There's a new compliance framework that most companies haven't heard of yet. Within the next 12 months, enterprise buyers are going to start asking about it. If you build or sell AI products, you should understand it now.
It's called AIUC-1. It's the first certifiable security standard built specifically for AI agents.
Why existing frameworks aren't enough
SOC 2 covers whether your security controls are designed and operating. ISO 27001 covers your information security management system. ISO 42001 covers AI management. HIPAA covers protected health information. These are all valuable frameworks. None of them were designed to answer a specific question that enterprise buyers increasingly need answered:
"When your AI agent connects to my systems, accesses my data, and takes actions autonomously, how do I know it's safe?"
SOC 2 doesn't test whether your AI agent can be jailbroken. ISO 27001 doesn't evaluate whether your agent leaks PII through its outputs. ISO 42001 covers AI governance broadly but doesn't get into the operational controls for agents that execute code, call tools, and chain actions across systems.
That's the gap AIUC-1 fills.
What AIUC-1 actually covers
The framework has 51 requirements and 130 controls organized across six pillars: Data and Privacy, Security, Safety, Reliability, Accountability, and Society. In practical terms, here's what that means:
1) Data and Privacy. Does your AI agent have policies governing what data it can access and what it does with outputs? Can it leak PII, credentials, or trade secrets through its responses? Does it prevent cross-customer data exposure?
2) Security. Can your agent withstand adversarial input (prompt injection, jailbreaking)? Are tool calls restricted to approved actions? Is the deployment environment hardened? If your agent connects via MCP (Model Context Protocol), are those connections authenticated, encrypted, and sandboxed?
3) Safety. Has the agent been tested for harmful outputs before deployment? Is there a human review process for high-risk outputs? Can the system be intervened in real-time if something goes wrong?
4) Reliability. Does the agent hallucinate? How often? Has it been independently tested? Are tool calls validated so the agent can't take unsafe actions?
5) Accountability. Who's responsible when the agent makes a mistake? Is there an incident response plan specifically for AI failures (security breaches, harmful outputs, hallucinations)? Is agent activity logged? Do you conduct vendor due diligence on your upstream AI providers?
6) Society. Can the agent be misused for cyberattacks or catastrophic harm?
If you've been following our AI governance series, a lot of this should sound familiar. We've been writing about these exact risks, especially around agentic tools like Cowork and Claude Code, for weeks. AIUC-1 is the framework that's formalizing what practitioners already know: AI agents operating inside enterprise environments need their own set of controls.
What makes AIUC-1 different from other frameworks
Three things stand out.
It updates quarterly. SOC 2, ISO 27001, HITRUST: these frameworks update on annual or multi-year cycles. AIUC-1 updates every quarter because AI moves too fast for annual reviews. The Q1 2026 update modified 26 requirements and added 40+ voice-specific controls. The Q2 update added MCP security controls, agent identity governance, and third-party risk monitoring. The Q3 update (July 15) is adding coding agent requirements for tools like Claude Code and GitHub Copilot. That cadence is unprecedented in compliance. It also means companies pursuing certification need to stay current, not just pass an audit and forget about it.
It's certifiable. This isn't a set of guidelines or a best practices document. It's a certifiable standard with accredited auditors (Schellman was the first), defined evidence requirements, and 12-month certificates that require quarterly technical testing to maintain. The Cloud Security Alliance has already integrated AIUC-1 into its STAR registry alongside ISO 42001 as a Level 2 designation. Drata has added native AIUC-1 support.
It's AI-specific. AIUC-1 explicitly does not cover the stuff that SOC 2 and ISO 27001 already handle. It doesn't duplicate network security, access management, or change management controls. It focuses on risks that only exist when AI agents are operating: prompt injection, hallucination, unauthorized tool calls, agent identity, MCP server security, credential leakage through AI outputs, and autonomous action governance. It's designed to layer on top of your existing compliance program, not replace it.
Why this matters for healthcare AI companies
If you're building AI products for healthcare, this is heading your way fast.
Health systems and payers are already adding AI-specific questions to vendor assessments. Many are standing up AI review boards. The questions they're asking (How do you prevent hallucinated clinical outputs? What happens if the AI accesses PHI it shouldn't? How do you validate model outputs before they reach patients?) map directly to AIUC-1 controls.
Right now, most companies answer these questions with custom documentation or by pointing to ISO 42001 alignment. Within the next year, expect some enterprise buyers to start asking for AIUC-1 certification the same way they ask for SOC 2 today.
The MCP angle
The Q2 update added specific controls for MCP security. If your AI agents use MCP to connect to external tools and services (Slack, databases, cloud consoles, file systems), AIUC-1 now requires connections restricted to approved MCP servers, runtime sandboxing for MCP execution environments, authentication across all AI interfaces including MCP and A2A channels, encrypted data in transit across MCP connections, and tool call logging with MCP server-level metadata.
This matters because MCP is becoming the standard protocol for AI agents to interact with enterprise systems. The attack surface is real. A compromised MCP server was already exploited this year through a widely-used Figma integration that gave attackers remote code execution on developer machines.
What to do now
1) If you build AI agents: Start mapping your controls to AIUC-1. You don't need to pursue certification tomorrow, but understanding the requirements now means you're building controls that will satisfy the framework when enterprise buyers start asking. Drata already supports AIUC-1 if you're on that platform.
2) If you use AI agents internally: Your AI governance program (inventory, acceptable use policy, technical controls, vendor governance) already covers a lot of what AIUC-1 addresses on the enterprise buyer side. Make sure your vendor assessments include AI-specific questions for any vendor whose AI agents touch your data or systems.
3) If you sell into healthcare or enterprise: Start building your AI disclosure documentation now. The companies that can answer AIUC-1-style questions clearly and specifically will close deals while competitors scramble to figure out what MCP security even means.
The bottom line
AIUC-1 is doing for AI agents what SOC 2 did for SaaS security: creating a structured, certifiable way for companies to demonstrate that their AI is safe, secure, and governed. It's early. Most companies haven't heard of it yet. But the trajectory is clear. The companies that understand this framework now will be ahead of the market when the questions start showing up in procurement.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies. [com-sec.com]