Short Answer
AIUC-1 is an emerging security standard scoped to AI agents — systems that take actions on a user's behalf. It attests that a specific agent product meets agent-security controls around identity, tool scope, action approval, logging and adversarial input handling. It is complementary to SOC 2 and ISO 42001, not a replacement.
Enterprise buyers of AI agents have the same problem they had with SaaS in 2015: no shared standard to point at. The vendor says "we're secure"; the buyer has no framework to evaluate "compared to what?" AIUC-1 is the emerging answer for the agent subset of the AI vendor market.
This piece covers the agent-security control surface AIUC-1 addresses, who signs an assessment, and how it fits alongside ISO 42001 and SOC 2. Anything standard-specific — the exact section names, current version, published assessor directory — is worth checking on the AIUC site before citing in a procurement response; this piece reflects what practitioners discuss publicly as of early November 2026.
What AIUC-1 Covers
Agents introduce a control surface a chatbot does not: tool invocations, autonomous decisions, cost blast radius, prompt-injection vectors. AIUC-1 is organised around that surface.
Agent authentication and identity
How the agent proves its identity when it acts — API keys, mTLS, OAuth, agent-specific identity. Who the agent represents (end-user vs system actor) and how that's recorded in audit logs.
Tool-scope boundaries
The set of tools the agent is authorised to invoke, with explicit allow-listing. Preventing the agent from exfiltrating via unlisted tools or escalating through tool chaining.
Action authorisation and human-in-the-loop
Which actions require human approval before execution. Risk-based thresholds (dollar value, blast radius, reversibility) and the approval workflow the agent uses.
Output and action logging
What the agent logged — inputs, outputs, every tool invocation with inputs/outputs, and the reasoning trace if captured. Retention and access controls on these logs.
Prompt injection and adversarial input resistance
How the agent handles untrusted inputs (web pages, documents, user uploads). Testing methodology, red-team findings, mitigation layers.
Data minimisation and PII handling
What customer data crosses into the agent's context window. Redaction, retention, deletion on request, vendor DPAs for underlying LLM providers.
Monitoring and incident response
Detection of anomalous agent behaviour, runaway loops, cost spikes. Escalation path when the agent misbehaves and the kill-switch procedure.
The seven themes above describe the agent-security control surface as practitioners structure it in 2026. They are not a direct citation of AIUC-1's section names — see the standard itself for exact structure.
Who Signs an AIUC-1 Report
An attestation standard is only as credible as the body that qualifies the people who sign the reports. Before accepting an AIUC-1 report, a buyer should check three things on the AIUC site:
- •Is the signing firm listed in the AIUC assessor directory? If a public directory exists, verification is a 30-second check.
- •What qualification process did AIUC apply to the firm? Training, exam, apprenticeship — the shape determines how comparable two firms' reports will be.
- •Is there an independent accreditation authority behind AIUC (a national standards body or an ISO-recognised accreditation authority)? This determines whether AIUC-1 is treated as a peer to ISO 42001 or as a private-sector standard that happens to be well-adopted.
Compare with the two anchors every buyer already knows
SOC 2 is signed by a licensed CPA firm — oversight comes from state boards and AICPA peer review. ISO 42001 is signed by a certification body accredited by UKAS, ANAB or an equivalent IAF-member accreditation authority — a chain of trust that goes back to ISO/IEC 17021-1. Where AIUC-1 sits in that landscape is the single question worth asking the vendor before accepting the report.
How AIUC-1 Relates to ISO 42001 and SOC 2
The three standards cover overlapping but distinct slices of what an enterprise buyer actually wants to know:
| Dimension | AIUC-1 | ISO 42001 | SOC 2 |
|---|---|---|---|
| Scope | A specific AI-agent product | The organisation's AI programme | The service organisation's security posture |
| Attestation style | Third-party agent-specific report | Management-system certification (3-year cycle) | AICPA attestation report |
| Report issuer | Assessor listed by AIUC | Accredited certification body | Licensed CPA firm |
| Period covered | Varies by engagement | Continuous under certificate | Type 1 point-in-time or Type 2 operating period |
| Common buyer ask | Vendor shipping an AI agent | AI-adjacent procurement in EU / regulated industries | Baseline for enterprise B2B SaaS |
💡 Practical take
If you sell an AI agent to enterprise, the current defensible stack is: SOC 2 Type 2 (baseline), ISO 42001 if a European or regulated buyer asks, AIUC-1 if the buyer is specifically evaluating your agent's action surface. The three do not overlap enough for any one to substitute for the others.
Should You Pursue AIUC-1?
Yes, if…
- • You ship an AI agent that takes autonomous actions (tool use, browsing, code execution).
- • Enterprise prospects have asked about it by name.
- • You already hold SOC 2 Type 2 and want to differentiate on agent-specific controls.
Probably not, if…
- • Your product is read-only (no autonomous actions). Buyers ask for SOC 2 and sometimes ISO 42001; agent-specific attestation adds little.
- • You're pre-SOC 2. Finish the baseline first; AIUC-1 on top of nothing is not how procurement will read it.
- • Your agent is internal-only (not sold to third parties). The standard is designed for vendor-to-buyer attestation.
Frequently Asked Questions
What is AIUC-1 in one sentence?
AIUC-1 is an emerging security standard scoped to AI agents — the systems that take actions on a user's behalf via tool use, browsing, code execution or other autonomous operations — rather than the broader organisation that hosts them.
Who publishes AIUC-1?
The standard is maintained by AIUC. Before citing it in a procurement response, confirm the current steward, governance model and version on the AIUC official site.
Who signs an AIUC-1 report?
A third-party assessor firm. The right verification step is simple: ask the vendor for the assessor firm name and check whether that firm appears on the current AIUC assessor directory. If AIUC publishes an explicit accreditation path (through a national accreditation body or an in-house qualification programme), the assessor firm should name it on its own site.
How is AIUC-1 different from ISO 42001?
Scope and shape. ISO 42001 is an organisation-wide management-system standard — it attests that the company has governance, risk management and lifecycle controls for AI. AIUC-1 is agent-specific and technical — it attests that a particular AI-agent product meets a set of agent-security controls. They are complementary: a mature AI vendor can hold ISO 42001 at the organisation level and AIUC-1 at the agent-product level.
Does AIUC-1 replace SOC 2?
No. SOC 2 attests to information-security controls at the service organisation. AIUC-1 attests to agent-specific controls on a particular product. Enterprise buyers typically expect SOC 2 Type 2 as a baseline; AIUC-1 sits on top when the product is an AI agent.
Can we self-attest AIUC-1?
Not in a way that carries procurement weight. Enterprise buyers asking for AIUC-1 expect a third-party assessment, not a vendor-authored claim. Confirm the current assessor requirements with AIUC before engaging a firm.
How long does an AIUC-1 assessment take?
Depends on the assessor and the scope of the agent product. Request quotes from two or three firms listed on the AIUC assessor directory. For analogous agent-scoped engagements in the broader market, 4–12 weeks is typical — confirm with each assessor directly.
Shipping an AI agent? Start with the baseline.
LowerPlane runs SOC 2, ISO 42001 and the AI-agent control pack on one platform. Book a 20-minute call to scope the right stack for your buyer.
Book a Demo