AIUC-1 Requirements: All 6 Risk Domains Explained

If you sell AI agents into the enterprise, you've likely heard AIUC-1 described as "SOC 2 for AI agents." That comparison is useful shorthand, but it undersells how different the two actually are. SOC 2 was built for infrastructure that mostly sits still. AIUC-1 was built for software that acts autonomously, calls tools, moves money, and makes decisions without a human in the loop, and its requirements reflect that.

This guide breaks down what AIUC-1 actually requires: the six risk domains, how many controls are mandatory versus optional, and what changed in the standard's first two updates since launch.

What AIUC-1 Is, in One Paragraph

AIUC-1 is a certification standard launched in mid-2025 by AIUC (AI Underwriting Company), built specifically for AI agents rather than AI models or software in general. It was developed with input from a consortium of Fortune 500 CISOs and technical contributors from organizations including Cisco, MITRE, Stanford, and Anthropic. Schellman, one of the largest SOC 2 auditing firms, is the first accredited AIUC-1 auditor; ElevenLabs was the first company to earn the certification.

The standard is also unusually current for a compliance framework: rather than a static annual update cycle, AIUC-1 itself is revised quarterly to keep pace with how fast agentic AI is changing. That's both its biggest strength and the thing that makes it genuinely harder to stay certified against than a standard like ISO 42001 or SOC 2.

The 6 Risk Domains

AIUC-1's requirements are organized into six domains. Each addresses a category of risk that traditional security or privacy frameworks weren't built to catch:

The Data & Privacy domain is the one to prioritize first if you're just starting: its seven requirements are all mandatory, and they map directly to the risk enterprise buyers ask about most, whether one customer's data can leak into another customer's agent session.

How Many Requirements and Controls, Actually

This is where a lot of secondhand summaries get sloppy, so here's the precise, current breakdown:

• 51 original requirements across the six domains, though a Q1 2026 update merged two of them, bringing the count of currently active requirements to 49.

• 130 controls sit underneath those requirements, of which 65 are mandatory and 65 are optional.

• How many controls actually apply to you depends on what you've built. A straightforward, single-purpose agent typically needs to satisfy around 40 controls. A complex, multi-modal agent handling sensitive data across multiple tools often needs closer to 65.

This is a meaningfully different structure than ISO 42001's Annex A, where all 38 controls are a reference set you select from freely based on your own risk assessment. AIUC-1 draws a harder line between mandatory and optional, and the security, safety, and reliability domains specifically require adversarial testing, not just documentation, meaning a written policy alone won't satisfy those requirements the way it might under other frameworks.

What Changed Since Launch (Because the Standard Moves Fast)

Because AIUC-1 updates quarterly, a summary written even six months ago may already be outdated. Two recent revisions are worth knowing about specifically:

• January 2026 revision: clarified a number of existing requirements and introduced a new block of voice-specific controls, a direct response to the rapid growth of voice-based AI agents.

• Q2 2026 update: added controls addressing MCP (Model Context Protocol) security, third-party risk management, and, most significantly, agent identity and permissions management, the question of whether a system can reliably identify what's making an access request and enforce what it's allowed to do at that moment.

If you're building an AIUC-1 program, treat "current requirements" as a moving target and check the standard's latest revision before finalizing your scope, not a one-time reference document.

How Certification Actually Works

• Certificates are valid for 12 months, but staying certified requires passing quarterly technical exams, not just an annual review. This is the standard's core design choice: agentic AI changes fast enough that a once-a-year audit would already be stale by the time it's issued.

• Certification is conducted by an accredited third-party auditor (Schellman is currently the primary one).

• AIUC-1 is also, notably, backed by insurance, AIUC puts its own underwriting behind certified outcomes, which is a structurally different model than ISO or SOC 2 certification bodies use.

One honest caveat worth knowing before you commit resources to this: AIUC-1 is young and self-accredited, it doesn't yet carry the decades of accreditation infrastructure that ISO standards or AICPA-governed SOC 2 audits do. That doesn't make it less useful, agentic AI risk is real and current frameworks genuinely don't cover it well, but it's worth going in with clear eyes about where the standard is in its maturity curve.

AIUC-1 vs. ISO 42001: Quick Comparison

Since these two are increasingly evaluated side by side:

They're not competitors so much as different layers: ISO 42001 governs how your organization manages AI broadly, AIUC-1 governs whether a specific agent is safe to deploy.

How DSALTA Helps

DSALTA doesn't issue AIUC-1 certificates, that's the accredited auditor's role. What DSALTA helps with is the part that's hardest to sustain given the standard's quarterly cadence: keeping your control evidence current between technical exams instead of rebuilding your documentation from scratch every three months, and mapping controls you've already built for SOC 2 or ISO 42001 onto AIUC-1's requirements where they genuinely overlap.

Frequently Asked Questions

Is AIUC-1 mandatory? No. It's a voluntary, market-driven certification, not a legal requirement. Its relevance comes from enterprise buyers increasingly asking for it during AI vendor security review, similar to how SOC 2 became a de facto requirement for SaaS without ever being legally mandated.

How is AIUC-1 different from SOC 2? SOC 2 was built to evaluate infrastructure and organizational controls generally. AIUC-1 was built specifically for autonomous AI agents, covering risks like prompt injection, hallucination, and unauthorized autonomous actions that SOC 2's Trust Services Criteria were never designed to address.

How often do I need to re-certify? The certificate itself is valid for 12 months, but you must pass quarterly technical exams to remain certified during that period. This is different from most compliance frameworks, which only require a single annual audit.

Do all 130 controls apply to my agent? No. The 65 mandatory controls apply broadly, but which of the 65 optional controls apply depends on your agent's complexity and risk profile. Simple agents often need around 40 total controls; complex, multi-modal agents often need closer to 65.

Can I reuse my ISO 42001 or SOC 2 work for AIUC-1? Partially. Governance-level work, like incident response planning, vendor due diligence, and risk taxonomy, often transfers. But AIUC-1's security, safety, and reliability domains require actual adversarial testing against your live agent, which isn't something a SOC 2 or ISO 42001 audit produces on its own.