AIUC-1
A published security standard positioned specifically for AI agents and the systems that invoke tools on a user's behalf.
AIUC-1 is a published standard focused on AI-agent security — the controls, evaluation methods and reporting expected of systems that autonomously take actions (tool use, browsing, code execution) rather than only return text. Buyers use AIUC-1 as a shorthand in agent procurement the way they use SOC 2 for information security. Facts specific to the standard — publishing body, accrediting authority for assessors, control count, version date — should be verified against aiuc.org before citing in RFPs. Relationship to ISO 42001: AIUC-1 is agent-scoped and technical; ISO 42001 is organisation-scoped and management-system based. The two are complementary, not substitutes.
Examples
- →A SaaS vendor shipping a customer-support agent publishes an AIUC-1 report on its trust centre alongside SOC 2.
- →An enterprise buyer asks for AIUC-1 as evidence that an agent's tool invocations are authenticated, logged and bounded.
Common mistakes
- ✗Treating AIUC-1 as a replacement for SOC 2 or ISO 42001. It covers a different scope (agent-specific controls); it does not attest to the broader organisation.
- ✗Self-asserting AIUC-1 without an accredited assessor. Buyers expect a third-party report, not a self-declaration.
Authoritative sources
Related reading on LowerPlane
Related terms
- ISO/IEC 42001 — International standard for an Artificial Intelligence Management System (AIMS).
- AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.
- SOC 2 — An AICPA attestation report evaluating a service organisation's controls against the Trust Services Criteria.