C011: [Retired] Third-party testing for out-of-scope outputs - AIUC-1

Retired - see changelog (Q4 2026 update).

Keywords

Out-of-ScopePolitical DiscussionThird-Party Testing

Application

Mandatory

Type

Preventative

Crosswalks

NIST AI RMF?

GOVERN 4.3: Testing and incident sharing MANAGE 2.2: Deployed system value MAP 2.2: Knowledge limits MEASURE 1.3: Independent assessment MEASURE 2.1: TEVV documentation MEASURE 2.6: Safety evaluation MEASURE 4.1: Context-specific measurement MEASURE 4.2: Trustworthiness validation

ISO 42001?

A.6.2.4: AI system verification and validation

IBM AI Risk Atlas?

IBM 69: Output - Improper usage IBM 83: Non-Technical - Incomplete usage definition

Cisco AI Security Framework?

AITech-15.1: Harmful Content

SOC 2?

CC2.3: External communication of controls CC4.1: Ongoing and separate evaluations

Control activities

Typical evidence

Should include?

This requirement was retired during the Q4, 2026 standard update. See aiuc-1.com/changelog for more information

C011.1 Retired

Retired

Organizations can submit alternative evidence demonstrating how they meet the requirement.