{"schema":"verdict.aiuc1-evidence-map.v1","disclaimer":"AIUC-1 is a standard of the Artificial Intelligence Underwriting Company. Verdict is not affiliated with or endorsed by AIUC, is not an accredited AIUC-1 auditor, and certifies no one. Control names and status are from standard.aiuc-1.com, October 15, 2026 release, read on 2026-11-12; descriptions are paraphrased. Check the current standard before relying on this page.","standard":{"name":"AIUC-1","owner":"Artificial Intelligence Underwriting Company","release":"October 15, 2026","nextRelease":"January 15, 2027","readOn":"2026-11-12","sources":{"e015":"https://standard.aiuc-1.com/accountability/log-model-activity","d003":"https://standard.aiuc-1.com/reliability/restrict-unsafe-tool-calls","changelog":"https://standard.aiuc-1.com/changelog","scope":"https://standard.aiuc-1.com/auditors/deliver-and-certify/scoping/requirements-in-scope","evidence":"https://standard.aiuc-1.com/auditors/deliver-and-certify/evidence-collection","fieldwork":"https://standard.aiuc-1.com/auditors/deliver-and-certify/fieldwork","maintaining":"https://standard.aiuc-1.com/auditors/deliver-and-certify/maintaining-certification","jointSoc2":"https://standard.aiuc-1.com/soc2-joint-offering"}},"case":{"id":"LN-30417","title":"A credit model's withdrawal goes to a lending officer first","summary":"After storm-related income disruption, a credit model recommends withdrawing a pre-approved loan offer. A lending officer checks with the employer and approves a smaller amount instead.","illustrative":true,"page":"https://verdict.systems/s/ln-30417"},"records":[{"step":1,"label":"Credit model recommends withdrawal","evidence_record_id":"ser_a383778f88ae4f060279d8ba137926f8","url":"https://verdict.systems/samples/ser_a383778f88ae4f060279d8ba137926f8.json","payload_hash":"a383778f88ae4f060279d8ba137926f8d11b97d7b71004599d1f60b74dfae8dc","record_commitment":"65723a7438b7c36686ed7658f8016b2dd5380eaa3500a40a10423fc6a5c9b99c","human_review_status":"pending","rekor_log_index":3247822463,"rekor_integrated_time":"2026-10-14T02:19:05Z"},{"step":2,"label":"Lending officer approves a reduced amount","evidence_record_id":"ser_5086c93c22af206a567fa06cf634682e","url":"https://verdict.systems/samples/ser_5086c93c22af206a567fa06cf634682e.json","payload_hash":"5086c93c22af206a567fa06cf634682e0a19a19cd0ca2219d371a55cd6e744ea","record_commitment":"192eb3dfe9fa65765ee508f0e29d00975cbc3370f81419ceef616179ef220ddf","human_review_status":"approved","rekor_log_index":3247822472,"rekor_integrated_time":"2026-10-14T02:19:06Z"}],"link":{"record":"ser_5086c93c22af206a567fa06cf634682e","field":"record.metadata.prior_merkle_root","equals":"65723a7438b7c36686ed7658f8016b2dd5380eaa3500a40a10423fc6a5c9b99c","meaning":"Step 2 was made after step 1's content existed."},"controls":[{"id":"E015.1","title":"Logging implementation","requirement":"E015 Log AI system activity (mandatory, every 12 months)","status":"core","coverage":"in-sample","shows":"Example log entries. Each record holds the input and output summaries, the source system, the model version, the review state, the caller's event time and Verdict's receipt time, all inside the hashed content.","yours":"The logging code or configuration that decides what is captured, and when your system calls Verdict.","status_label":"Core · “should include”","coverage_label":"In the sample"},{"id":"E015.2","title":"AI agent logging implementation","requirement":"E015 Log AI system activity (mandatory, every 12 months)","status":"supplemental","coverage":"partly","shows":"An approval event linked to the step before it. Step 2 holds the reviewer's role and decision, and carries step 1's commitment inside its own hashed content, so step 2 was made after step 1.","yours":"The approver's identity: the sample names the reviewer's role, not the person. Agent provenance metadata, tool-call parameters and results, sub-agent handoffs and reasoning traces, which your agent framework records.","status_label":"Supplemental · “may include”","coverage_label":"Partly in the sample"},{"id":"E015.3","title":"Log storage","requirement":"E015 Log AI system activity (mandatory, every 12 months)","status":"core","coverage":"not-covered","shows":"Nothing. The public sandbox stores no records and keeps no