AIUC-1 AI Agent Certification Standard

Publish a policy that says how customer input data is used for training and inference, how long it is kept, and what rights customers have over it.

A001 — Establish input data policy (A. Data & Privacy) · Read the full page →

Publish a policy stating who owns the agent's outputs, how they may be used, and how a customer opts out of their reuse or has them deleted.

A002 — Establish output data policy (A. Data & Privacy) · Read the full page →

Restrict what data an agent can reach to what the current task, the calling user's role and the operating context actually require.

A003 — Limit AI agent data access (A. Data & Privacy) · Read the full page →

Stop the agent from disclosing the organisation's own proprietary information or trade secrets in its outputs.

A004 — Protect IP & trade secrets (A. Data & Privacy) · Read the full page →

Keep each customer's data isolated so one tenant's data can never surface in another tenant's session.

A005 — Prevent cross-customer data exposure (A. Data & Privacy) · Read the full page →

Stop personal identifiers from escaping through the agent's responses, its logs or its telemetry.

A006 — Prevent PII leakage (A. Data & Privacy) · Read the full page →

Keep the agent's outputs from infringing third-party copyright, trademarks or other intellectual property.

A007 — Prevent IP violations (A. Data & Privacy) · Read the full page →

Detect and block credentials, API keys and other secrets moving through the agent's inputs, outputs, logs or stored context.

A008 — Prevent leakage of credentials and secrets (A. Data & Privacy) · Read the full page →

Have an independent assessor test the agent's resistance to prompt injection and other adversarial input on a quarterly cycle, against a stated threat taxonomy.

B001 — Third-party testing of adversarial robustness (B. Security) · Read the full page →

Monitor live traffic for prompt-injection and other adversarial input, and respond when it is detected.

B002 — Detect adversarial input (B. Security) · Read the full page →

Put an approval step in front of public disclosure of AI system internals that would help an attacker.

B003 — Manage public release of technical details (B. Security) · Read the full page →

Block bulk probing and extraction against externally reachable AI endpoints.

B004 — Prevent AI endpoint scraping (B. Security) · Read the full page →

Filter harmful or injected prompts with automated moderation before they reach the model.

B005 — Implement real-time input filtering (B. Security) · Read the full page →

Constrain the agent to the systems and actions it is authorised for, and alert when it tries to step outside them.

B006 — Prevent unauthorized AI agent actions (B. Security) · Read the full page →

Apply role- or attribute-based access control to AI system resources and review the entitlements quarterly.

B007 — Enforce user access privileges to AI systems (B. Security) · Read the full page →

Secure the environment the model runs in: authenticated interfaces, encrypted transport, verified artefacts and hardened infrastructure.

B008 — Protect AI system deployment environment (B. Security) · Read the full page →

Cap and coarsen what a single response can reveal so the agent cannot be used to drain a dataset one answer at a time.

B009 — Limit output over-exposure (B. Security) · Read the full page →

Make the code the agent generates secure by default across the common vulnerability classes.

B010 — Promote secure patterns in generated code (B. Security) · Read the full page →

Maintain a documented taxonomy of the risk categories the agent can produce, with severity levels tied to what the system actually does and where it is deployed.

C001 — Define AI risk taxonomy (C. Safety) · Read the full page →

Test the agent internally before it goes live, record what the tests found, and get a named sign-off on the residual issues.

C002 — Conduct pre-deployment testing (C. Safety) · Read the full page →

Detect and block offensive, biased, deceptive or distressing output across every modality the agent produces.

C003 — Prevent harmful outputs (C. Safety) · Read the full page →

Keep the agent inside its intended subject boundary and block answers outside it, such as medical, legal or political advice from a support agent.

C004 — Prevent out-of-scope outputs (C. Safety) · Read the full page →

Block the high-risk outputs specific to this deployment, as named in the organisation's own risk taxonomy, with filtering, escalation and automated response.

C005 — Prevent agent-specific high risk outputs (C. Safety) · Read the full page →

Neutralise security flaws carried inside generated output — injected markup, scripts or commands — before it reaches a user or a downstream system.

C006 — Prevent output vulnerabilities (C. Safety) · Read the full page →

Route outputs the system judges high-risk to a human before they reach the user.

C007 — Flag high risk outputs for human review (C. Safety) · Read the full page →

Monitor live output continuously against the defined risk categories, using logging, dashboards and sampling.

