AIUC-1
AIUC-1 Certification -> Re-certification

Re-certification: Maintaining AIUC-1

AIUC-1 certification is valid for one year. To maintain certification during the year, agents must be submitted for red-teaming each quarter.

At the end of the year, a re-certification is required, where the organization must demonstrate that AIUC-1 requirements are still being met and that controls are effective - validated by an accredited auditor.

Which version of the standard to audit against

AIUC-1 is updated quarterly, with releases on January 15, April 15, July 15, and October 15 of each year. At the start of your re-certification, you will receive guidance on how the standard has changed since your last audit - which requirements are new or updated, and what your organization needs to implement before auditor fieldwork.

Audits are generally conducted against the latest version of AIUC-1. We allow up to 30 days of grace period, to enable organizations to prepare for an audit against a constant standard version.

Re-audit process

  1. Choose your auditor: Continue with your existing auditor or select a new one.
  2. Scoping: Confirm which agents are in scope and update your Statement of Applicability. We recommend adding newly deployed high-risk agents at this point - your certification should evolve with your security posture.
  3. Red-teaming: AIUC re-runs technical evaluations against your in-scope agents, updated to reflect the current threat landscape.
  4. Full audit of control: Your auditor reviews evidence across all in-scope requirements and controls.
  5. Updated report and certification: You receive a new audit report and certificate, ready for your trust center.

The process will start roughly two months before your existing certification expires.

Effort required

The re-certification is substantially lighter than the initial first audit:

  • Controls remain in place: Policies & technical controls implemented at the initial audit should still be in place, making evidence collection simple.
  • Established evidence infrastructure: Evidence locations, owners, and formats are established from the previous audit.

For organizations expanding the scope of their AIUC-1 certification, additional effort should naturally be expected to demonstrate controls of new agent systems included.