copy.","yours":"Retention periods, access control and masking for the records you keep.","status_label":"Core · “should include”","coverage_label":"Not covered"},{"id":"E015.4","title":"Log integrity protection","requirement":"E015 Log AI system activity (mandatory, every 12 months)","status":"supplemental","coverage":"in-sample","shows":"Cryptographic hashing of each entry, with the commitment logged on Sigstore Rekor, a public log Verdict does not run. Anyone can recompute it. An edited record no longer matches the log entry made when it was sealed. The chain check then walks the two records: each names the one before it inside its hashed content, the steps run 1 to 2, the records commit to a length of 2, and each was logged no later than the next. A missing, reordered or dropped record fails that check.","yours":"A fork. A second record sealed off the same predecessor is not visible to this check until a chain head is published. Keeping every record available to the auditor is the storage control, E015.3.","status_label":"Supplemental · “may include”","coverage_label":"In the sample"},{"id":"D003.3","title":"Tool call log","requirement":"D003 Restrict unsafe tool calls (mandatory, every 12 months, for agents that take actions)","status":"core","coverage":"not-covered","shows":"Nothing. A record is sealed when your system sends a step. It is not a log of each tool call.","yours":"The tool-call log: the originating MCP server, the tool name and version, the input parameters and a timestamp for each call, with alerts on unauthorized attempts.","status_label":"Core · “should include”","coverage_label":"Not covered"},{"id":"D003.4","title":"Human-approval workflows","requirement":"D003 Restrict unsafe tool calls (mandatory, every 12 months, for agents that take actions)","status":"core","changed":"Moved from supplemental to core in the October 15, 2026 release","coverage":"supporting","shows":"A sealed record that an approval decision was logged, with the reviewer's role, and when it was logged.","yours":"The approval workflow itself: its configuration, code or ticketing, and what it holds back until a person confirms.","status_label":"Core · “should include”","coverage_label":"Supporting only"}],"verify":{"needs":["git","curl","Python 3","openssl","a network connection"],"rekor_key_source":"https://raw.githubusercontent.com/sigstore/root-signing/main/targets/rekor.pub","steps":[{"say":"Get the open verifier and the two records.","cmds":["git clone https://github.com/verdictsystems/ser-spec","curl -sO https://verdict.systems/samples/ser_a383778f88ae4f060279d8ba137926f8.json","curl -sO https://verdict.systems/samples/ser_5086c93c22af206a567fa06cf634682e.json"]},{"say":"Take Rekor's public key from Sigstore's own repository, not from the log being checked.","cmds":["curl -sL https://raw.githubusercontent.com/sigstore/root-signing/main/targets/rekor.pub -o rekor.pem"]},{"say":"Check each record: its content and commitment, the Rekor entry and its signature, Rekor's signed entry timestamp, the inclusion proof and the signed checkpoint. Each run ends with \"RESULT: content self-consistent and anchor confirmed\".","cmds":["python3 ser-spec/tools/verify.py ser_a383778f88ae4f060279d8ba137926f8.json --anchor --rekor-key rekor.pem","python3 ser-spec/tools/verify.py ser_5086c93c22af206a567fa06cf634682e.json --anchor --rekor-key rekor.pem"]},{"say":"Walk the chain: step 2 names step 1's commitment inside its hashed content, the steps run 1 to 2, the declared length matches, and each record was logged no later than the next. It ends with \"RESULT: chain of 2 records intact: each record self-consistent and anchored, each names the one before it, steps 1..2 unbroken\". Change one character in either file and it fails.","cmds":["python3 ser-spec/tools/verify.py --chain ser_a383778f88ae4f060279d8ba137926f8.json ser_5086c93c22af206a567fa06cf634682e.json --anchor --rekor-key rekor.pem"]}],"expected_result":"RESULT: content self-consistent and anchor confirmed","expected_chain_result":"RESULT: chain of 2 records intact: each record self-consistent and anchored, each names the one before it, steps 1..2 unbroken","last_run":"2026-11-12"},"does_not_show":[{"title":"Who made either record.","body":"The public sandbox signs each request with a one-time key that names no one. A published registry of signer keys is planned. Until it ships, a record does not identify its maker."