AITBM

TIER 1 · CERTIFICATION AND INSURANCE STANDARD

AIUC-1 to AITBM Mapping

Relates AIUC-1 requirements to AITBM evidence, assurance, and operational-risk inputs without treating certification as a score.

Pr-1Pr-2Pr-3Pr-4Ro-1Cn-1Cn-2Cn-3

How to use this crosswalk

External requirements, controls, threats, and practices identify evidence to collect or tests to run. Only measured evidence from the assessed deployment determines AITBM rubric placements, IVP, ORP, ACI, MVT findings, and ERS.

Mapping content last verified 2026-08-13. No endorsement by the external framework owner is implied.

AIUC-1

Certification + insurance standard for AI agents

AIUC-1 (Artificial Intelligence Underwriting Company Standard 1) · Artificial Intelligence Underwriting Company (AIUC)

AIUC-1 is a pass/fail, Lloyd's-insured certification standard for AI agents. Its July 15, 2026 edition has 51 active requirements (43 mandatory and 8 optional); current total control counts are not published. AITBM adds a quantitative, multi-dimensional, confidence-graded risk score that a binary certificate does not express.

AIUC-1 Domain Primary AITBM Sub-Metrics Evidence Use / Notes
A - Data & Privacy (8 requirements)Pr-1Pr-2Pr-3Pr-4Verified privacy and data-handling evidence may support the listed rubrics; the domain does not assign a tier
B - Security (10 requirements)Ro-1Cn-1Cn-2Current adversarial-test evidence may support Ro-1 when coverage and effectiveness requirements are met
C - Safety (12 requirements)Cn-3Fa-1Fa-2Fa-3Fa-4Ro-3Measured safety and bias-test evidence may support applicable Cn, Fa, and Ro rubrics
D - Reliability (4 requirements)Ro-3Cn-1Cn-2D002 testing may support Ro-3 and may refresh covered Tf evidence when AITBM admissibility rules are met
E - Accountability (15 requirements)Tr-1Tr-3Tr-4Current accountability and logging evidence may support Tr-3/Tr-4 and inform Rf
F - Society (2 requirements)Cn-2Cn-3Tr-4Misuse scenarios provide assessment context; they do not assign a tier or ACI cap automatically

Key findings

  • The current auditor roster contains seven organizations: Schellman, Coalfire, BDO, Grant Thornton, Mastermind, Sensiba, and A-LIGN; AIUC marks every organization except Schellman as provisional.
  • AIUC-1's insurance mechanism and AITBM's residual-risk floor address different questions: risk transfer versus risk quantification. Their coexistence is conceptually consistent with non-zero residual risk, but it does not validate AITBM's selected alpha=0.15 value.
  • The official AIVSS-AIUC-1 crosswalk maps only about two controls each to Agent Identity Impersonation (E016, F001) and Multi-Agent Orchestration (B006, E010); this coverage is thin and policy-and-disclosure oriented rather than a graduated cryptographic-identity rubric - the depth that AITBM's Cn-5 (Agent Identity Integrity) and agentic/MCP weighting add.
  • AIUC-1's quarterly third-party re-testing cadence can provide refresh evidence for covered sub-metrics. Tf resets only when the report satisfies the applicable AITBM evidence-quality, coverage, and event rules.
  • Division of labor mirrors AISVS: AIUC-1 answers whether controls are implemented/verified and who pays if they fail (binary cert + Lloyd's-backed insurance up to $50M); AITBM answers how risky the system is, across dimensions, with what confidence, over time.

AIUC-1 reference →