> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# January 15, 2026 release

export const InlineClock = ({city, timeZone}) => {
  const [time, setTime] = useState('--:--:--');
  useEffect(() => {
    const update = () => setTime(new Intl.DateTimeFormat('en-US', {
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
      hour12: false,
      timeZone
    }).format(new Date()));
    update();
    const id = setInterval(update, 1000);
    return () => clearInterval(id);
  }, [timeZone]);
  return <div className="aiuc-footer-clock">
      <span className="aiuc-footer-clock-city">{city}</span>
      <span className="aiuc-footer-clock-time">{time}</span>
    </div>;
};

This update focused on detailing guidance on control implementation, including publishing typical evidence submitted to pass AIUC-1 requirements transparently on the website. It also updated several requirements to integrate stronger PII protection in logs, threat modeling in pre-deployment testing, multimodal coverage of AI labeling, pickle-file security tools, and more. Finally, it published more information on the AIUC-1 certification process and scoping questionnaire.

### Overview of key updates

* Updated 26 requirements based on audit experience, input from technical contributors, feedback from AIUC-1 Consortium members, and external peer-review comments.
* Detailed typical evidence submitted to pass AIUC-1 with suggested locations and concrete examples, making it easier for organizations to begin a readiness assessment of AIUC-1.
* Published AIUC-1 scoping questionnaire and certification process details to ensure consistent application of AIUC-1 across accredited auditors.

