Certifications typically run against the latest version of AIUC-1, which is updated quarterly. See the changelog for what changed, and Requirements in scope for which version an audit uses.
Need to know
The auditor recommends, AIUC certifies
The audit report carries the auditor’s recommendation. The AIUC-1 Certification Committee reviews it alongside the evaluation results, and issues the certificate if both meet all AIUC-1 requirements.
Who does what
The client owns the controls and the evidence, and remediates where needed.The auditor confirms scope, reviews evidence, issues a verdict per requirement, writes the report, and contracts directly with the client.AIUC maintains the standard, runs the evals today, supports every step of the process, and issues the certificate.
The engagement
Kickoff to certification takes 5 to 12 weeks. The week numbers below show the longer end of that range. Scoping, evidence collection, and evals overlap; fieldwork starts once evidence is handed over and testing is far enough along. An engagement with eval scope, agent access, and evidence largely in place, and a clean Round 1 can certify in about 5 to 6 weeks.1
Scoping
Weeks 1 to 2Leads: client on the Statement of Applicability; AIUC on the agent and evaluation scope todaySupports: auditor confirms scope and signs off the Statement of ApplicabilityPin down which instance of the agent the evals will test and against which risks, and which AIUC-1 requirements apply.
2
Evidence collection
Weeks 1 to 6Leads: clientSupports: AIUC; auditor available for a preliminary reviewThe client gathers evidence for every in-scope requirement and hands the auditor a quality-assured evidence pack.
3
Technical evaluations (evals)
Weeks 2 to 8, in parallel with evidence collectionLeads: AIUC today; auditor-led evals are in developmentSupports: client remediatesThe agent is tested across benign, social engineering, and adversarial scenarios. A second round runs only where Round 1 surfaces P0 or P1 findings.
4
Fieldwork
Weeks 8 to 10, typically two weeksLeads: auditorSupports: client answers; AIUC supportsReview the evidence per requirement, walk through it with the client, and issue a verdict per requirement.
5
Audit report and certification
Weeks 10 to 12, 1 to 2 weeks after fieldworkLeads: auditorSupports: AIUC adds its sections, reviews, and certifiesFinalize the report on the AIUC-1 template with your certification recommendation, then AIUC issues the certificate on the target date.
6
Maintaining certification
Quarterly and annuallyLeads: AIUC on quarterly evals today; auditor on annual re-certificationSupports: client remediates and re-submitsCertification is valid for 12 months and is maintained through quarterly evals and an annual re-certification audit.
How we work together
Cadence and channels
Cadence and channels
AIUC typically holds weekly syncs with auditors that have live engagements. The cadence is not a requirement and adapts to the auditor’s process. Shared clients rely on timely answers and are often on strict internal or regulatory timelines, so a shared Slack channel or Teams workspace is encouraged.
Raise questions early
Raise questions early
The standard can be more prescriptive than a client’s context warrants, and some controls require judgment. Raise open questions with AIUC rather than resolving them unilaterally. Where you think the standard itself should change, that feedback feeds the quarterly update process.
Verdicts are the auditor's
Verdicts are the auditor's
To avoid conflicts of interest, requirement verdicts are always at the auditor’s discretion. Client input is evaluated against the intent of requirements, and AIUC feedback adds context and nuance, before the auditor decides.
Contracting and invoicing
Contracting and invoicing
Contracting always happens directly between the client and the auditor, and the choice of auditor is the client’s. Invoicing happens separately unless explicitly agreed with all parties.
The standard
The full requirement and control list, downloadable from the AIUC-1 website.
Questions
If anything is unclear, or you think the process or the standard should work differently, tell us.
Next: Scoping
Pin down the agent and evaluation scope, then the requirements in scope.