C008 — Monitor AI risk categories (C. Safety) · Read the full page →

Give users an accessible way to report a problem and to interrupt the agent mid-interaction, and act on what they report.

C009 — Enable real-time feedback and intervention (C. Safety) · Read the full page →

Have an independent assessor evaluate the agent quarterly for toxic, biased, offensive or deceptive output.

C010 — Third-party testing for harmful outputs (C. Safety) · Read the full page →

Have an independent assessor test quarterly whether the agent answers outside its declared scope.

C011 — Third-party testing for out-of-scope outputs (C. Safety) · Read the full page →

Have an independent assessor test quarterly against the deployment-specific high-risk categories the organisation itself defined.

C012 — Third-party testing for customer-defined risk (C. Safety) · Read the full page →

Use technical controls to reduce factually unsupported output — grounding, source attribution and honest confidence signalling.

D001 — Prevent hallucinated outputs (D. Reliability) · Read the full page →

Have an independent assessor measure the agent's hallucination rate quarterly with a documented methodology.

D002 — Third-party testing for hallucinations (D. Reliability) · Read the full page →

Stop the agent's tool calls from acting outside authorised scope, reaching restricted data or taking unintended actions.

D003 — Restrict unsafe tool calls (D. Reliability) · Read the full page →

Have an independent assessor test quarterly whether tool selection stays in scope and unauthorised actions are actually refused.

D004 — Third-party testing of tool calls (D. Reliability) · Read the full page →

Keep a documented plan for AI-related security breaches: who leads, who is notified, how it is contained and how evidence is preserved.

E001 — AI failure plan for security breaches (E. Accountability) · Read the full page →

Keep a documented plan for when the agent causes material harm through its output: who owns the response and how remediation is coordinated.

E002 — AI failure plan for harmful outputs (E. Accountability) · Read the full page →

Keep a documented plan for hallucination incidents that cost a customer money, covering mitigation, communication and external coordination.

E003 — AI failure plan for hallucinations (E. Accountability) · Read the full page →

Name the people accountable for AI system changes across development and deployment, and record the approvals they give.

E004 — Assign accountability (E. Accountability) · Read the full page →

Document how AI data is stored and secured, including the reasoning behind the cloud-versus-on-premises choice.

E005 — Document data storage security (E. Accountability) · Read the full page →

Assess foundation-model and upstream AI providers on their data handling, security and compliance posture before engaging them, and record the decision.

E006 — Conduct vendor due diligence (E. Accountability) · Read the full page →

Review the organisation's own AI decision processes on a regular cycle and keep the records of those reviews and their approvals.

E008 — Review internal processes (E. Accountability) · Read the full page →

Log and monitor third-party API connections, sessions and data access, with anomaly detection over the access pattern.

E009 — Monitor third-party access (E. Accountability) · Read the full page →

Publish an acceptable-use policy for the AI system, detect breaches of it, and tell users when they have breached it.

E010 — Establish AI acceptable use policy (E. Accountability) · Read the full page →

Keep a record of every geography where AI processing happens, including the foundation-model provider's and every sub-processor's infrastructure.

E011 — Record processing locations (E. Accountability) · Read the full page →

Maintain and review documentation identifying which AI and data-protection rules apply to the deployment and how each is addressed.

E012 — Document regulatory compliance (E. Accountability) · Read the full page →

Run a quality management system proportionate to the system's risk, covering objectives, risk methodology, change control, improvement and stakeholder communication.

E013 — Implement quality management system (E. Accountability) · Read the full page →

Log the agent's processing, actions and outputs — including execution chains, tool calls and delegations — well enough to investigate an incident afterwards.

E015 — Log AI system activity (E. Accountability) · Read the full page →

Make it clear to users that they are dealing with an AI system rather than a person.

E016 — Implement AI disclosure mechanisms (E. Accountability) · Read the full page →

Keep documentation — model cards, datasheets, interpretability notes — describing each major AI system's characteristics, data provenance and behaviour.

E017 — Document system transparency policy (E. Accountability) · Read the full page →

Prevent the agent from being used to build or run cyber attacks.

F001 — Prevent AI cyber misuse (F. Society) · Read the full page →

Detect and prevent use of the agent to assist with weapons of mass destruction or other catastrophic harm.

F002 — Prevent catastrophic misuse (F. Society) · Read the full page →