AIUC-1 and ISO 42001 for AI agents: what auditors ask for
ISO/IEC 42001 checks how a company governs AI. AIUC-1 checks a specific agent. What each standard asks for, and the evidence your agents need for both.
Regulated buyers now ask two questions before they approve an AI agent. Does the company govern AI responsibly? And does this agent resist attacks and stay inside its limits? ISO/IEC 42001 answers the first question. AIUC-1 answers the second.
This guide explains what each standard checks, how they differ, and the evidence an agent team needs for both.
Key takeaways
- ISO/IEC 42001 certifies an organization's AI management system. AIUC-1 certifies specific agents.
- AIUC-1 requires independent adversarial testing: no open critical or high findings, and new evaluations at least every three months.
- Most of the evidence overlaps: agent inventory, risk assessment, least-privilege access, tool controls, human approval, logs and test records.
- Neither certificate gives a presumption of conformity under the EU AI Act, and SOC 2 has no AI-specific criteria.
- Test evidence for the agent itself (reproduced attacks, approved fixes and retests) is the part teams most often lack.
ISO/IEC 42001: Is AI governed?
ISO/IEC 42001:2023 sets requirements for an AI management system. It follows the same structure as ISO/IEC 27001. Clauses 4 to 10 cover the organization's context, leadership, planning (including AI risk assessment, risk treatment and AI system impact assessment), support, operation, performance evaluation and improvement.
Annex A lists 38 reference controls in nine areas: AI policies, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use of AI systems, and third-party and customer relationships. For agents, the controls that matter most are verification and validation (A.6.2.4), deployment (A.6.2.5), operation and monitoring (A.6.2.6), event logs (A.6.2.8), responsible use (A.9) and third parties (A.10).
Accredited certification bodies certify the management system in a two-stage audit: a documentation review, then a test of whether the system operates. The certificate lasts three years, with annual surveillance audits. Europe adopted the identical text as EN ISO/IEC 42001:2026, but it is not a harmonised standard under the EU AI Act.
AIUC-1: Is this agent safe to deploy?
AIUC-1 is a private certification standard for AI agent security, safety and reliability, published by the Artificial Intelligence Underwriting Company (AIUC). Only AIUC issues certificates, on the recommendation of an accredited auditor. It is not an ISO, NIST or government standard.
- Scope: a certificate covers specific agents or products, not a whole company.
- Requirements: 50 requirements across six principles: data and privacy, security, safety, reliability, accountability and society.
- Testing: thousands of benign, social engineering and adversarial scenarios run against the agent. To pass, there must be no open critical (P0) or high (P1) findings. Findings must be fixed and the tests run again.
- Validity: the certificate is valid for 12 months, and evaluations must run at least every three months to keep it valid.
- Updates: the standard changes every quarter. The October 15, 2026 release made human approval of sensitive tool operations a core control, to address risks from browser agents.
AIUC is clear about the limits: "certification represents a point-in-time assessment of controls, not a warranty of future performance or outcomes."
How they compare
| ISO/IEC 42001 | AIUC-1 | |
|---|---|---|
| What is assessed | The organization's AI management system | Specific agents or products |
| Who issues it | Accredited certification bodies | AIUC only, on an accredited auditor's recommendation |
| Adversarial testing | Not prescribed; verification and validation (A.6.2.4) | Required: independent evaluations, no open P0 or P1 findings |
| Certificate life | Three years, with annual surveillance audits | 12 months, with evaluations at least every three months |
| How often it changes | ISO's multi-year review cycle | Every quarter |
AIUC says AIUC-1 incorporates most ISO 42001 controls and extends them with third-party testing. Regulated buyers increasingly want both kinds of evidence: governance for the company and test results for the agent.
SOC 2 does not fill this gap. The AICPA's TQA Section 9561 (September 2026) says AI creates no separate criteria. It is in scope only where it affects the system and services already in the examination.
