1
Send the draft report to AIUC
AIUC adds its parts of the report, the executive summary and the evaluation results (today), and reviews the draft to ensure the standard is applied as intended.
2
Send the draft report for client review
Ask the client for feedback on three things: inconsistencies or errors; sensitive information that needs redacting, such as explicitly stated rate limits; and missing pieces, evidence that was submitted but is not described in the report.
3
Implement feedback and issue the final report
Implementing feedback is at the auditor’s discretion. Issue the final report, carrying your certification recommendation, to AIUC. Your recommendation is what AIUC certifies on, so it needs to be with AIUC by the target certification date.
4
Certificate issuance
AIUC signs the certification statement and issues the certificate to the client on the target certification date, for the client’s trust center. The client should expect the report to follow on or shortly after.
Submit results
Coming soonSubmit the audit report and evaluation results for the certification decision.
The certification date
The certification date is set as a target at the start of fieldwork, not chosen once the report is done.- Fix a target together. AIUC, the auditor, and the client fix a target certification date, typically about a week after fieldwork is expected to complete, so it can drive planning and post-fieldwork activities. Working back from a fixed point keeps the timeline predictable for the client and avoids the date being negotiated at the last minute. The client receives the AIUC-1 certificate on that date and should expect the report to follow on or shortly after it.
- It always falls on or after the closing meeting, never before. The closing meeting is the formal stage gate: it marks that fieldwork and evidence collection are complete and that all applicable requirements pass. Because AIUC certifies based on the auditor’s recommendation, the certification decision cannot sit ahead of the evidence that supports it. Placing the target roughly a week past the closing meeting keeps the report, and the recommendation it carries, aligned with the certification date.
- Aim to have the report finalized by the target date. A fixed target creates healthy pressure to close the report out on time. It also leaves room to absorb client feedback, a round of back-and-forth, or an unexpected delay: minor QA edits to clear the report can be made after the target, but the certification decision does not change. If fieldwork surfaces an evidence-level issue that needs remediation or re-testing, reset the target rather than working around it.
- Public announcement follows the certification date. The client’s public announcement and any marketing sit on or after the certification date, and never before evidence is complete and requirements pass. Where a client has a launch planned, work back from it to set a target that still respects the closing-meeting gate.
What the report contains
What the report contains
The template evolves with the standard, so use the current version AIUC shares and the sanitized example below for the exact structure. In outline, the report carries:
- auditor’s statement with the certification recommendation;
- AIUC’s certification statement;
- executive summary across the evaluations and the six principles, drafted by AIUC;
- audit testing summary and details written by the auditor, with the scope, methodology, timeline, and a verdict per requirement in the Statement of Applicability;
- evaluation results, with placeholders for the quarterly rounds that follow;
- appendices such as the report version history and grading rubrics.
Report conventions
Report conventions
An AIUC-1 certificate must have the same meaning and weight across auditors, so reports follow the template’s conventions rather than free text:
- Each requirement verdict uses the template’s standard conformance wording, naming the sub-requirements the controls were designed and implemented to meet
- Excluded requirements use the template’s not-applicable wording and the reason
- Requirements met through the technical evaluations point to the evaluation results rather than describing evidence
- Evidence descriptions are artifact-level: name the document, configuration, or code the verdict rests on. The client flags anything sensitive for redaction at review
Sanitized example report
The current report structure and conventions in full, with client detail removed. AIUC shares the editable template directly.
Output. The final audit report carrying the auditor’s recommendation, and the AIUC-1 certificate issued on a certification date the client can plan an announcement around.
Next: Maintaining certification
Quarterly evals and annual re-certification.