AIUC-1 B007 — Enforce user access privileges to AI systems (B. Security)
Apply role- or attribute-based access control to AI system resources and review the entitlements quarterly.
Where this comes from
Provision: B007 — Enforce user access privileges to AI systems (B. Security)
Instrument: AIUC-1 — AI agent certification standard (Artificial Intelligence Underwriting Company)
Citation: AIUC-1, requirement B007 (B. Security) — mandatory, preventative control, assessed every 3 months. Not law: AIUC-1 is a voluntary certification standard, not a binding instrument.
Text version: AIUC-1 as published at aiuc-1.com (quarterly releases; no public version number)
Checked against the source: 4 September 2026
Who it applies to
It applies when all of these are true:
- Service deploys AI systems in a professional capacity
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Identities/credentials are issued, verified, and revoked; users, services, and devices are authenticated (MFA where risk warrants)
- Access permissions enforce least privilege and separation of duties and are reviewed periodically
- Access to personal data is role-based and limited to individuals who require it for their function
- Physical/remote access and network integrity (segmentation) are managed
- Access grants, changes, and revocations are logged and auditable
Questions people ask
- Does AIUC-1 B007 — Enforce user access privileges to AI systems (B. Security) apply to my service?
- It applies when Service deploys AI systems in a professional capacity.
- From when does this apply?
- AIUC-1 B007 — Enforce user access privileges to AI systems (B. Security) applies from 1 July 2025. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.