> ## Documentation Index > Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt > Use this file to discover all available pages before exploring further. # October 15, 2026 release > AIUC-1 changes published in Q4 2026. This update focused on governing open-weight model deployments, expanding third-party testing requirements, and providing guidance around agent developers and deployers. This quarter's refresh led to 5 new requirements, 5 new controls and 3 retired requirements. ### Overview of key updates * **Open-weight model deployments:** New controls governing the verification, testing and evaluation of open-weight models before deployment. * **Expanded third-party testing:** New comprehensive third-party testing requirements per AIUC-1 principle, paired with the release of a public incident database, and a risk and attack taxonomy informing the scope of third-party testing conducted. * **Developer and deployer responsibilities:** Guidance on how AIUC-1 controls are typically met by the developer and deployer of the agent platform, developed by working group with Consortium members from ElevenLabs, McKinsey, PwC, Noma Security, Datavant, Commerzbank, Veeam Software and more. ### Detailed change log | Date | AIUC-1 requirement and control | Category | Change notes | | - | - | - | - | | Q4 2026 | A009: Third-party testing for data & privacy risk | New addition | Added new mandatory requirement for third-party testing of data & privacy risk across the AIUC-1 principle, with a new control (A009.1) requiring a third-party evaluation report | | Q4 2026 | E018: Third-party testing for accountability risk | New addition | Added new mandatory requirement for third-party testing of accountability risk across the AIUC-1 principle, with a new control (E018.1) requiring a third-party evaluation report | | Q4 2026 | B001: Third-party testing for security risk | Revision | Renamed from third-party testing of adversarial robustness to third-party testing for security risk, broadening scope to cover security risk as defined in the AIUC-1 risk taxonomy | | Q4 2026 | C002.4 Documentation: Open-weight model change regression testing | Addition | Added new supplemental control for regression-testing open-weight model changes before deployment, such as after fine-tuning, quantization, or inference engine updates | | Q4 2026 | C010: Third-party testing for safety risk | Revision | Renamed from third-party testing for harmful outputs to third-party testing for safety risk, broadening scope to cover safety risk as defined in the AIUC-1 risk taxonomy | | Q4 2026 | C011: \[Retired] Third-party testing for out-of-scope outputs | Retired | Retired third-party testing for out-of-scope outputs; scope folded into the broader third-party testing for safety risk requirement (C010) | | Q4 2026 | C012: \[Retired] Third-party testing for customer-defined risk | Retired | Retired third-party testing for customer-defined risk; scope folded into the broader third-party testing for safety risk requirement (C010) | | Q4 2026 | D002: \[Retired] Third-party testing for hallucinations | Retired | Retired third-party testing for hallucinations; scope folded into the broader third-party testing for reliability risk requirement (D004) | | Q4 2026 | D003.4 Config: Human-approval workflows | Specification | Elevated requiring human approval for sensitive tool operations from a supplemental to a core control to address risks posed by browser agents that can transact, delete, or change settings in real accounts | | Q4 2026 | D004: Third-party testing for reliability risk | Revision | Renamed from third-party testing of tool calls to third-party testing for reliability risk, broadening scope to cover reliability risk as defined in the AIUC-1 risk taxonomy | | Q4 2026 | E006: Conduct vendor and model due diligence | Clarification | Renamed from conduct vendor due diligence to conduct vendor and model due diligence, clarifying that due diligence extends to model provenance and source | | Q4 2026 | E006.2 Documentation: Open-weight model source, integrity and licence verification | Addition | Added new supplemental control for verifying the source, integrity, and licence of an open-weight model before use | | Q4 2026 | E007: \[Retired] Document system change approvals | Clarification | Standardized the retired-requirement description to match the format used for other retired and merged requirements | | Q4 2026 | E014: \[Retired] Share transparency reports | Clarification | Standardized the retired-requirement description to match the format used for other retired and merged requirements | | Q4 2026 | E016.1 Demonstration: AI disclosure | Revision | Consolidated five separate disclosure controls (text, voice, labelling, automation, and reactive disclosure) into one combined control covering disclosure across all applicable modalities | | Q4 2026 | F001.3 Documentation: Cyber capability assessment for modified models | Addition | Added new supplemental control for assessing and mitigating cyber misuse capabilities after modifying an open-weight model | 37.782274° N -122.392147° W FIG. A (SITE INDEX) Artificial Intelligence Underwriting Company SFO NYC LON Code Structural unit a. AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk. b. Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation. c. Crosswalks to AI regulations, standards, and security frameworks. d. Quarterly updates shaped by enterprise adoption, risk, regulation, and community input. I. Standard II. Learn III. Office 100 © AIUC — ALL RIGHTS RESERVED This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.