AIUC-1 changelog

Updated typical evidence descriptions to move away from screenshots in favor of substantive and verifiable evidence

Included both opt-in and out practices

Included both opt-in and out practices, ensuring balanced coverage of consent models

Added new control to incorporate implementation testing to A002

Specified that the requirement covers data access more generally, and included more controls on agent IAM within it

Clarified the control to cover agent access and identity management, not just data collection

Separated agent identity and access management into distinct controls, with a focus on providing configurable, auditable architecture that integrates with enterprise IAM systems

Separated agent identity and access management into distinct controls, with a focus on providing configurable, auditable architecture

Clarified that monitoring is to enable responding to adversarial inputs

Changed on a controls level - MCP coverage and additional execution-level containment controls

Covered MCP server access alongside existing API and service-level restrictions

Added execution-level containment controls that limit the blast radius when an agent or approved MCP server behaves unexpectedly at runtime

Expanded scope of requirement from the AI model only to system

Expanded scope of control from the AI model only to system

Expanded deployment security controls to address MCP and A2A protocols alongside traditional API endpoints, with dedicated controls for authentication, transport security, and message integrity across all agentic interfaces

See above

See above

Generalized the risk taxonomy requirement and changed testing frequency to every 12 months

Aligned testing frequency to a 12-month cycle consistent with the risk management framework update schedule

Clarified that the requirement is in scope for AI agents that generate code (see C006.1, C006.2, C006.3), and text (see C006.2)

Clarified that the control is in scope for code-generating AI agents

See above

See above

Clarified that C007 is about human in the loop via updated label

Expanded requirement scope from recommendations to generalized outputs

Included example of auditing human review workflows (i.e., checking the effectiveness of oversight over time) to mitigate against ‘automation bias’

Changed on a controls level - synthesized controls and added in control to action user feedback

Included practical validation and actioning of relevant user feedback, and streamlined three controls into one

Changed on a controls level - extends tool call validation to cover MCP servers alongside approved functions, expands scope of human approval for sensitive tool operations to cover multi-step workflows

Extended tool call validation to cover MCP servers alongside approved functions

Extended tool call validation to cover MCP servers alongside approved functions

Expanded scope to cover multi-step workflows, reflecting trends of AI agents increasingly chaining tool calls across sequential operations rather than executing single actions in isolation

Clarified that the requirement is around ensuring companies establish clear security and compliance requirements for hosting platforms, rather than the act of cloud vs on-prem assessment

Enforced E009 as a mandatory control

Expanded scope of requirement from the AI model only to system

Extended logging to cover the intermediate steps between input and output (i.e., tool calls, sub-agent actions, and provenance metadata) getting traceability across the full execution chain

Changed on a controls level - adjusts disclosure to AI agents and systems

Adjusted disclosure to AI agents and systems