AIUC-1: The Agent Standard That Prices Its Controls Into an Insurance Policy
AIUC-1 is the framework on this list with a price tag attached: it is the only one whose controls are audited so an insurer can write a policy off the result. Of its six risk categories and 51 named controls, the Q2-2026 update reworked the ones a coding-agent team cares about most, agent identity and just-in-time credentials, MCP runtime containment, and tool-call logging, which are the same mechanisms Build the Environment and the seven properties describe. The publisher is not a standards body. It is the Artificial Intelligence Underwriting Company, an insurer that came out of stealth in July 2025 with a $15M seed round led by Nat Friedman, reported as the largest seed in insurance history, with Anthropic co-founder Ben Mann and former CISOs of Google Cloud and MongoDB participating.
The standard exists to price an insurance policy
AIUC's model is a three-pillar loop: a standard (AIUC-1), an independent audit against it, and an insurance policy priced off the audit result. Per Fortune, "insurance policies cover customers and vendors in the event an agent causes harm, with pricing that reflects how safe the system is." Audits adversarially try to make agents fail, hallucinate, leak data, or act dangerously.
The founders are telling: Rune Kvist (CEO, first product/GTM hire at Anthropic), Brandon Wang (CTO, Thiel Fellow), Rajiv Dattani (ex-McKinsey insurance partner, former COO of METR). Friedman's stated motivation comes from watching enterprises hesitate on Copilot over IP and trust concerns while he ran GitHub. The pitch is the historical pattern of insurers building safety infrastructure: Franklin's mutual fire insurance, UL Labs, crash-test standards. Phil Venables, former Google Cloud CISO and an AIUC-1 technical contributor, frames the demand side: "We need a SOC 2 for AI agents - a familiar, actionable standard for security and trust."
Six risk categories, 51 controls, and the biggest one is accountability
The standard organizes everything an enterprise worries about into six categories. Accountability is the largest, with 17 of the 51 controls, which is the same bet this handbook makes: the work of proving an agent is safe is mostly the work of recording who did what. Counting the published navigation:
| Category | Controls | Representative controls |
|---|---|---|
| A. Data & Privacy | 7 | Limit AI agent data access; prevent cross-customer data exposure; prevent PII leakage |
| B. Security | 9 | Prevent unauthorized AI agent actions; protect AI system deployment environment; third-party adversarial testing |
| C. Safety | 12 | Pre-deployment testing; flag high-risk outputs for human review; third-party testing for harmful outputs |
| D. Reliability | 4 | Prevent hallucinated outputs; restrict unsafe tool calls |
| E. Accountability | 17 | Assign accountability; log AI system activity; AI failure plans; record processing locations |
| F. Society | 2 | Prevent AI cyber misuse; prevent catastrophic misuse |
It publishes crosswalks to ISO 42001, MITRE ATLAS, the EU AI Act, NIST AI RMF, and the OWASP Top 10, positioning itself as the operational layer under those frameworks (AIUC's own comparison: ISO 42001 establishes the management system, AIUC-1 validates safeguards through independent technical testing; see ISO 42001). The Accountability category is the handbook's attribution and audit-trail properties restated as insurance prerequisites.
The Q2-2026 update describes the same mechanisms this handbook builds
AIUC-1 releases on a fixed cadence: January 15, April 15, July 15, October 15. The Q2-2026 update (April 15, 2026) changed 14 requirements and 23 controls, after technical sessions with 120+ consortium members and 200+ peer-review comments. Each new agent control names a mechanism the environment chapter already produces evidence for:
- A003.3 / A003.4 split agent identity management from access management and ask for "just-in-time credential issuance scoped to individual subtasks or tool calls." That is the least-privilege property and the per-session, task-scoped token that produces attribution evidence.
- B006.3 asks for runtime containment of agents and MCP servers: tool definition integrity, restricted filesystem and network access, pre-execution policy hooks. B006.1 added MCP server allowlisting. The handbook's answer is the per-task sandbox and isolation property.
- B008.4 asks for cryptographic message signing for agent-to-agent communication, plus schema validation and input sanitization for MCP tool-call I/O. Signing applies to A2A messages, not MCP calls; the shorthand "signed tool calls" overstates it.
- E009 ("Monitor third-party access") was promoted to mandatory; E015.2 extends logging to tool calls and sub-agent actions; D003.4 expands human-approval workflows to multi-step operations. These are the audit-trail property and the review gate, restated as evidence requirements.
One nuance worth holding onto: A003.4 and B006.3 are supplemental ("may include") controls, not core mandatory ones. The standard names the right mechanisms; it does not yet require all of them. A team that built the environment first already has the artifacts these controls ask for.
Certification is starting to mean something for coding agents
Schellman became the first accredited AIUC-1 auditor, the same firm Intercom engaged when it confirmed AIUC-1 alongside SOC 2 and ISO 42001 for its AI PR review system. ElevenLabs is the first voice AI company certified. For coding agents, the test case is Lovable: AIUC's agentic development whitepaper, co-authored with Lovable, identifies 75 coding-agent-specific risks and frames the stakes plainly: "A hallucinated authentication pattern is no longer an inconvenience, it's a vulnerability shipping to production." Lovable's Schellman audit is scheduled for summer 2026.
Why this matters to a team running agents: the broader insurance market is moving the other way, with absolute AI exclusions appearing in D&O and E&O lines (see who pays). The market is bifurcating into certified-and-insured agents on one side and an uninsured deployer-pays default on the other, and the dividing line is exactly the attribution and audit evidence this handbook describes (see certified and insured).
The standard is documented, but no claim has ever been paid
The standard is documented; the loss experience is not. As of June 2026, there is no public AIUC policy form, no named carrier, no published limits or exclusions, and no publicly disclosed paid claim. The whitepaper on agentic development does not discuss payouts or liability allocation. No court anywhere has decided liability for a defect in agent-written code.