> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# April 15, 2026 release

> AIUC-1 changes published in Q2 2026.

export const InlineClock = ({city, timeZone}) => {
  const [time, setTime] = useState('--:--:--');
  useEffect(() => {
    const update = () => setTime(new Intl.DateTimeFormat('en-US', {
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
      hour12: false,
      timeZone
    }).format(new Date()));
    update();
    const id = setInterval(update, 1000);
    return () => clearInterval(id);
  }, [timeZone]);
  return <div className="aiuc-footer-clock">
      <span className="aiuc-footer-clock-city">{city}</span>
      <span className="aiuc-footer-clock-time">{time}</span>
    </div>;
};

Changes published in Q2 2026.

<div className="aiuc-changelog-table" />

| Date    | AIUC-1 requirement and control                                   | Category      | Change notes                                                                                                                                                                                                                    |
| ------- | ---------------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Q2 2026 | All requirements                                                 | Revision      | Updated typical evidence descriptions to move away from screenshots in favor of substantive and verifiable evidence                                                                                                             |
| Q2 2026 | A002: Establish output data policy                               | Revision      | Included both opt-in and out practices                                                                                                                                                                                          |
| Q2 2026 | A002.1 Documentation: Output usage and ownership policy          | Revision      | Included both opt-in and out practices, ensuring balanced coverage of consent models                                                                                                                                            |
| Q2 2026 | A002.2 Config: Opt-in/opt-out and output deletion implementation | Addition      | Added new control to incorporate implementation testing to A002                                                                                                                                                                 |
| Q2 2026 | A003: Limit AI agent data collection                             | Specification | Specified that the requirement covers data access more generally, and included more controls on agent IAM within it                                                                                                             |
| Q2 2026 | A003.1 Config: Data access scoping                               | Clarification | Clarified the control to cover agent access and identity management, not just data collection                                                                                                                                   |
| Q2 2026 | A003.3 Config: Agent identity management                         | Revision      | Separated agent identity and access management into distinct controls, with a focus on providing configurable, auditable architecture that integrates with enterprise IAM systems                                               |
| Q2 2026 | A003.4 Config: Agent access and permissions management           | Addition      | Separated agent identity and access management into distinct controls, with a focus on providing configurable, auditable architecture                                                                                           |
| Q2 2026 | B002: Detect adversarial input                                   | Clarification | Clarified that monitoring is to enable responding to adversarial inputs                                                                                                                                                         |
| Q2 2026 | B006: Prevent unauthorized AI agent actions                      | Revision      | Changed on a controls level - MCP coverage and additional execution-level containment controls                                                                                                                                  |
| Q2 2026 | B006.1 Config: Agent service access restrictions                 | Revision      | Covered MCP server access alongside existing API and service-level restrictions                                                                                                                                                 |
| Q2 2026 | B006.3 Config: Execution-level safeguards                        | Addition      | Added execution-level containment controls that limit the blast radius when an agent or approved MCP server behaves unexpectedly at runtime                                                                                     |
| Q2 2026 | B008: Protect AI system deployment environment                   | Revision      | Expanded scope of requirement from the AI model only to system                                                                                                                                                                  |
| Q2 2026 | B008.1 Config: Model access controls                             | Clarification | Expanded scope of control from the AI model only to system                                                                                                                                                                      |
| Q2 2026 | B008.2 Config: API and agentic interface authentication          | Revision      | Expanded deployment security controls to address MCP and A2A protocols alongside traditional API endpoints, with dedicated controls for authentication, transport security, and message integrity across all agentic interfaces |
| Q2 2026 | B008.3 Config: API and agentic interface transport security      | Addition      | See above                                                                                                                                                                                                                       |
| Q2 2026 | B008.4 Config: Agentic interface data integrity                  | Addition      | See above                                                                                                                                                                                                                       |
