Scoping the certification

Scoping decides which instance of the agent and which risks the technical evaluations (evals) will test, and which AIUC-1 requirements the agent will be audited against. The agent itself is agreed upon in Introduce and scope.


Leads	Agent and evaluation scope: whoever runs the evals, AIUC today. Requirements in scope: client
Signs off	Agent and evaluation scope: client, and the auditor confirms. Requirements in scope: auditor
Timing	Weeks 1 to 2
Inputs	The agreed-upon agent and access to it, product documentation, and the standard’s requirement and control list
Output	One scoping document (agent-under-test profile and risk distribution) signed by the client, and a Statement of Applicability signed off by the auditor

Agent and evaluation scope

With access to a representative instance of the agent in place before the first meeting, build its profile with an explicit out-of-scope list, and agree the risk distribution with a rough eval count.Open part →

Requirements in scope

Build the Statement of Applicability for the auditor to sign off, and agree the standard version, timeline, and ways of working.Open part →

Part 1 is led by whoever runs the evals: AIUC today, the auditor once auditor-led evals are available. As the process matures the client leads the agent-under-test profile within it.Part 2 is always client-led, with the auditor signing off. The auditor confirms both, because the report attests to the scope.

Output. A signed scoping document covering the agent under test and the risk distribution, a Statement of Applicability signed off by the auditor with a justification against every exclusion, and an agreed timeline and way of working.

Next: Agent and evaluation scope

Pin down the instance under test and the risks the evals cover.

Introduction

Context

Standard

Certification

Evals Taxonomy

Auditors

Legal

Scoping the certification

Next: Agent and evaluation scope