| | | | - | - | | Leads | Auditor | | Supports | AIUC drafts the executive summary, provides the evaluation results, reviews the report, and signs the certification statement. The client reviews the draft. | | Timing | Weeks 10 to 12 on the full timeline: 1 to 2 weeks after fieldwork. Writing starts during fieldwork. | | Inputs | The [verdicts](/auditors/deliver-and-certify/fieldwork), the final [evaluation results](/auditors/deliver-and-certify/evals), the [Statement of Applicability](/auditors/deliver-and-certify/scoping/requirements-in-scope), and the current report template | | Output | The final audit report carrying the auditor's recommendation, and the AIUC-1 certificate | AIUC adds its parts of the report, the executive summary and the evaluation results (today), and reviews the draft to ensure the standard is applied as intended. Ask the client for feedback on three things: inconsistencies or errors; sensitive information that needs redacting, such as explicitly stated rate limits; and missing pieces, evidence that was submitted but is not described in the report. Implementing feedback is at the auditor's discretion. Issue the final report, carrying your certification recommendation, to AIUC. Your recommendation is what AIUC certifies on, so it needs to be with AIUC by the target certification date. AIUC signs the certification statement and issues the certificate to the client on the target certification date, for the client's trust center. The client should expect the report to follow on or shortly after. Coming soon Submit the audit report and evaluation results for the certification decision. ## The certification date The certification date is set as a target at the start of fieldwork, not chosen once the report is done. * **Fix a target together.** AIUC, the auditor, and the client fix a target certification date, typically about a week after fieldwork is expected to complete, so it can drive planning and post-fieldwork activities. Working back from a fixed point keeps the timeline predictable for the client and avoids the date being negotiated at the last minute. The client receives the AIUC-1 certificate on that date and should expect the report to follow on or shortly after it. * **It always falls on or after the closing meeting, never before.** The closing meeting is the formal stage gate: it marks that fieldwork and evidence collection are complete and that all applicable requirements pass. Because AIUC certifies based on the auditor's recommendation, the certification decision cannot sit ahead of the evidence that supports it. Placing the target roughly a week past the closing meeting keeps the report, and the recommendation it carries, aligned with the certification date. * **Aim to have the report finalized by the target date.** A fixed target creates healthy pressure to close the report out on time. It also leaves room to absorb client feedback, a round of back-and-forth, or an unexpected delay: minor QA edits to clear the report can be made after the target, but the certification decision does not change. If fieldwork surfaces an evidence-level issue that needs remediation or re-testing, reset the target rather than working around it. * **Public announcement follows the certification date.** The client's public announcement and any marketing sit on or after the certification date, and never before evidence is complete and requirements pass. Where a client has a launch planned, work back from it to set a target that still respects the closing-meeting gate. The template evolves with the standard, so use the current version AIUC shares and the sanitized example below for the exact structure. In outline, the report carries: * auditor's statement with the certification recommendation; * AIUC's certification statement; * executive summary across the evaluations and the six principles, drafted by AIUC; * audit testing summary and details written by the auditor, with the scope, methodology, timeline, and a verdict per requirement in the Statement of Applicability; * evaluation results, with placeholders for the quarterly rounds that follow; * appendices such as the report version history and grading rubrics. An AIUC-1 certificate must have the same meaning and weight across auditors, so reports follow the template's conventions rather than free text: * Each requirement verdict uses the template's standard conformance wording, naming the sub-requirements the controls were designed and implemented to meet * Excluded requirements use the template's not-applicable wording and the reason * Requirements met through the technical evaluations point to the evaluation results rather than describing evidence * Evidence descriptions are artifact-level: name the document, configuration, or code the verdict rests on. The client flags anything sensitive for redaction at review The current report structure and conventions in full, with client detail removed. AIUC shares the editable template directly. **Output.** The final audit report carrying the auditor's recommendation, and the AIUC-1 certificate issued on a certification date the client can plan an announcement around. *** Quarterly evals and annual re-certification.

37.782274° N -122.392147° W FIG. A (SITE INDEX)

Artificial Intelligence Underwriting Company

Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.

I. Standard

II. Learn

III. Office

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.