How AIUC-1 controls map to TrustEvals operating outputs. Built for finance auditors and risk teams.
For each control family, what AIUC-1 expects and what TrustEvals produces. The same trace data that drives your operating view.
Personal data handling, classification, minimization, retention, cross-border flow, data-subject rights.
Per-tenant data handling log. Classification + source pointer per interaction. Cross-border flow inventory. Data-subject-request workflow.
Access control, authentication, prompt-injection defenses, tool-call authorization, audit logging.
Authorization exception log. Prompt-injection detection rates. Authentication and authorization audit trail per invocation.
Harmful output filtering, jailbreak resistance, escalation paths, human oversight for consequential actions.
Versioned safety baseline. Safety-violation incident log with resolution trace. Human-in-the-loop trigger audit.
Groundedness, factuality, multi-turn consistency, performance under load, fallback behavior.
Groundedness SLO (rolling 30-day). Multi-turn consistency metric per agent. Documented and tested fallback behavior.
Decision provenance, audit logs, human ownership, change history for policy, baseline, prompt, and model.
Decision chain per interaction. Human-owner registry. Change log for every policy, baseline, prompt, and model update.
Bias and fairness, demographic parity, impact assessments, disclosure practices.
Per-use-case bias evaluation. Versioned impact assessment with named owner. Populated disclosure templates.
Most finance enterprises running AI at scale want both an organization-level standard and an agent-level standard. Here is how AIUC-1 pairs.
Three patterns finance auditors actually look for. The same patterns hold whether the standard is AIUC-1, ISO 42001, or SR 11-7.
A signed-off threshold document. Loan underwriting agent and marketing copy agent have different baselines, and the auditor sees both with timestamps and owners.
Every decision points to the data that informed it, the policy that permitted it, the baseline it was evaluated against, and the human who owns it.
Every artifact timestamped. Evidence current as of today, not last quarter. The auditor can ask what the system was doing yesterday at 3:47 pm and get an answer.
Thirty minutes to size the discovery surface: employees, devices, SaaS admin access, developer tooling, internal agents, Shadow AI exposure, and the outcome read you need at the end.
No. Certification is done by AIUC Inc. or an authorized third-party. TrustEvals produces the evidence the certifier needs, plus the evidence that the certification is still accurate next month.
Scope. ISO 42001 is a management-system standard. AIUC-1 is an agent-level standard. Most finance enterprises running AI at scale want both.
Yes. The same evaluation data maps to NIST AI RMF MEASURE functions, ISO 42001 Clause 8 (operation), and EU AI Act high-risk requirements.
Three to five weeks per agent, depending on current instrumentation. Faster if we have already run an AI Audit and the governance foundation is set.