| Q2 2026 | C001: Define AI risk taxonomy                                    | Specification | Generalized the risk taxonomy requirement and changed testing frequency to every 12 months                                                                                                                                      |
| Q2 2026 | C001.2 Documentation: Risk taxonomy reviews                      | Specification | Aligned testing frequency to a 12-month cycle consistent with the risk management framework update schedule                                                                                                                     |
| Q2 2026 | C006: Prevent output vulnerabilities                             | Clarification | Clarified that the requirement is in scope for AI agents that generate code (see C006.1, C006.2, C006.3), and text (see C006.2)                                                                                                 |
| Q2 2026 | C006.1 Config: Output sanitization                               | Clarification | Clarified that the control is in scope for code-generating AI agents                                                                                                                                                            |
| Q2 2026 | C006.2 Demonstration: Warning labels for untrusted content       | Clarification | See above                                                                                                                                                                                                                       |
| Q2 2026 | C006.3 Config: Adversarial output detection                      | Clarification | See above                                                                                                                                                                                                                       |
| Q2 2026 | C007: Flag high risk outputs for human review                    | Clarification | Clarified that C007 is about human in the loop via updated label                                                                                                                                                                |
| Q2 2026 | C007.1 Documentation: Definition of high-risk output criteria    | Clarification | Expanded requirement scope from recommendations to generalized outputs                                                                                                                                                          |
| Q2 2026 | C007.3 Documentation: Human review workflows                     | Revision      | Included example of auditing human review workflows (i.e., checking the effectiveness of oversight over time) to mitigate against ‘automation bias’                                                                             |
| Q2 2026 | C009: Enable real-time feedback and intervention                 | Revision      | Changed on a controls level - synthesized controls and added in control to action user feedback                                                                                                                                 |
| Q2 2026 | C009.2 Documentation: User feedback & intervention reviews       | Clarification | Included practical validation and actioning of relevant user feedback, and streamlined three controls into one                                                                                                                  |
| Q2 2026 | D003: Restrict unsafe tool calls                                 | Revision      | Changed on a controls level - extends tool call validation to cover MCP servers alongside approved functions, expands scope of human approval for sensitive tool operations to cover multi-step workflows                       |
| Q2 2026 | D003.1 Config: Tool authorization & validation                   | Revision      | Extended tool call validation to cover MCP servers alongside approved functions                                                                                                                                                 |
| Q2 2026 | D003.3 Config: Tool call log                                     | Revision      | Extended tool call validation to cover MCP servers alongside approved functions                                                                                                                                                 |
| Q2 2026 | D003.4 Config: Human-approval workflows                          | Revision      | Expanded scope to cover multi-step workflows, reflecting trends of AI agents increasingly chaining tool calls across sequential operations rather than executing single actions in isolation                                    |
| Q2 2026 | E005: Document data storage security                             | Clarification | Clarified that the requirement is around ensuring companies establish clear security and compliance requirements for hosting platforms, rather than the act of cloud vs on-prem assessment                                      |
| Q2 2026 | E009: Monitor third-party access                                 | Revision      | Enforced E009 as a mandatory control                                                                                                                                                                                            |
| Q2 2026 | E015: Log AI system activity                                     | Revision      | Expanded scope of requirement from the AI model only to system                                                                                                                                                                  |
| Q2 2026 | E015.2 Config: AI agent logging implementation                   | Addition      | Extended logging to cover the intermediate steps between input and output (i.e., tool calls, sub-agent actions, and provenance metadata) getting traceability across the full execution chain                                   |
| Q2 2026 | E016: Implement AI disclosure mechanisms                         | Specification | Changed on a controls level - adjusts disclosure to AI agents and systems                                                                                                                                                       |
| Q2 2026 | E016.4 Demonstration: Automation AI disclosure                   | Specification | Adjusted disclosure to AI agents and systems                                                                                                                                                                                    |

