> ## Documentation Index > Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt > Use this file to discover all available pages before exploring further. # AIUC-1 Governance AIUC-1 is created by the Artificial Intelligence Underwriting Company ([AIUC](/learn/contribute.md)), a Public Benefit Corporation headquartered in San Francisco. ### AIUC-1 Consortium The AIUC-1 standard is developed and maintained with the [AIUC-1 Consortium](/consortium), uniting 300+ security & risk leaders across the Fortune 500. The standard is updated quarterly following the [process described below](#quarterly-updates). The process is designed on the following principles: 1. **Broad input:** All consortium members can propose changes to AIUC-1 each quarter. The input shapes quarterly release priorities alongside changes to legislation, new incidents, and new agent capabilities. 2. **Focused updating:** AIUC Standards team collect inputs and translate them into formal standard changes. For some changes, smaller working groups are created to work through proposed changes in a targeted way. 3. **Transparent review:** All proposed standard changes go through a transparent peer-review, enabling consortium members to question and challenge proposed updates. AIUC Standards team finalize standard changes based on peer-review feedback before final release. All changes are documented in a public [changelog](/changelog.md). An AIUC-1 advisory group has been formed to review standard governance and propose additional steps. For example, adding a formal review step by an advisory board for each standard release. Details of their work, including how it has been implemented, will be shared as part of the next release of AIUC-1 on January 15th, 2027. ### AIUC-1 Certification To earn AIUC-1 Certification, organizations must submit to a control audit by an accredited auditor and submit agents to technical evaluations: * [Accredited auditors](https://standard.aiuc-1.com/accredited-auditors.md) validate that organizations have implemented effective controls to meet all applicable AIUC-1 requirements. The auditor writes the AIUC-1 audit report and issues a recommendation to certify. * **Technical evaluations** validate how agents behave against real world risk. Results are included in the audit report, graded by severity. To pass AIUC-1 Certification, organizations must demonstrate no Critical (P0) or Major (P1) findings. Evaluations are currently conducted only by AIUC, to ensure consistent quality and methodology across certified agents. The final AIUC-1 Certification is issued by AIUC. **Expanding technical evaluator ecosystem** A pilot program was launched in Q3, 2026 with independent entities completing the technical evaluations of agents required in AIUC-1. The entities follow AIUC-1 evaluation guidelines to ensure consistent quality and methodology across certified agents. Pending successful results, the ecosystem of independent technical evaluators will grow similarly to the [ecosystem of accredited auditors](https://standard.aiuc-1.com/accredited-auditors.md). To accelerate ecosystem creation, parts of the AIUC-1 evaluation methodology have already been released publicly, including: * [Risk taxonomy](https://standard.aiuc-1.com/evals-taxonomy/risks.md) - a comprehensive taxonomy of agent risk areas by category * [Attack taxonomy](https://standard.aiuc-1.com/evals-taxonomy/attacks.md) - an overview of benign and adversarial tactics to elicit risks * [Incident database](https://standard.aiuc-1.com/evals-taxonomy/incident-database.md) - a sample of real-world incidents used to ensure evals are realistic > ****Accrediting technical evaluators**** > > Accreditation criteria for technical evaluators are being developed in parallel with the pilot. To earn accreditation, technical evaluators must demonstrate the ability to consistently and at a high quality: > > 1. Scope evaluations to the relevant risk areas, drawing on the risk taxonomy > 2. Execute a representative set of benign and adversarial agent attacks, drawing on the attack taxonomy and incident database > 3. Grade evaluation results consistently, following the AIUC-1 grading methodology > 4. Maintain strong governance and security, including sensitive data protection, independence from the organizations they evaluate, and secure handling of evaluation results and agent access ### Quarterly updates AIUC-1 is updated each quarter on January 15, April 15, July 15 and October 15 to ensure that the standard evolves as technology, risk, and regulation evolves. Quarterly updates follow a documented process involving: 1. Prioritization sessions with executive consortium members 2. Technical working sessions with consortium members & technical contributors 3. Peer-review of all standard changes 4. Transparent change management with public line-by-line [changelog](https://standard.aiuc-1.com/changelog.md) ![7aec2fa2811da9210c9ab945c003f182fe51c5a9 3877x1315](https://mintcdn.com/aiuc-28e27073/7jVrfOJQme2j0R-0/images/7aec2fa2811da9210c9ab945c003f182fe51c5a9-3877x1315.avif?fit=max\&auto=format\&n=7jVrfOJQme2j0R-0\&q=85\&s=7694ed94314a95669bd5fb48c67a38fe) ### Tenets guiding standard updates AIUC-1 is designed to be: * **Adoption-focused.** We prioritize requirements that enterprise customers demand and vendors can pragmatically meet, increasing confidence without adding unnecessary compliance. * **AI-focused.** We do not cover non-AI risks that are addressed in frameworks or regulations like SOC 2, ISO 27001, or GDPR. * **Insurance-enabling.** We prioritize risks that lead to direct harms and financial losses. * **Adapting to regulation.** We update AIUC-1 to make it easier to comply with new regulations. * **Adapting to AI progress.** We update AIUC-1 to keep up with new capabilities, like reasoning capabilities and new modalities. * **Adapting to the threat landscape.** We update AIUC-1 in response to real-world incidents. * **Continuously improving.** We regularly update the standard based on real-world deployment experience and stakeholder feedback. * **Predictable.** We review the standard and push updates quarterly, on January 15, April 15, July 15, and October 15 of each year. Certifications remain valid for the full year, with the standard version locked at certification. * **Transparent.** We keep a public changelog and share our lessons. ### Guarantees No standard can eliminate all risks inherent in deploying AI systems, and certification represents a point-in-time assessment of controls, not a warranty of future performance or outcomes. Organizations change, systems evolve, and new risks emerge. AIUC-1 quarterly technical evaluations are designed to mitigate this risk, so that an AIUC-1 certificate demonstrates that an organization takes AI governance seriously and has invested in demonstrable controls that work in practice when evaluated. But it should not substitute independent risk assessment and ongoing monitoring. ### Frequently asked questions Answers to FAQs [here](https://standard.aiuc-1.com/faq.md) ### **Provide input on AIUC-1** We welcome feedback, ideas, suggestions, and criticism. [Provide input on AIUC-1](/learn/contribute.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.