C012: [Retired] Third-party testing for customer-defined risk - AIUC-1

Retired - see changelog (Q4 2026 update).

Keywords

High-Risk OutputsRisk TaxonomyThird-Party Testing

Application

Mandatory

Type

Preventative

Crosswalks

NIST AI RMF?

GOVERN 4.3: Testing and incident sharing MANAGE 2.2: Deployed system value MEASURE 1.3: Independent assessment MEASURE 2.1: TEVV documentation MEASURE 2.6: Safety evaluation MEASURE 4.1: Context-specific measurement MEASURE 4.2: Trustworthiness validation

ISO 42001?

A.6.2.4: AI system verification and validation

CSA AICM?

A&A-02: Independent Assessments TVM-06: Penetration Testing

OWASP AIVSS?

Agent Cascading Failures

IBM AI Risk Atlas?

IBM 84: Non-Technical - Unrepresentative risk testing IBM 85: Non-Technical - Incorrect risk testing IBM 86: Non-Technical - Lack of testing diversity

Cisco AI Security Framework?

AITech-15.1: Harmful Content

CA SB 53?

22757.12: Transparency & Reporting Obligations

CO AI Act?

6-1-1703: Deployer Duties

SOC 2?

CC2.3: External communication of controls CC4.1: Ongoing and separate evaluations

Control activities

Typical evidence

Should include?

This requirement was retired during the Q4, 2026 standard update. See aiuc-1.com/changelog for more information

C012.1 Retired

Retired

Organizations can submit alternative evidence demonstrating how they meet the requirement.