> ## Documentation Index > Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt > Use this file to discover all available pages before exploring further. # Requirements in scope export const InlineClock = ({city, timeZone}) => { const [time, setTime] = useState('--:--:--'); useEffect(() => { const update = () => setTime(new Intl.DateTimeFormat('en-US', { hour: '2-digit', minute: '2-digit', second: '2-digit', hour12: false, timeZone }).format(new Date())); update(); const id = setInterval(update, 1000); return () => clearInterval(id); }, [timeZone]); return
{city} {time}
; }; The Statement of Applicability is the list of AIUC-1 requirements and controls the client's agent will be audited against, signed off by the auditor. Building it is the second part of scoping, and it is what the audit report is built from.
| | | | - | - | | Leads | Client | | Signs off | Auditor. AIUC supports and is the escalation point for judgment calls | | Timing | Weeks 1 to 2. Opt-ins can be revised until the evidence pack is handed over; the Statement of Applicability is final at handover, before fieldwork | | Inputs | The [agent-under-test profile](/auditors/deliver-and-certify/scoping/agent-and-evaluation-scope) and the standard's requirement and control list | | Output | A Statement of Applicability signed off by the auditor, and an agreed standard version, timeline, and way of working | AIUC-1's requirements are organized under six principles, and the set is updated each quarter; the current list is on the [standard](/evidence/index) page. Each requirement is mandatory or optional, and comes with core controls (what organizations should implement to pass) and supplemental controls (opted into at the organization's discretion). Each requirement is tagged with the agent capabilities it applies to, such as "universal" or "code-generation". All mandatory requirements and their core controls apply by default. Where a core control is not demonstrated, the client can submit alternative evidence showing how the requirement is met, subject to the auditor's assessment. A mandatory requirement can only be excluded when the agent genuinely lacks the capability it is tagged with, never to reduce audit effort. This is what gives the certificate the same meaning across auditors. Each exclusion carries a one to two sentence justification. Organizations opt in to showcase strengths beyond the baseline, or to meet buyer or regulatory demands. Opted-in items strengthen the report but are not required to pass. Opt-ins can be revised during [evidence collection](/auditors/deliver-and-certify/evidence-collection) until the evidence pack is handed over. Confirm which version of AIUC-1 the audit runs against (see below), the evidence platform (for example, Drata, Vanta, Fieldguide, or the auditor's own), the cadence of syncs, the fieldwork dates, and whether a preliminary review of specific controls is useful. The auditor signs off the Statement of Applicability. It is the definitive list of requirements and controls the audit tests, it is documented in the audit record, and it drives the audit report, which covers exactly the requirements it lists. Exclusions are documented and opted-in items are given visibility. AIUC-1 is updated quarterly, with releases on January 15, April 15, July 15, and October 15. Audits run against the latest version, with a grace period of up to 30 days so organizations can prepare against a constant version. For example, the January 15 version can be selected until May 15; after that, the April 15 version must be used. The version is fixed when the engagement starts, at kickoff and scoping, and stays constant through fieldwork and the report. Always advise clients to use the latest version as soon as it is published. See the [changelog](/changelog) for what changed in each release. An approved exclusion produces an N/A verdict. Every scoped-out mandatory requirement is explicitly documented in the audit record. If evidence during fieldwork suggests the capability does exist, raise it with AIUC rather than leaving the N/A in place. The full scoping methodology, including the developer versus deployer distinction. The full requirement and control list, downloadable from the AIUC-1 website. **Output.** A Statement of Applicability signed off by the auditor, with a justification against every exclusion, and an agreed standard version, timeline, and way of working. *** The client gathers evidence for every requirement in scope.
37.782274° N -122.392147° W FIG. A (SITE INDEX)
Artificial Intelligence Underwriting Company
Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.
100 © AIUC — ALL RIGHTS RESERVED
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.