> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# C004: Prevent out-of-scope outputs

export const InlineClock = ({city, timeZone}) => {
  const [time, setTime] = useState('--:--:--');
  useEffect(() => {
    const update = () => setTime(new Intl.DateTimeFormat('en-US', {
      hour: '2-digit',
      minute: '2-digit',
      second: '2-digit',
      hour12: false,
      timeZone
    }).format(new Date()));
    update();
    const id = setInterval(update, 1000);
    return () => clearInterval(id);
  }, [timeZone]);
  return <div className="aiuc-footer-clock">
      <span className="aiuc-footer-clock-city">{city}</span>
      <span className="aiuc-footer-clock-time">{time}</span>
    </div>;
};

Implement safeguards or technical controls to prevent out-of-scope outputs (e.g. political discussion, healthcare advice)

<div className="aiuc-requirement-overview">
  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-taxonomy">
    <div className="aiuc-requirement-overview-group">
      <div className="aiuc-requirement-overview-label">Keywords</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Out-of-Scope</span>
        <span className="aiuc-requirement-overview-pill">Political Discussion</span>
        <span className="aiuc-requirement-overview-pill">Technical Controls</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-details">
    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Application</div>
      <span className="aiuc-requirement-overview-pill">Mandatory</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Frequency</div>
      <span className="aiuc-requirement-overview-pill">Every 12 months</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Type</div>
      <span className="aiuc-requirement-overview-pill">Preventative</span>
    </div>

    <div className="aiuc-requirement-overview-detail">
      <div className="aiuc-requirement-overview-label">Capabilities</div>

      <div className="aiuc-requirement-overview-pill-list">
        <span className="aiuc-requirement-overview-pill">Text-generation</span>
        <span className="aiuc-requirement-overview-pill">Voice-generation</span>
      </div>
    </div>
  </section>

  <section className="aiuc-requirement-overview-section aiuc-requirement-overview-crosswalks">
    <div className="aiuc-requirement-overview-label">Crosswalks</div>

    <div className="aiuc-requirement-crosswalk-grid">
      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">EU AI Act</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="EU regulation classifies AI systems by risk levels (minimal, limited, high, unacceptable) with corresponding compliance obligations" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/eu-ai-act" title="The EU AI Act requires providers of high-risk AI systems to establish a post-market monitoring system. This system should collect and analyze data on the perfo…">Article 72: Post-Market Monitoring by Providers and Post-Market Monitoring Plan for High-Risk AI Systems</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">NIST AI RMF</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="US government framework for managing AI risks throughout the AI lifecycle with four core functions: Govern, Map, Measure, Manage" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/nist-ai-rmf" title="Information about the AI system's knowledge limits and how system output may be utilized and overseen by humans is documented. Documentation provides sufficien…">MAP 2.2: Knowledge limits</a>
          <a href="/crosswalks/nist-ai-rmf" title="Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are…">MAP 3.4: Operator proficiency</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">OWASP Top 10</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Curated list of the most critical security threats to LLM and generative AI systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/owasp-top-10" title="Improper Output Handling involves inadequate validation of LLM outputs before downstream use. Exploits include XSS, CSRF, SSRF, privilege escalation, or remote…">LLM05:25 - Improper Output Handling</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">CSA AICM</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Cloud Security Alliance’s AI Controls Matrix provides security controls framework specifically designed for AI/ML systems" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/csa-aicm" title="Validate, filter, modify or block, as necessary, output against adversarial patterns, failure patterns and unwanted behaviour according to organisational polic…">AIS-09: Output Validation</a>
          <a href="/crosswalks/csa-aicm" title="Define, document and enforce policies and procedures on the acceptable use of AI services offered by the organization. Ensure effectiveness by continuous risk…">GRC-09: Acceptable Use of the AI Service</a>
          <a href="/crosswalks/csa-aicm" title="Log and monitor all output events (content and metadata) to enable auditing and reporting on usage of AI models.">LOG-15: Output Monitoring</a>
          <a href="/crosswalks/csa-aicm" title="Define and implement processes, procedures and technical measures to apply guardrails to the AI system. Continuously evaluate guardrails for changes in regulat…">TVM-11: Guardrails</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">OWASP AIVSS</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="OWASP AI Vulnerability Scoring System enables organizations to quantify how agentic capabilities amplify security risks" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/owasp-aivss" title="Prompt injection and semantic hijacking of agent objectives">Agent Goal and Instruction Manipulation</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">IBM AI Risk Atlas</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Comprehensive taxonomy of risks associated with ML models, GenAI, and AI Agents from IBM Research" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/ibm-ai-risk-atlas" title="Improper usage occurs when a model is used for a purpose that it was not originally designed for.">IBM 69: Output - Improper usage</a>
        </div>
      </div>

      <div className="aiuc-requirement-crosswalk-group">
        <div className="aiuc-requirement-crosswalk-heading">
          <span className="aiuc-requirement-crosswalk-title">Cisco AI Security Framework</span> <span className="aiuc-help-marker aiuc-crosswalk-help-marker" data-tooltip="Comprehensive AI threat landscape taxonomy identifying 19 attacker objectives with 150+ subtechniques from Cisco" tabIndex="0">?</span>
        </div>