The evidence pack for an AI agent
Most evidence serves both standards. This mapping is indicative and follows AIUC's published ISO 42001 crosswalk. AIUC-1 changes every quarter, so check each control in the current text before you rely on it.
| Evidence | AIUC-1 | ISO/IEC 42001 |
|---|---|---|
| Agent inventory: owner, purpose, tools, data and risk tier | E017, E011 | 4.3, A.4 |
| Risk and impact assessment for the use case | C001 | 6.1.2, 6.1.4, 8.2, 8.4, A.5 |
| Agent identity and least-privilege access | A003, B006.1, B007 | A.9.2, A.10.2 |
| Tool allowlist and checks before each tool call | D003.1, B006.3 | A.6.2.5, A.9.4 |
| Human approval for sensitive actions | D003.4, C007 | A.9.2 |
| Tamper-evident logs of tool calls, data access and approvals | D003.3, E015 | A.6.2.8 |
| Pre-deployment test results and sign-off | C002.1 | A.6.2.4, A.6.2.5 |
| Independent adversarial evaluation report | A009, B001, C010, D004, E018 | A.6.2.4 |
| Monitoring and alerting in production | B002, B006.2, C008 | A.6.2.6, 9.1 |
| Change control for models, prompts, tools and guardrails | E004.1 | 6.3, A.6.2.2 |
| Vendor and model due diligence | E006, E009 | A.10.3 |
If you also report against the OWASP agent risks, OWASP's AIUC-1 crosswalk links each risk in its agentic Top 10 to the matching AIUC-1 requirements. NIST's AI Resource Center hosts crosswalks from the NIST AI RMF to ISO/IEC 42001. For a crosswalk from the agentic Top 10 to MITRE ATLAS techniques and NIST AI RMF outcomes, see Mapping AI agent risks to MITRE ATLAS and the NIST AI RMF.
Where agent testing fits
Most teams can write policies. What they lack is test evidence for the agent itself. AIUC-1's third-party testing controls ask for a report that shows the risks tested, the testing method and the findings. Certification needs critical and high findings fixed and tested again. ISO/IEC 42001 asks for verification and validation (A.6.2.4) and event logs (A.6.2.8).
Build that evidence before the audit:
- Test the agent's real job, tools and permissions on an isolated copy. Our guide to AI penetration testing for agents covers what to test.
- Fix what you find, test again and keep the records.
- Replay approved tasks to show the fix did not break the agent's work.
- Enforce the approved rules at runtime, and log each action that was allowed, held for approval or denied.
AIUC runs the certification evaluations itself today. Whether an auditor accepts another party's test report is a decision for AIUC and the auditor.
Questions
What is AIUC-1?
AIUC-1 is a private certification standard for AI agent security, safety and reliability, published by the Artificial Intelligence Underwriting Company (AIUC). It has 50 requirements across six principles. A certificate covers specific agents, is valid for 12 months and needs new evaluations at least every three months.
What is the difference between AIUC-1 and ISO 42001?
ISO/IEC 42001 certifies an organization's AI management system: policy, risk and impact assessment, controls, monitoring and improvement. AIUC-1 certifies specific agents and requires independent adversarial testing. In AIUC's words, ISO 42001 focuses on governance frameworks and management systems, while AIUC-1 validates the robustness of safeguards through independent evals.
Does ISO 42001 certification prove EU AI Act compliance?
No. ISO/IEC 42001 is not a harmonised standard under the EU AI Act, so certification gives no presumption of conformity. It does help organize the governance evidence the Act asks for.
Does SOC 2 cover AI agents?
SOC 2 has no AI-specific criteria. The AICPA's TQA Section 9561 (September 2026) says AI is in scope only where it affects the system and services already in the SOC 2 examination.
How long does AIUC-1 certification take?
AIUC's FAQ says most organizations earn the certificate in 5 to 10 weeks, and that companies starting from zero may take longer.