are scoped to fit it. Either way, AI agent governance has to exist before the audit does: named owners, change control and human oversight that someone can evidence.

Where are you starting from?

No certification yet

Start with the agent boundary and the buyer's exact question. AIUC-1 readiness builds the governance evidence and the agent-level controls together; if the buyer also wants SOC 2, the joint AICPA and AIUC route covers both in one engagement.

We hold SOC 2

Your Trust Services Criteria controls cover much of the organisational side. Readiness concentrates on the agent-specific requirements and the adversarial testing, and we scope it to the joint SOC 2 plus AIUC-1 engagement your CPA firm can now offer.

We hold ISO 42001

Your AI management system supplies most of the governance evidence. AIUC-1 adds agent-level controls and mandatory third-party testing that ISO 42001 does not require. Readiness maps your AIMS records to the AIUC-1 requirements and fills the gaps.

We hold both

You are closest. Readiness is a dated gap assessment against the current release, the agent-specific evidence and test preparation, then handover. Weeks, not months, for a bounded agent.

AIUC-1 vs ISO 42001: different questions about one agent

AIUC publishes an official crosswalk to ISO 42001 and a reverse mapping from ISO 42001 controls to AIUC-1 requirements, and it says AIUC-1 incorporates most ISO 42001 controls and adds third-party testing. The two are complementary. The table shows where they differ.

AIUC also publishes crosswalks to the NIST AI RMF, the EU AI Act, OWASP and MITRE ATLAS, and to SOC 2. If you hold or are building ISO 42001, the crosswalk is where readiness starts.

ISO 42001 implementation · SOC 2 readiness

Readiness, from the current release to the auditor's opening meeting

Five pieces of work, each with a named owner and a written scope. Together they take an agent from an unassessed state to one an accredited auditor can examine without discovering the gaps for you.

Gap assessment against the current release

We assess the agent, its tooling and the organisation around it against every requirement of the Q4 2026 release and record the result requirement by requirement, dated to the release. You get a prioritised list with owners, not a score.

Policy and ownership

AIUC-1 expects named accountability: who owns the agent, who approves changes, who answers for an incident. We draft or tailor the policies, procedures and ownership records the requirements call for, inside your own document system.

Evidence pack

Each requirement gets a control, an owner and evidence of what actually happens: logs, access reviews, test records, change approvals, data-handling records. We build the pack in the order an auditor samples it.

Crosswalk to what you already hold

If you hold ISO 42001, SOC 2, ISO 27001 or a NIST AI RMF profile, we map that evidence to the AIUC-1 requirements using AIUC's published crosswalks, so nothing is built twice and the gaps are real gaps.

Test readiness and auditor handover

We prepare the agent and the team for the adversarial technical testing an accredited body will run, then hand the readiness outputs to the accredited auditor you appoint and attend the opening meeting where the scope includes it.

Aegentra prepares. Accredited third parties certify.

Aegentra does not certify against AIUC-1, does not audit for AIUC, does not run the accredited adversarial testing and holds no AIUC accreditation. Only AIUC accredits auditors, and only AIUC issues certificates. You appoint the accredited auditor; we work to their information requests and hand over the readiness outputs.

The firms below are the accredited auditors AIUC lists, as read on 30 October 2026. They are independent third parties with no relationship to Aegentra. Accreditation is earned through a witness audit, so provisional firms are completing that step. Check AIUC's own register before appointing one, because the list changes.

AIUC-accredited auditors

Check AIUC’s accredited-auditor register

Readiness: Aegentra

Gap assessment, policies, evidence pack, crosswalk, handover.

Controls: Your organisation

Owns and operates the agent and its controls.

Audit: AIUC-accredited auditor

Examines governance and controls; reports to AIUC.

Testing: Accredited testing body

Adversarial technical testing, then quarterly retests.

Certificate: AIUC certification committee

Issues the certificate for 12 months.

Decision: Your customer

Decides whether the certificate answers its question.

Four named steps, then the auditor takes over

Step through what happens. The engagement is sized for weeks, not months, for a bounded agent with existing security controls. Audit and testing dates belong to the auditor and the testing body.

Scope the agent

Decide exactly what is being certified

AIUC-1 certifies an agent, so the first job is the boundary: which product, which model, which tools and connectors, which data, which guardrails, and which buyer question it has to answer. The written scope names the accountable lead and records responsibilities, assumptions and exclusions.

• One agent, one scope. Shared platforms are recorded once and referenced.
• The buyer's exact requirement decides whether the joint SOC 2 plus AIUC-1 route fits.

Flow: The agent as sold → Model, tools, data, guardrails → One written scope

Assess against the release

Every requirement of the Q4 2026 release, recorded

We walk the agent and the organisation through each requirement and its controls, reuse evidence you already hold through the published crosswalks, and record a dated gap list with an owner and a priority against each line.