### Detailed change log

<div className="aiuc-changelog-table" />

| Date    | AIUC-1 requirement and control                    | Category      | Change notes                                                                                                                                                                                                                                                                                                                                                                                                             |
| ------- | ------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Q1 2026 | All requirements                                  | New addition  | Defined and published typical evidence for all controls tagged by evidence category and typical location                                                                                                                                                                                                                                                                                                                 |
| Q1 2026 | Scoping questionnaire                             | New addition  | Published the AIUC-1 scoping questionnaire, enabling consistent approach to scoping by accredited auditors                                                                                                                                                                                                                                                                                                               |
| Q1 2026 | All requirements                                  | New addition  | Tagged all requirements with relevant AI agent capabilities which are used as input for the scoping questionnaire to ensure appropriate application of AIUC-1 requirements                                                                                                                                                                                                                                               |
| Q1 2026 | All requirements                                  | New addition  | Enabled Excel export of all requirements and controls for easier readiness assessment                                                                                                                                                                                                                                                                                                                                    |
| Q1 2026 | Should include and May include control activities | Clarification | Clarified application of control activities<br />For controls labeled "Should include": Organizations must demonstrate core controls to meet the requirement. Auditors may accept alternative implementations that achieve equivalent outcomes<br />For controls labeled "May include": Supplemental controls demonstrating additional safeguards. Recommended when particularly relevant to the organization's use case |
| Q1 2026 | A001: Establish input data policy                 | Specification | Specified evidence requirements across policies and enforcement of policies, particularly for data retention                                                                                                                                                                                                                                                                                                             |
| Q1 2026 | A003: Limit AI agent data collection              | Revision      | Removed optional control activity focused on dynamic context-based restrictions given limited technical pathways for implementation                                                                                                                                                                                                                                                                                      |
| Q1 2026 | A004: Protect IP & trade secrets                  | Specification | Specified controls with a stricter requirement of user guardrails<br />Provided specific guidance on foundation model IP protections<br />Added supplemental safeguards                                                                                                                                                                                                                                                  |
| Q1 2026 | A005: Prevent cross-customer data exposure        | Revision      | Revised controls to avoid overlap and specify the intent of the requirement<br />Removed optional controls on adapting safeguards to industry-specific risks<br />Removed optional controls on inference-time data isolation                                                                                                                                                                                             |
| Q1 2026 | A006: Prevent PII leakage                         | Specification | Increased PII protection requirements for logs<br />Removed incident management control to avoid overlap with E001<br />Removed cross-tenant contaminant control to avoid overlap with A005                                                                                                                                                                                                                              |
| Q1 2026 | A007: Prevent IP violations                       | Clarification | Clarified controls with emphasis on foundation model IP protections<br />Added additional safeguards tagged as supplemental controls<br />Removed third-party IP incident response control to avoid overlap with other requirements                                                                                                                                                                                      |
| Q1 2026 | B006: Limit AI agent system access                | Clarification | Clarified the requirement's focus on security aspects of system limiting<br />Emphasized agent privilege restrictions and monitoring                                                                                                                                                                                                                                                                                     |
| Q1 2026 | B008: Protect model deployment environment        | Specification | Included Trail of Bits' Fickling tool as example safeguard in control B008.4 based on peer-review feedback                                                                                                                                                                                                                                                                                                               |
| Q1 2026 | B009: Limit output over-exposure                  | Revision      | Tagged user notification control as supplemental, recognizing it is not always in the organization's interest to disclose output limitations<br />Minor revisions to output fidelity limitations to align with MITRE AML-M0002                                                                                                                                                                                           |
| Q1 2026 | C001: Define AI risk taxonomy                     | Revision      | Simplified controls to focus on AI Risk Taxonomy documentation and reviews                                                                                                                                                                                                                                                                                                                                               |
| Q1 2026 | C002: Conduct pre-deployment testing              | Specification | Included explicit reference to threat modelling in controls based on peer-review feedback                                                                                                                                                                                                                                                                                                                                |
| Q1 2026 | C003: Prevent harmful outputs                     | Revision      | Removed control on review and appeal mechanisms, which are beyond the intent of the requirement                                                                                                                                                                                                                                                                                                                          |
| Q1 2026 | C006: Prevent output vulnerabilities              | Revision      | Removed control on logging sanitation activities as this is beyond standard practice for organizations                                                                                                                                                                                                                                                                                                                   |
| Q1 2026 | C008: Monitor AI risk categories                  | Revision      | Removed control on proactive detection as this is already covered by C008.2                                                                                                                                                                                                                                                                                                                                              |
| Q1 2026 | C009: Enable real-time feedback and intervention  | Revision      | Revised controls to cover other modalities (e.g. voice, image)<br />Tagged review of intervention logs as a supplemental control                                                                                                                                                                                                                                                                                         |
| Q1 2026 | D003: Restrict unsafe tool calls                  | Revision      | Revised controls to avoid overlap with A003 and B006<br />Emphasized tool call validation and monitoring specifically                                                                                                                                                                                                                                                                                                    |
| Q1 2026 | E005: Assess cloud vs on-prem processing          | Revision      | Revised controls to focus on cloud vs. on-prem decisions<br />Removed security and vendor due diligence controls covered in other requirements                                                                                                                                                                                                                                                                           |
| Q1 2026 | E007: Document system change approvals            | Retired       | This requirement was merged into E004: Assign accountability, which already requires documenting approval with supporting evidence                                                                                                                                                                                                                                                                                       |
| Q1 2026 | E009: Monitor third-party access                  | Clarification | Clarified monitoring configuration requirement in place of purely documenting procedures                                                                                                                                                                                                                                                                                                                                 |
| Q1 2026 | E010: Establish AI acceptable use policy          | Clarification | Combined supplemental controls into one without changing the nature of the control activities                                                                                                                                                                                                                                                                                                                            |
| Q1 2026 | E013: Implement quality management system         | Specification | Controls updated to simplify the requirement while fulfilling EU AI Act Article 17                                                                                                                                                                                                                                                                                                                                       |
| Q1 2026 | E014: Share transparency reports                  | Retired       | This requirement was merged into E017 to avoid overlap and to recognize transparency policy sharing procedures                                                                                                                                                                                                                                                                                                           |
| Q1 2026 | E015: Log model activity                          | Specification | Strengthened controls around PII protection<br />Improved log immutability and tamper-proofing based on peer-review feedback                                                                                                                                                                                                                                                                                             |
| Q1 2026 | E016: Implement AI disclosure mechanisms          | Revision      | Revised control activities to ensure coverage of multiple modalities (e.g. voice, text, image)                                                                                                                                                                                                                                                                                                                           |
| Q1 2026 | F001: Prevent AI cyber misuse                     | Revision      | Removed control requiring a signed attestation that cyber misuse safeguards remain active<br />Encouraged organizations using open-source or fine-tuned third-party models to opt into the supplemental control                                                                                                                                                                                                          |
| Q1 2026 | F002: Prevent catastrophic misuse                 | Revision      | Removed control requiring a signed attestation that CBRN safeguards remain active<br />Encouraged organizations using open-source or fine-tuned third-party models to opt into the supplemental control                                                                                                                                                                                                                  |

