Introduce and scope
Introduce AIUC-1
AIUC-1 introduction deck
Send after the first conversation. The client-facing overview: the gap in existing frameworks, quantified risk by agent type, cost and services, and case studies.
AIUC-1 requirements and controls
Send when the client wants to see what they will be audited against. All 50 requirements across the six principles, each with its controls and typical evidence. View only, and copying it starts a readiness assessment.
Sanitized audit report
Send when the client wants to see the deliverable. The full report structure with client detail removed.
Full ISO 42001 mapping
How AIUC-1 requirements map to ISO 42001 controls, and where existing ISO 42001 evidence carries over.
Certifications and case studies
Send when the client asks who has already certified. Recent certifications and case studies, grouped by client type.
Deliver and certify
Scoping
Scoping methodology
The full scoping methodology, including the developer versus deployer distinction.
Deployer and Developer Responsibility Guidance
Guidance clarifying how responsibility for meeting AIUC-1 controls is split between the agent platform developer and the deployer.
The standard
The full requirement and control list.
Evaluation methodology
The evaluation and grading methodology, and the risk and attack taxonomy.
Evidence collection
Legal evidence
Evidence templates for policies and contracts, such as ownership of inputs and outputs, or the agent’s acceptable use policy.
Technical evidence
Evidence templates for safeguards in the codebase or tooling, such as sensitive data protection or hallucination guardrails.
Operational evidence
Evidence templates for process documentation, such as accountability for agent changes or failure plans.
Third-party evals
Evidence templates for the technical evaluation results.
Maintaining certification
Re-certification and maintenance
What re-certification requires and how standard versions apply.
Changelog
Every quarterly change documented with type, notes, and reasoning.