• Evidence from ISO 42001, SOC 2 or ISO 27001 is mapped, not rebuilt.
• The assessment is dated to the release so the next quarterly change is a delta, not a restart.

Flow: Q4 2026 requirements → Existing evidence → Dated gap list with owners

Build and evidence

Close the gaps and prove the controls operate

Policies, ownership records and procedures are drafted or tailored inside your own systems. Your team operates the controls; we organise the evidence in the order an auditor samples it and prepare the agent and the team for adversarial testing.

• Engineering changes to the agent are your team's or a separately scoped Aegentra service.
• Test readiness means knowing what the testing body will try, and having the logs to show what happened.

Flow: Policies and ownership → Controls operating → Evidence pack

Hand over

The accredited auditor and testing body take it from here

We hand the readiness outputs to the auditor you appoint and attend the opening meeting where the scope includes it. The auditor examines, the testing body tests, and AIUC's certification committee decides. None of that is Aegentra's to promise.

• Quarterly retesting and the 12-month renewal are separately scoped if you want support through them.
• Findings are represented accurately; fixing a problem does not erase how it is reported.

Flow: Readiness outputs → Accredited auditor, outside Aegentra → Accredited testing, outside Aegentra → AIUC certificate

For a bounded agent with existing security controls, readiness is usually a matter of weeks. Scheduling the audit and the adversarial testing is the auditor's and the testing body's, and we do not promise a certificate date before those dependencies are known.

AIUC-1 readiness questions

What is AIUC-1 and who issues the certificate?

AIUC-1 is a certification standard for a specific AI agent, published by the Artificial Intelligence Underwriting Company in July 2025 and updated every quarter. Requirements sit in six risk categories: data and privacy, security, safety, reliability, accountability and society. An AIUC-accredited auditor examines governance and controls, an accredited testing body runs adversarial testing against the agent, and AIUC's certification committee issues the certificate, which runs 12 months with quarterly retesting.

Does Aegentra certify or audit against AIUC-1?

No. Aegentra provides readiness, implementation and quarterly upkeep. We do not certify, do not audit for AIUC, do not run the accredited adversarial testing and hold no AIUC accreditation. You appoint an accredited auditor from AIUC's register; we hand over the readiness outputs and can attend the opening meeting where the scope includes it.

Can Aegentra implement AIUC-1 controls, not just assess them?

Yes. Aegentra builds and evidences the governance controls, specifies the technical controls with your engineers, and arranges the adversarial testing with an accredited testing body. Your engineers make the changes to the agent itself, and an AIUC-accredited auditor and AIUC decide certification. Aegentra never certifies.

What does AIUC-1 readiness and implementation cost?

A readiness assessment is from A$6,500 + GST per agent for the bounded scope described on this page. Implementation is from A$18,000 + GST per agent. Quarterly upkeep, which keeps the evidence and controls current through each quarterly release and retest, is A$2,500 + GST per quarter. Each fixed fee follows a scoping call. The accredited audit, the adversarial technical testing, the certificate and engineering changes to the agent are separate costs.

What does "per agent" mean?

AIUC-1 certifies an agent, not a company. Each distinct agent, with its own purpose, model, tools and data boundary, is its own scope and its own certificate. Two agents that share a platform are quoted together after scoping, because much of the evidence is shared.

How long does AIUC-1 readiness take?

It depends on how bounded the agent is, what evidence already exists and which release is in force. For a bounded agent with existing security controls, readiness is usually weeks rather than months. Audit and testing dates are set by the accredited auditor and testing body, so we do not promise a certificate date.

We already hold ISO 42001 or SOC 2. How much carries over?

A lot of the governance evidence, once its scope is checked against the agent. AIUC publishes crosswalks to ISO 42001, SOC 2 and the NIST AI RMF, and we map your existing evidence through them. AIUC-1 then adds agent-specific controls and mandatory adversarial testing that neither standard supplies. SOC 2 holders can also use the joint SOC 2 plus AIUC-1 engagement the AICPA and AIUC announced on 19 October 2026.

Which release do you assess against, and what happens when it changes?

The release named on this page, currently Q4 2026, published 15 October 2026. AIUC-1 changes every quarter, on 15 January, 15 April, 15 July and 15 October. Our gap assessment is dated to a release, and the handover notes which requirements changed since, so a new release is a delta to work through rather than a restart.

Do Australian companies need AIUC-1?

No Australian law requires it. Demand comes from enterprise and US buyers writing it into procurement and security questionnaires. If your agent sells into those buyers, readiness is cheaper before the questionnaire arrives than after a deal stalls on it. If it does not, ISO 42001 may be the better first step, and we will say so.

Tell us about the agent

Share what the agent does, who buys it, what the buyer has asked for and which certifications you already hold. We will reply with the right scope and the information needed for a written proposal.