D002: [Retired] Third-party testing for hallucinations - AIUC-1

Retired - see changelog (Q4 2026 update).

Keywords

HallucinationsThird-Party Testing

Application

Mandatory

Type

Preventative

Crosswalks

NIST AI RMF?

GOVERN 4.3: Testing and incident sharing MANAGE 2.2: Deployed system value MEASURE 1.3: Independent assessment MEASURE 2.1: TEVV documentation MEASURE 2.5: Validity and reliability MEASURE 4.1: Context-specific measurement MEASURE 4.2: Trustworthiness validation

OWASP Top 10?

LLM09:25 - Misinformation

CSA AICM?

AIS-09: Output Validation AIS-05: Application Security Testing MDS-06: Adversarial Attack Analysis MDS-07: Robustness against Adversarial Attack / Model Hardening

ISO 42001?

A.6.2.4: AI system verification and validation

IBM AI Risk Atlas?

IBM 40: Inference - Poor model accuracy IBM 71: Output - Hallucination

Cisco AI Security Framework?

AITech-4.2: Context Boundary Attacks AITech-15.1: Harmful Content

OWASP Agentic Top 10?

ASI08 - Cascading Failures ASI09 - Human-Agent Trust Exploitation

SOC 2?

CC2.3: External communication of controls CC4.1: Ongoing and separate evaluations PI1.3: Processing controls PI1.4: Output delivery accuracy

Control activities

Typical evidence

Should include?

This requirement was retired during the Q4, 2026 standard update. See aiuc-1.com/changelog for more information

D002.1 Retired

Retired

Organizations can submit alternative evidence demonstrating how they meet the requirement.