AIUC-1 requirements: the six domains in plain English

The six domains at a glance

AIUC groups the requirements into six domains, lettered A to F, and the letter opens every requirement ID.³ Accountability is the largest domain, with 16 requirements. Society is the smallest, with 2. Optional requirements appear only in Security, Safety and Accountability.

What each domain asks for

Each domain is described below in plain English, with a few example requirements by ID and short name and a one line summary we wrote ourselves. They are examples, not the full list. AIUC publishes every requirement, with its own wording and its evidence, in its full evidence list, and that is the text an auditor works from.¹

A Data and privacy

What the agent can see, and where customer data ends up. All 9 requirements are mandatory, and it leans on legal documents more than any other domain: 6 of its 26 evidence items are legal policies.

A003 Limit AI agent data access

The agent reaches only the data its task needs.

A005 Prevent cross-customer data exposure

One customer's data never surfaces in another customer's session.

A009 Third-party testing for data and privacy risk

Independent testing of the agent for data and privacy failures, reviewed every quarter.

B Security

Attacks on the agent, and the agent acting past its permissions. Security carries the heaviest engineering load in the standard: 31 of its 37 evidence items are technical implementation. Of its 10 requirements, 3 are optional.

B002 Detect adversarial input (optional)

Spot input crafted to manipulate the agent, such as a prompt injection.

B006 Prevent unauthorized AI agent actions

The agent cannot take an action nobody authorized it to take.

B007 Enforce user access privileges to AI systems

A user gets no more out of the agent than that user's own role allows.

C Safety

Harmful output, and the testing that catches it before users do. Of its 10 requirements, 3 are optional. Since the October 15, 2026 release, its third-party testing requirement also carries the scope of the retired C011 and C012.²

C002 Conduct pre-deployment testing

Test the agent before it is put in front of users.

C007 Flag high risk outputs for human review (optional)

Send a risky output to a person before it takes effect.

C010 Third-party testing for safety risk

Independent testing for unsafe or harmful output, reviewed every quarter.

D Reliability

Whether the agent does what it says, and keeps its actions inside safe limits. It has 3 requirements, all mandatory. Its third-party testing requirement, D004, took over the scope of the retired D002.

D001 Prevent hallucinated outputs

Keep the agent from stating unsupported or false things as fact.

D003 Restrict unsafe tool calls

Stop the agent from calling a tool in a way that could do damage.

E Accountability

Who owns the agent, what happens when it fails, and what record it leaves. It is the largest domain, with 16 requirements and 2 of them optional. It is also the only one where operational practices outnumber technical evidence, 17 items to 13. The one requirement reviewed twice a year, E012, sits here.

E001 AI failure plan for security breaches

A written plan for the day the agent is part of a security incident.

E004 Assign accountability

Named people own the agent and answer for what it does.

E015 Log AI system activity

Keep a record of what the agent did, so an incident can be traced.

F Society

Use of the agent to cause harm in the wider world. It is the smallest domain, with 2 requirements and 5 evidence items. It is also the only domain with no third-party eval in its evidence.

F001 Prevent AI cyber misuse

Stop the agent being used to attack other systems.

F002 Prevent catastrophic misuse

Stop the agent being turned toward harm on a catastrophic scale.

Mandatory, optional and what scoping changes

Mandatory does not mean every requirement applies to every agent. The Statement of Applicability decides which ones do, and the auditor signs it off.⁴ A mandatory requirement leaves scope only when the agent genuinely lacks the capability it is written for, never to save effort, and each exclusion needs a short written justification.⁵

The 8 optional requirements are B002, B003, B005, C007, C008, C009, E013 and E017. None applies by default. A company can opt in to any of them, and to AIUC’s supplemental controls, to make its report stronger.⁵ If your agent reads untrusted input, B002 is the one to look at first. The guide to getting certified walks the scoping step in order.

The evidence behind the requirements

Of the 140 evidence items AIUC lists, 91 are technical implementation.¹ That is 65 percent. Counted by item, AIUC-1 is mostly engineering evidence: proof that a safeguard exists in the system itself. Then come 32 operational practices, 12 legal policies and 5 third-party evals.

By domain, the engineering weight sits in Security. Its 31 technical items are 34 percent of all the technical evidence in the standard. Accountability runs the other way, with more operational items than technical ones, and Data and privacy holds the most legal policies, 6.

Plan the evidence with whoever leads engineering, not only with whoever owns the policies. A SOC 2 helps here. AIUC maps 45 of the 50 active requirements to at least one SOC 2 criterion, which means related evidence rather than coverage.⁶ The map is in AIUC-1 vs SOC 2.

On October 19, 2026, the American Institute of CPAs (AICPA) and AIUC announced one engagement that produces a SOC 2 report and an AIUC-1 certification together.⁷ The joint engagement explains how the two halves divide, and SOC 2 for AI companies covers the SOC 2 side of an AI product.

How often each requirement is reviewed

Every requirement carries a review cadence.¹ 40 are reviewed yearly, 9 quarterly and 1 twice a year. The quarterly ones are A009, B001, B002, B007, C006, C009, C010, D004 and E018. The twice yearly one is E012.

The third-party testing requirements, one per domain from A to E, are all on the quarterly list: A009, B001, C010, D004 and E018. That is the same rhythm as the quarterly evals that keep a certificate current between audits.⁸ By control type, 43 requirements are preventative and 5 detective. The other 2 state no type.

What was retired, and when

5 of the 55 IDs are retired. The October 15, 2026 release retired C011, C012 and D002 and folded their scope into the broader third-party testing requirements: C010 for safety and D004 for reliability.² E007 and E014 were retired before that release. The October entry only standardized their descriptions.

If an older spreadsheet or crosswalk still lists C011, C012 or D002, move the safety items under C010 and the reliability item under D004. AIUC releases on January 15, April 15, July 15 and October 15, with up to 30 days of grace, and the next release is due January 15, 2027.² Every count on this page is as of October 19, 2026. Recheck them after each release.