AIUC-1 certification cost: no price is published

Read it as preparation for a scoping call. The last section lists what to bring.

The three things AIUC says set the price

AIUC names three factors that set what certification costs for a given agent.² None of them is headcount or revenue. All three describe the agent.

Agent complexity

How many use cases and workflows the agent handles.

Capabilities and blast radius

What the agent can reach, and what it can change or act on.

Technical setup

How easily AIUC can reach the agent to test it: through an API and a sandbox, or only through its user interface.

Complexity and blast radius move the price because they move the testing. Each use case, tool and data store widens what the evaluations have to cover. Capabilities also decide scope: a mandatory requirement leaves scope only when the agent genuinely lacks the capability it covers, and never to save effort.³ You cannot trim the price by trimming requirements. You change it by changing what the agent can do.

Technical setup is the factor you control most directly. An agent AIUC can reach through an API and a sandbox with realistic data is faster to test. One reachable only through its user interface needs more manual work, which often costs more.⁴

Two fees, billed separately

AIUC calculates and bills its fee separately from the audit firm, and the firm prices its own engagement.² So expect two quotes and two invoices for one certificate. Here is what each side delivers.

A joint SOC 2 and AIUC-1 engagement adds a third line: the SOC 2 examination, which the CPA firm leading the engagement performs.¹ That one has its own cost logic, and what SOC 2 actually costs breaks it down line by line.

The work on your side

The fees are only part of the cost. The rest is your team’s time, and the evidence list shows where it goes.⁶ Across the 50 active requirements, AIUC lists 140 evidence items in four categories.

Technical implementation, 91 items

Engineering time. Changes to code and configuration, and the proof that each one works.

Operational practices, 32 items

Owner time. Records that a process actually ran: reviews, approvals, training and the like.

Legal policies, 12 items

Founder or counsel time. Written policies, and the contract terms that back them.

Third-party evals, 5 items

Mostly the testers’ time. Your part is giving them access to the agent, then fixing what they find.

Two pieces of that time belong on the calendar from day one. The first is access. Before Round 1, AIUC needs to reach the agent, ideally through an API and a sandbox with realistic data, and setting that up is engineering work.⁴ The second is the remediation window. Weeks 5 to 6 from kickoff are for fixing every P0 and P1 finding from Round 1, and Round 2 in weeks 7 to 8 runs only if Round 1 found one. Name the engineer who owns that window before kickoff.

One more line item is the platform the evidence lives on. AIUC names Drata, Vanta, Fieldguide and the auditor's own platform as homes for the shared evidence pack the auditor reads.⁷ If your SOC 2 evidence already sits on one of them, put the AIUC-1 pack beside it rather than paying for a second home.

A SOC 2 shortens the list. 45 of the 50 active requirements map to at least one SOC 2 point,⁸ which means related evidence you can reuse and extend. The SOC 2 overlap shows which domains it reaches.

What keeps costing after the first certificate

The first certificate is not the last bill. It is valid for 12 months, and keeping it means three recurring lines.⁹ Here is the first year, month by month.

Technical evaluations, again

AIUC runs the evals at least every 3 months while the certificate is live. Each run can raise a finding to fix, so the remediation time recurs with it.

The annual re-audit

An accredited auditor audits the controls again, starting about two months before the certificate expires. AIUC describes it as much lighter than the first audit, and you can keep the same firm or choose a new one.

Standard releases

AIUC publishes a new version every quarter, on January 15, April 15, July 15 and October 15, with up to 30 days of grace.¹⁰ Each one is something to read and map to your controls.

One rule caps the release cost during an audit. The version of the standard is fixed at kickoff for the engagement, so a release does not move the target mid-audit.³ Between audits it does. If you also hold a SOC 2, both renew every year, which is how the October 19, 2026 announcement describes the joint engagement.¹

How to get a real number

Ask for one. Scoping is where AIUC and an accredited auditor price your agent, so arrive with what they will ask about. This list follows the three factors above.

• A short description of the agent: what it does, who uses it, and which product it sits in.
• Every use case and workflow it handles.
• Every tool, API, data store and credential it can reach, and what it can change.
• How AIUC can reach it: an API and a sandbox with realistic data, or only the user interface.
• Whether you build the agent, deploy it, or both.
• Your SOC 2 report, if you have one, so shared evidence is scoped once.
• The date you need the certificate by.

Send the same pack to AIUC and to a firm on AIUC’s list of accredited auditors.¹¹ Ask each for a written scope with its price, and ask which work each one bills. The step by step certification guide shows what each phase involves, and the ISO 42001 comparison covers the other AI certificate in the picture.