What is AIUC-1?
AIUC-1 describes itself as “the standard for AI agent security, safety and reliability.” It is organized in six domains: A. Data and privacy, B. Security, C. Safety, D. Reliability, E. Accountability and F. Society. The standard is updated quarterly. The version current at the time of writing is the Q4 2026 update of 15 October 2026.
Certification has four steps: scoping the agent and its deployment, technical evaluations run by AIUC (typically 1,000 to 5,000 scenarios, including red-teaming), an audit by an accredited third-party auditor, and the certificate. The certificate is valid for one year, and the agent is retested quarterly against the version it was certified to.
How often does AIUC-1 require third-party testing?
Each domain has a third-party testing control: A009 (data and privacy), B001 (security), C010 (safety), D004 (reliability) and E018 (accountability). Each asks for qualified third-party assessors, a defined scope, documented results, and assessments of high-risk areas at least every quarter.
Several earlier testing controls, including C011 (out-of-scope outputs), C012 (customer-defined risk) and D002 (hallucinations), are now marked retired on the evidence page, so check the current version before mapping old reports to it.
Which controls matter for an agent that can issue refunds or discounts?
These are the controls whose evidence a refund, credit or discount agent will be asked for. Control IDs and titles are as published on the AIUC-1 evidence page.
| Control | What it asks | What it means for a refund agent |
|---|---|---|
| D003 Restrict unsafe tool calls | Tool-call validation and authorization. Rate limits and transaction caps for autonomous tool use | The refund and discount tools check every call and enforce caps outside the model |
| D003.1 Tool authorization and validation | Validate that each tool call is permitted and well-formed | Refund amount, order, customer and reason code are checked before execution |
| D003.2 Rate limits for tools | Per-tool quotas, time-windowed limits and circuit breakers | Limits per conversation, per customer and per day, not only per call |
| D003.3 Tool call log | Log tool name, version, parameters and timestamps | Every refund and credit can be traced to the conversation that caused it |
| D003.4 Human-approval workflows | Human approval for high-risk actions. Executing financial transactions is given as an example | Refunds above a threshold, or outside policy, wait for a person |
| B006 Prevent unauthorized AI agent actions | Service access restrictions, monitoring and alerting, execution-level safeguards | The agent’s credentials cannot reach payment functions it does not need |
| D001 Prevent hallucinated outputs | Factual accuracy controls, source validation, communicating uncertainty | Policy and eligibility answers are grounded in the actual policy |
| E004 Assign accountability | Change approval policy and records | Prompt, model and policy changes are approved and recorded |
Where is the gap for financial and negotiation harm?
D003 asks whether a money action was authorized, logged and inside a cap. It does not ask whether the agent was talked into using authority it legitimately has. A $40 goodwill credit can be within every cap and still be the wrong decision, and the same credit granted across ten conversations, or stacked with a discount, adds up.
The third-party testing controls name risks such as prompt injection, harmful outputs and hallucinations. As of the Q4 2026 version, we found no control that mentions refunds, discounts, credits, negotiation or financial loss as a risk to test. Financial topics appear only as an example of a high-risk use case (financial advice, in C001) and of an action needing human approval (D003.4).
For an agent that moves money, that leaves a measurable question open: how many dollars an adversarial customer can extract while every control is working as designed.
Checklist before an AIUC-1 audit of a refund or discount agent
Evidence an auditor can check, organized by the controls above.
- An inventory of every tool that moves money, with its cap, rate limit and approval threshold (D003, D003.2, D003.4).
- Caps and approvals enforced in the payment or order system, not in the prompt (D003, B006).
- A tool-call log linking each refund, credit and discount to its conversation, with periodic reviews (D003.3, D003.5).
- Policy answers grounded in a versioned policy source (D001).
- Failure plans for harmful outputs and hallucinations that cover wrong refunds and invented policy (E002, E003).
- Change records for every prompt, model and policy update (E004.1).
- Quarterly third-party test reports, plus your own adversarial tests of concessions within caps.
Questions
Is AIUC-1 a law?
No. It is a voluntary certification standard. Companies use it to answer enterprise security reviews and, increasingly, insurance questions. It does not replace the consumer-protection or collections rules that apply to what the agent says and does.
Does a hard cap on refunds satisfy D003?
A cap is one part. D003 also asks for validation and authorization of tool calls, rate limits, logging and human-approval workflows for high-risk actions. Evidence for each sub-control is listed separately on the evidence page.
How often does AIUC-1 change?
Quarterly. Controls are added, revised and retired, and a certified agent is held to the version it was certified against for one year. Check the changelog before reusing old evidence.
This page summarizes a published standard and is not legal or audit advice.
Attack families
Free checklist
Get the guardrail checklist for agents that move money.
A one-page PDF of the controls and the test for each. Download it right away, and we email you the link.
Sources
- AIUC-1: the standard for AI agent security, safety and reliability
- AIUC-1: controls and evidence
- OWASP LLM06:2025 Excessive Agency