AIUC-1
Certification standard + linked insuranceAIUC-1 (Artificial Intelligence Underwriting Company Standard 1) · Artificial Intelligence Underwriting Company (AIUC)
AIUC-1 is a pass/fail certification standard for AI agents. Its July 15, 2026 edition has 51 active requirements (43 mandatory and 8 optional); current total control counts are not published. AIUC separately offers certification-linked insurance, while AITBM adds a quantitative, multi-dimensional, confidence-graded risk assessment that a binary certificate does not express. Basis note (2026-10-18): AIUC's October 15, 2026 change lists 50 active requirements (42 mandatory and 8 optional), adds A009 and E018, and retires C011, C012, and D002; the domain counts and routes below remain on the audited July 15, 2026 basis, and D002 routes are historical pending a semantic review.
| AIUC-1 Domain | Primary AITBM Sub-Metrics | Evidence Use / Notes |
|---|---|---|
| A - Data & Privacy (8 requirements) | Pr-1Pr-2Pr-3Pr-4 | Verified privacy and data-handling evidence may support the listed rubrics; the domain does not assign a tier |
| B - Security (10 requirements) | Ro-1Cn-1Cn-2 | Current adversarial-test evidence may support Ro-1 when coverage and effectiveness requirements are met |
| C - Safety (12 requirements) | Cn-3Fa-1Fa-2Fa-3Fa-4Ro-3 | Measured safety and bias-test evidence may support applicable Cn, Fa, and Ro rubrics |
| D - Reliability (4 requirements) | Ro-3Cn-1Cn-2 | D002 testing may support Ro-3 and may refresh covered Tf evidence when AITBM admissibility rules are met (historical July 2026 route; D002 retired 2026-10-15) |
| E - Accountability (15 requirements) | Tr-1Tr-3Tr-4 | Current accountability and logging evidence may support Tr-3/Tr-4 and inform Rf |
| F - Society (2 requirements) | Cn-2Cn-3Tr-4 | Misuse scenarios provide assessment context; they do not assign a tier or ACI cap automatically |
Key findings
- The current auditor roster contains seven organizations: Schellman, Coalfire, BDO, Grant Thornton, Mastermind, Sensiba, and A-LIGN; AIUC marks every organization except Schellman as provisional.
- AIUC's associated insurance offering and AITBM's residual-risk floor address different questions: policy-specific risk transfer versus system-risk quantification. Their coexistence is conceptually consistent with non-zero residual risk, but it does not validate AITBM's selected alpha=0.15 value or establish that insurers use ERS.
- The official AIVSS-AIUC-1 crosswalk maps only about two controls each to Agent Identity Impersonation (E016, F001) and Multi-Agent Orchestration (B006, E010); this coverage is thin and policy-and-disclosure oriented rather than a graduated cryptographic-identity rubric - the depth that AITBM's Cn-5 (Agent Identity Integrity) and agentic/MCP weighting add.
- AIUC-1's quarterly third-party re-testing cadence can provide refresh evidence for covered sub-metrics. Tf resets only when the report satisfies the applicable AITBM evidence-quality, coverage, and event rules.
- Division of labor mirrors AISVS: AIUC-1 answers whether controls are implemented and independently verified; an associated insurance policy may transfer specified losses under its actual terms; AITBM answers how risky the system is, across dimensions, with what confidence, over time.
- Current AIUC primary sources do not identify a general insurance carrier, limit, or pricing formula. AITBM therefore does not repeat prior Lloyd's, $50M, or safety-score pricing claims.