        <div className="aiuc-requirement-crosswalk-rule" aria-hidden="true" />

        <div className="aiuc-requirement-crosswalk-items">
          <a href="/crosswalks/cisco-ai-security-safety-framework" title="Actors provide malicious instructions (via prompt) to override, bypass, alter, or subvert the output of a LLM/agent's system instructions, guardrails, or inten…">AITech-1.1: Direct Prompt Injection</a>
          <a href="/crosswalks/cisco-ai-security-safety-framework" title="Actors employ adversarial technique that circumvents or defeats a model's safety guardrails, content filters, or usage restrictions, enabling output generation…">AITech-2.1: Jailbreak</a>
          <a href="/crosswalks/cisco-ai-security-safety-framework" title="Actors prompt generative models or agents to produce unauthorized, unsafe, or malicious content, including harmful instructions, toxic speech, misinformation,…">AITech-15.1: Harmful Content</a>
        </div>
      </div>
    </div>
  </section>
</div>

<section className="aiuc-requirement-control-evidence">
  <div className="aiuc-requirement-control-evidence-headings">
    <h2>Control activities</h2>
    <h2>Typical evidence</h2>
  </div>

  <div className="aiuc-requirement-control-evidence-group">
    <div className="aiuc-requirement-control-evidence-label">
      <span>Should include</span> <span className="aiuc-help-marker" data-tooltip="Organizations must demonstrate core controls to meet the requirement. Auditors may accept alternative implementations that achieve equivalent outcomes." tabIndex="0">?</span>
    </div>

    <div className="aiuc-requirement-control-evidence-row">
      <div className="aiuc-requirement-card aiuc-requirement-control-card">
        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Detecting and blocking out-of-scope requests.</strong> For example, detecting conversations outside intended use cases, blocking prohibited topics, providing redirection messages when users hit boundaries, and escalating or restricting access for repeated violations.</p>
        </div>
      </div>

      <div className="aiuc-requirement-card aiuc-requirement-evidence-card">
        <div className="aiuc-requirement-evidence-title">C004.1 Config: out-of-scope guardrails</div>
        <p>Blocking rules, defensive prompting, or filtering configuration showing how out-of-scope requests are detected and handled - may include topic blocklists, redirection message templates, escalation rules for repeated attempts, or system prompts defining allowed topics.</p>

        <div className="aiuc-requirement-evidence-meta">
          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Category</div>
            <a href="/evidence/technical-implementation">Technical Implementation</a>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Typical location</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Engineering Code</span>
            </div>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Capabilities</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Text-generation</span>
              <span className="aiuc-requirement-evidence-pill">Voice-generation</span>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div className="aiuc-requirement-control-evidence-row">
      <div className="aiuc-requirement-card aiuc-requirement-control-card">
        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Tracking out-of-scope violations and updating boundaries.</strong> For example, logging boundary violations, adjusting restrictions based on misuse patterns.</p>
        </div>
      </div>

      <div className="aiuc-requirement-card aiuc-requirement-evidence-card">
        <div className="aiuc-requirement-evidence-title">C004.2 Logs: Out-of-scope attempts</div>
        <p>Logs showing out-of-scope attempts with frequency data. May include documentation of boundary updates made in response to violations, monitoring dashboard of flagged requests, change log showing restriction updates with rationale, or incident reports triggering scope adjustments.</p>

        <div className="aiuc-requirement-evidence-meta">
          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Category</div>
            <a href="/evidence/technical-implementation">Technical Implementation</a>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Typical location</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Logs</span>
            </div>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Capabilities</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Text-generation</span>
              <span className="aiuc-requirement-evidence-pill">Voice-generation</span>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-requirement-control-evidence-group">
    <div className="aiuc-requirement-control-evidence-label">
      <span>May include</span> <span className="aiuc-help-marker" data-tooltip="Supplemental controls demonstrating additional safeguards. Recommended when particularly relevant to the organization’s use case." tabIndex="0">?</span>
    </div>

    <div className="aiuc-requirement-control-evidence-row">
      <div className="aiuc-requirement-card aiuc-requirement-control-card">
        <div className="aiuc-requirement-control-item">
          <span className="aiuc-requirement-control-bullet" aria-hidden="true" />

          <p><strong>Providing user guidance on system capabilities and limitations.</strong> For example, communicating what the AI system can and cannot do, intended use cases, and topics or requests outside the system's scope.</p>
        </div>
      </div>

      <div className="aiuc-requirement-card aiuc-requirement-evidence-card">
        <div className="aiuc-requirement-evidence-title">C004.3 Demonstration: User guidance on scope</div>
        <p>User-facing guidance explaining system capabilities and limitations - may include onboarding tooltips or welcome screens, help documentation or FAQs describing intended use, UI warnings when approaching scope boundaries, or published usage guidelines.</p>

        <div className="aiuc-requirement-evidence-meta">
          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Category</div>
            <a href="/evidence/technical-implementation">Technical Implementation</a>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Typical location</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Product</span>
            </div>
          </div>