<div className="aiuc-footer">
  <span className="aiuc-footer-corner aiuc-footer-corner-tl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-tr">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <div className="aiuc-footer-strip">
    <span className="aiuc-footer-mono">37.782274° N -122.392147° W</span>
    <span className="aiuc-footer-strip-center">FIG. A (SITE INDEX)</span>

    <span />
  </div>

  <div className="aiuc-footer-row-main">
    <div className="aiuc-footer-wireframe-cell">
      <svg className="aiuc-footer-wireframe" fill="none" stroke="currentColor" strokeWidth="0.4" viewBox="0 0 200 150">
        <rect height="130" width="180" x="10" y="10" />

        <rect height="40" width="60" x="20" y="20" />

        <rect height="40" width="40" x="90" y="20" />

        <rect height="40" width="40" x="140" y="20" />

        <rect height="60" width="60" x="20" y="70" />

        <rect height="60" width="90" x="90" y="70" />

        <line strokeDasharray="2,2" x1="20" x2="180" y1="65" y2="65" />

        <line strokeDasharray="2,2" x1="85" x2="85" y1="20" y2="60" />

        <circle cx="50" cy="40" r="6" />

        <circle cx="110" cy="40" r="6" />

        <circle cx="160" cy="40" r="6" />
      </svg>
    </div>

    <div className="aiuc-footer-wordmark-cell">
      <div className="aiuc-footer-wordmark">Artificial Intelligence Underwriting Company</div>
    </div>

    <div className="aiuc-footer-clocks">
      <InlineClock city="SFO" timeZone="America/Los_Angeles" />

      <InlineClock city="NYC" timeZone="America/New_York" />

      <InlineClock city="LON" timeZone="Europe/London" />
    </div>
  </div>

  <div className="aiuc-footer-row-sub">
    <div className="aiuc-footer-codeblock-cell">
      <div className="aiuc-footer-codeblock">
        <span className="aiuc-footer-codeblock-header">Code</span>
        <span className="aiuc-footer-codeblock-header">Structural unit</span>
        <span className="aiuc-footer-codeblock-code">a.</span>
        <span className="aiuc-footer-codeblock-text">AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.</span>
        <span className="aiuc-footer-codeblock-code">b.</span>
        <span className="aiuc-footer-codeblock-text">Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.</span>
        <span className="aiuc-footer-codeblock-code">c.</span>
        <span className="aiuc-footer-codeblock-text">Crosswalks to AI regulations, standards, and security frameworks.</span>
        <span className="aiuc-footer-codeblock-code">d.</span>
        <span className="aiuc-footer-codeblock-text">Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.</span>
      </div>
    </div>

    <div className="aiuc-footer-columns-cell">
      <div className="aiuc-footer-columns">
        <div>
          <div className="aiuc-footer-column-header">I. Standard</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/">Overview</a></li>
            <li><a className="aiuc-footer-column-link" href="/crosswalks">Crosswalks</a></li>
            <li><a className="aiuc-footer-column-link" href="/evidence">Evidence</a></li>
            <li><a className="aiuc-footer-column-link" href="/changelog">Changelog</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">II. Learn</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/learn/about">About AIUC-1</a></li>
            <li><a className="aiuc-footer-column-link" href="/learn/contribute">Contribute</a></li>
            <li><a className="aiuc-footer-column-link" href="/scoping">Scoping</a></li>
            <li><a className="aiuc-footer-column-link" href="/faq">FAQ</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">III. Office</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/consortium">Consortium</a></li>
            <li><a className="aiuc-footer-column-link" href="https://www.aiuc-1.com/contact">Contact</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/privacy">Privacy policy</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/terms">Terms of use</a></li>
          </ul>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-footer-strip-bottom">
    <span className="aiuc-footer-mono">100</span>
    <span>© AIUC — ALL RIGHTS RESERVED</span>
  </div>

  <span className="aiuc-footer-corner aiuc-footer-corner-bl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-br">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>
</div>