<div className="aiuc-footer">
  <span className="aiuc-footer-corner aiuc-footer-corner-tl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-tr">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <div className="aiuc-footer-strip">
    <span className="aiuc-footer-mono">37.782274° N -122.392147° W</span>
    <span className="aiuc-footer-strip-center">FIG. A (SITE INDEX)</span>

    <span />
  </div>

  <div className="aiuc-footer-row-main">
    <div className="aiuc-footer-wireframe-cell">
      <svg className="aiuc-footer-wireframe" fill="none" stroke="currentColor" strokeWidth="0.4" viewBox="0 0 200 150">
        <rect height="130" width="180" x="10" y="10" />

        <rect height="40" width="60" x="20" y="20" />

        <rect height="40" width="40" x="90" y="20" />

        <rect height="40" width="40" x="140" y="20" />

        <rect height="60" width="60" x="20" y="70" />

        <rect height="60" width="90" x="90" y="70" />

        <line strokeDasharray="2,2" x1="20" x2="180" y1="65" y2="65" />

        <line strokeDasharray="2,2" x1="85" x2="85" y1="20" y2="60" />

        <circle cx="50" cy="40" r="6" />

        <circle cx="110" cy="40" r="6" />

        <circle cx="160" cy="40" r="6" />
      </svg>
    </div>

    <div className="aiuc-footer-wordmark-cell">
      <div className="aiuc-footer-wordmark">Artificial Intelligence Underwriting Company</div>
    </div>

    <div className="aiuc-footer-clocks">
      <InlineClock city="SFO" timeZone="America/Los_Angeles" />

      <InlineClock city="NYC" timeZone="America/New_York" />

      <InlineClock city="LON" timeZone="Europe/London" />
    </div>
  </div>

  <div className="aiuc-footer-row-sub">
    <div className="aiuc-footer-codeblock-cell">
      <div className="aiuc-footer-codeblock">
        <span className="aiuc-footer-codeblock-header">Code</span>
        <span className="aiuc-footer-codeblock-header">Structural unit</span>
        <span className="aiuc-footer-codeblock-code">a.</span>
        <span className="aiuc-footer-codeblock-text">AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.</span>
        <span className="aiuc-footer-codeblock-code">b.</span>
        <span className="aiuc-footer-codeblock-text">Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.</span>
        <span className="aiuc-footer-codeblock-code">c.</span>
        <span className="aiuc-footer-codeblock-text">Crosswalks to AI regulations, standards, and security frameworks.</span>
        <span className="aiuc-footer-codeblock-code">d.</span>
        <span className="aiuc-footer-codeblock-text">Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.</span>
      </div>
    </div>

    <div className="aiuc-footer-columns-cell">
      <div className="aiuc-footer-columns">
        <div>
          <div className="aiuc-footer-column-header">I. Standard</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/">Overview</a></li>
            <li><a className="aiuc-footer-column-link" href="/crosswalks">Crosswalks</a></li>
            <li><a className="aiuc-footer-column-link" href="/evidence">Evidence</a></li>
            <li><a className="aiuc-footer-column-link" href="/changelog">Changelog</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">II. Learn</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/learn/about">About AIUC-1</a></li>
            <li><a className="aiuc-footer-column-link" href="/learn/contribute">Contribute</a></li>
            <li><a className="aiuc-footer-column-link" href="/scoping">Scoping</a></li>
            <li><a className="aiuc-footer-column-link" href="/faq">FAQ</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">III. Office</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/consortium">Consortium</a></li>
            <li><a className="aiuc-footer-column-link" href="https://www.aiuc-1.com/contact">Contact</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/privacy">Privacy policy</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/terms">Terms of use</a></li>
          </ul>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-footer-strip-bottom">
    <span className="aiuc-footer-mono">100</span>
    <span>© AIUC — ALL RIGHTS RESERVED</span>
  </div>

  <span className="aiuc-footer-corner aiuc-footer-corner-bl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-br">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>
</div>