          <div className="aiuc-requirement-evidence-meta-group">
            <div className="aiuc-requirement-evidence-meta-label">Capabilities</div>

            <div className="aiuc-requirement-evidence-pill-list">
              <span className="aiuc-requirement-evidence-pill">Text-generation</span>
              <span className="aiuc-requirement-evidence-pill">Voice-generation</span>
            </div>
          </div>
        </div>
      </div>
    </div>
  </div>

  <p className="aiuc-requirement-alternative-evidence">Organizations can submit alternative evidence demonstrating how they meet the requirement.</p>
</section>

<div className="aiuc-footer">
  <span className="aiuc-footer-corner aiuc-footer-corner-tl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-tr">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <div className="aiuc-footer-strip">
    <span className="aiuc-footer-mono">37.782274° N -122.392147° W</span>
    <span className="aiuc-footer-strip-center">FIG. A (SITE INDEX)</span>

    <span />
  </div>

  <div className="aiuc-footer-row-main">
    <div className="aiuc-footer-wireframe-cell">
      <svg className="aiuc-footer-wireframe" fill="none" stroke="currentColor" strokeWidth="0.4" viewBox="0 0 200 150">
        <rect height="130" width="180" x="10" y="10" />

        <rect height="40" width="60" x="20" y="20" />

        <rect height="40" width="40" x="90" y="20" />

        <rect height="40" width="40" x="140" y="20" />

        <rect height="60" width="60" x="20" y="70" />

        <rect height="60" width="90" x="90" y="70" />

        <line strokeDasharray="2,2" x1="20" x2="180" y1="65" y2="65" />

        <line strokeDasharray="2,2" x1="85" x2="85" y1="20" y2="60" />

        <circle cx="50" cy="40" r="6" />

        <circle cx="110" cy="40" r="6" />

        <circle cx="160" cy="40" r="6" />
      </svg>
    </div>

    <div className="aiuc-footer-wordmark-cell">
      <div className="aiuc-footer-wordmark">Artificial Intelligence Underwriting Company</div>
    </div>

    <div className="aiuc-footer-clocks">
      <InlineClock city="SFO" timeZone="America/Los_Angeles" />

      <InlineClock city="NYC" timeZone="America/New_York" />

      <InlineClock city="LON" timeZone="Europe/London" />
    </div>
  </div>

  <div className="aiuc-footer-row-sub">
    <div className="aiuc-footer-codeblock-cell">
      <div className="aiuc-footer-codeblock">
        <span className="aiuc-footer-codeblock-header">Code</span>
        <span className="aiuc-footer-codeblock-header">Structural unit</span>
        <span className="aiuc-footer-codeblock-code">a.</span>
        <span className="aiuc-footer-codeblock-text">AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.</span>
        <span className="aiuc-footer-codeblock-code">b.</span>
        <span className="aiuc-footer-codeblock-text">Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.</span>
        <span className="aiuc-footer-codeblock-code">c.</span>
        <span className="aiuc-footer-codeblock-text">Crosswalks to AI regulations, standards, and security frameworks.</span>
        <span className="aiuc-footer-codeblock-code">d.</span>
        <span className="aiuc-footer-codeblock-text">Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.</span>
      </div>
    </div>

    <div className="aiuc-footer-columns-cell">
      <div className="aiuc-footer-columns">
        <div>
          <div className="aiuc-footer-column-header">I. Standard</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/">Overview</a></li>
            <li><a className="aiuc-footer-column-link" href="/crosswalks">Crosswalks</a></li>
            <li><a className="aiuc-footer-column-link" href="/evidence">Evidence</a></li>
            <li><a className="aiuc-footer-column-link" href="/changelog">Changelog</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">II. Learn</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/learn/about">About AIUC-1</a></li>
            <li><a className="aiuc-footer-column-link" href="/learn/contribute">Contribute</a></li>
            <li><a className="aiuc-footer-column-link" href="/scoping">Scoping</a></li>
            <li><a className="aiuc-footer-column-link" href="/faq">FAQ</a></li>
          </ul>
        </div>

        <div>
          <div className="aiuc-footer-column-header">III. Office</div>

          <ul className="aiuc-footer-column-list">
            <li><a className="aiuc-footer-column-link" href="/consortium">Consortium</a></li>
            <li><a className="aiuc-footer-column-link" href="/contact">Contact</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/privacy">Privacy policy</a></li>
            <li><a className="aiuc-footer-column-link" href="/legal/terms">Terms of use</a></li>
          </ul>
        </div>
      </div>
    </div>
  </div>

  <div className="aiuc-footer-strip-bottom">
    <span className="aiuc-footer-mono">100</span>
    <span>© AIUC — ALL RIGHTS RESERVED</span>
  </div>

  <span className="aiuc-footer-corner aiuc-footer-corner-bl">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>

  <span className="aiuc-footer-corner aiuc-footer-corner-br">
    <svg fill="none" stroke="currentColor" strokeWidth="1" viewBox="0 0 12 12" width="12" height="12">
      <line x1="0" x2="12" y1="6" y2="6" />

      <line x1="6" x2="6" y1="0" y2="12" />
    </svg>
  </span>
</div>