Skip to main content

Requirements

Define AI risk taxonomyC001·Mandatory

Establish a risk taxonomy based on system capabilities and deployment context.

KeywordsRisk TaxonomySeverity Rating
CapabilitiesUniversal
Conduct pre-deployment testingC002·Mandatory

Conduct internal testing of AI systems prior to deployment across risk categories for system changes requiring formal review or approval.

KeywordsInternal TestingPre-Deployment Testing
CapabilitiesUniversal
Prevent harmful outputsC003·Mandatory

Implement safeguards or technical controls to prevent harmful outputs including distressed outputs, angry responses, high-risk advice, offensive content, bias, and deception.

KeywordsHarmful OutputsDistressedAngryAdviceOffensiveBias
CapabilitiesText-generationVoice-generationImage-generation
Prevent out-of-scope outputsC004·Mandatory

Implement safeguards or technical controls to prevent out-of-scope outputs (e.g. political discussion, healthcare advice).

KeywordsOut-of-ScopePolitical DiscussionTechnical Controls
CapabilitiesText-generationVoice-generation
Prevent agent-specific high risk outputsC005·Mandatory

Implement safeguards or technical controls to prevent agent-specific high-risk outputs as defined in risk taxonomy.

KeywordsHigh-Risk OutputsRisk TaxonomyTechnical Controls
CapabilitiesUniversal
Prevent output vulnerabilitiesC006·Mandatory

Implement safeguards to prevent security vulnerabilities in outputs from impacting users.

KeywordsHarmful OutputsCode InjectionData Exfiltration
CapabilitiesCode-generationText-generationVoice-generation
Flag high risk outputs for human reviewC007·Optional

Implement an alerting system that flags high-risk outputs for human review.

KeywordsHuman ReviewEscalation
CapabilitiesUniversal
Monitor AI risk categoriesC008·Optional

Implement monitoring of AI systems across risk categories.

KeywordsMonitoringHigh-Risk Outputs
CapabilitiesUniversal
Enable real-time feedback and interventionC009·Optional

Implement mechanisms to enable real-time user feedback collection, intervention and actioning mechanisms.

KeywordsFeedbackInterventionUser ControlTransparency
CapabilitiesUniversal
Third-party testing for safety riskC010·Mandatory

Appoint expert third-parties to evaluate system robustness to safety risk as defined in the AIUC-1 risk taxonomy at least every 3 months

KeywordsHarmful OutputsDistressedAngryAdviceOffensiveBiasRisk SeverityToxigenThird-Party Testing
CapabilitiesUniversal
[Retired] Third-party testing for out-of-scope outputsC011·Mandatory

Retired - see changelog (Q4 2026 update).

KeywordsOut-of-ScopePolitical DiscussionThird-Party Testing
[Retired] Third-party testing for customer-defined riskC012·Mandatory

Retired - see changelog (Q4 2026 update).

KeywordsHigh-Risk OutputsRisk TaxonomyThird-Party Testing