},{"title":"Who approved.","body":"The approval record names the reviewer's role and decision, not the person. AIUC-1 lists approver identity among the evidence for E015.2. It comes from your approval workflow."},{"title":"A fork, or records past the end.","body":"The chain check catches a missing, reordered or dropped record among the records you hold, against the length they declare or a head record held separately. It does not see a second record sealed off the same predecessor, and a chain with no declared length or held head can be cut after the last record you hold."},{"title":"That every consequential action reached Verdict.","body":"Nothing is sealed unless your system calls Verdict. Whether every approval and sensitive tool call is sent is a property of your system, and an auditor should test it like any other logging control."},{"title":"That the events happened as described.","body":"A record shows what was sent and, through its log entry, when it was logged."},{"title":"Anything outside the record block.","body":"chain_of_custody, legal_review, notice and surface are display copies outside the hash, and the verifier says so. Read the values inside record."}],"audit_fit":{"note":"Paraphrased from AIUC's public pages for accredited auditors and certifying teams. These are AIUC's statements. Check the source before relying on them.","read_on":"2026-11-12","facts":[{"title":"Supplemental controls are a choice.","body":"E015.2 and E015.4 are supplemental. A team opts in to them on its Statement of Applicability, and can do so until the evidence pack is handed to the auditor. AIUC's guide says opted-in controls are highlighted in the audit report.","page":"Requirements in scope","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/scoping/requirements-in-scope"},{"title":"The core controls carry the verdict.","body":"A Pass on E015 rests on its core controls, E015.1 and E015.3, or on alternative evidence the auditor accepts. A sealed record is not a storage control, so it does not carry E015 by itself.","page":"Auditor fieldwork","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/fieldwork"},{"title":"The audit is point in time.","body":"AIUC-1 audits assess controls at a point in time, and the auditor gives no opinion on a historical record of compliance. A record's log entry shows when that one record existed. It does not widen the audit's opinion.","page":"Auditor fieldwork","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/fieldwork"},{"title":"The version is fixed at kickoff.","body":"Audits run against the latest release, with a grace period of up to 30 days, and the version stays fixed through fieldwork and the report. This page is written against the October 15, 2026 release. The next is due January 15, 2027.","page":"Requirements in scope","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/scoping/requirements-in-scope"},{"title":"Evidence goes to a shared platform.","body":"The team uploads its evidence pack where the auditor and AIUC can reach it. AIUC's guide names Drata, Vanta and Fieldguide as examples. A sealed record and the evidence map are JSON files and upload with the rest.","page":"Evidence collection","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/evidence-collection"},{"title":"AIUC runs the technical evaluations.","body":"Third-party testing, including E018 for accountability risk, is run by AIUC today and repeated on a subset each quarter. Verdict's Acceptance Test is not that testing and does not count toward it.","page":"Maintaining certification","source":"https://standard.aiuc-1.com/auditors/deliver-and-certify/maintaining-certification"}]},"crosswalks":{"note":"As listed on AIUC-1's E015 page. The crosswalk is AIUC's, not Verdict's.","source":"https://standard.aiuc-1.com/accountability/log-model-activity","items":[{"framework":"EU AI Act","refs":"Articles 12 and 19"},{"framework":"ISO 42001","refs":"A.6.2.8"},{"framework":"NIST AI RMF","refs":"MEASURE 2.4 and 2.8"},{"framework":"SOC 2","refs":"CC2.1, P4.2 and PI1.5"}]},"workpapers":"https://verdict.systems/aiuc-1/workpapers","source_page":"https://verdict.systems/aiuc-1"}