The Certificate You Have to Ask For

The Cloud Security Alliance’s public registry displayed an AI-agent safety certificate called AIUC-1 beside nine services. A buyer could reasonably read that as third-party reassurance. I asked what evidence CSA verifies before adding the AIUC-1 trustmark: certificate identity, issuer, validity dates, audited product or configuration scope, and current status. Its chief technology officer answered with one word: “None.”

That answer came from Daniele Catteddu, chief technology officer at the Cloud Security Alliance. CSA classifies AIUC-1 as a partner entry: a third-party assessment relevant to its registry, but outside the CSA-governed program. Catteddu said responsibility for validation remains with the third party.

The exchange began with a smaller problem. On September fifteenth, each of the nine listings offered a different link labeled “Download AIUC-1.” Every link returned the same one-page blank PDF. The file carried metadata naming the Justice Department’s Executive Office for Immigration Review, with a 2006 creation date. It contained no text.

CSA responded the next day. Catteddu said the download option was an error and should never have appeared. CSA removed it, and a fresh check confirmed that the old links now return visitors to the service pages. That correction deserves credit. It also leaves the larger fact intact: the registry displays the trustmark, but CSA does not validate what sits underneath it.

The assurance process

AIUC-1 is the certification standard created by Artificial Intelligence Underwriting Company, or AIUC. On September fifteenth, AIUC announced a forty-million-dollar funding round, bringing its disclosed total to fifty-five million dollars. TechCrunch reported that founders Rune Kvist and Rajiv Dattani are trying to build a third-party assurance layer for AI agents. The company names Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath and Fin among organizations certifying against its standard.

The commercial pitch is easy to understand. Enterprises want agents that can write code, answer customers and perform professional work. Those buyers also want somebody credible to test the systems before deployment. AIUC says it uses roughly five thousand business-specific risk and attack combinations covering failures such as jailbreaks, hallucinations and data leaks.

The process is more layered than a company testing itself and printing a badge. AIUC’s documentation says accredited auditors collect evidence, review controls and write reports. Schellman is currently the only fully accredited auditor listed; several large audit firms are provisional. TechCrunch reported that humans verify the final audit. Certification lasts twelve months, with quarterly technical retesting and an annual control audit.

But AIUC controls several other parts of the system. It owns the accreditation process, is currently the sole technical-testing body and issues every certificate through its certification committee. Its documentation says AIUC may also periodically conduct audits itself. On September fifteenth, AIUC’s auditor documentation marked a future model in which outside auditors run the technical evaluations as “Coming soon.” That page was unavailable when I checked again two days later.

Concentration is not proof that the process is weak. It can be how a young market gets built. The unresolved question is who independently governs the framework, checks enforcement, hears appeals or disciplines a poor examination. The public documents I reviewed do not answer that.

I asked AIUC about that governance, buyer-visible evidence, insurance terms and post-certification outcomes through a company address published in its own FAQ. AIUC had not replied by Thursday afternoon.

What the report must explain

That September fifteenth documentation also described the certification threshold. All applicable requirements had to pass, with no critical P-zero or P-one vulnerabilities. Findings labeled P-two, or “Significant,” had moderate potential for harm, but remediation was discretionary. The report’s technical-testing section used final-round results while stating the total number of tests across rounds; the first round was used to find and repair problems. AIUC’s current certification page says certification does not guarantee that a system is secure, safe or reliable.

That is a real process with real limits. A buyer still needs the report.

Intercom’s live trust center lists a locked “AIUC-1 Certification Report” described as containing quarterly results from March and June. Cursor’s trust center lists an AIUC-1 certificate behind an access-request form; its public inventory does not separately expose the detailed report Cursor says exists. Lovable publishes a substantive fifteen-page paper naming a completed Schellman audit. The paper tells buyers, “Ask for the test results. Ask for the audit report.” It includes neither.

None of that means the reports are missing or that access would be refused. I submitted both access requests, selected “Other” and requested full access. Both portals confirmed receipt. More than three hours later, neither request had produced approval or an artifact. The public signal still travels more freely than the evidence needed to interpret it.

What a buyer should ask

I asked Lenny Zeltser what an enterprise buyer should inspect before relying on the certificate. Zeltser, the former chief information security officer at Axonius and a Faculty Fellow at the SANS Institute, replied on the record. He said, “Buyers should start by confirming which agent, tools, model versions, and data flows the audit and AIUC’s testing covered.” If a vendor describes the scope only as “the agent,” he said, the buyer cannot tell what the certificate includes.

He also pointed buyers to the latest quarterly retest, the specific tests behind judgment-based domains and anything excluded from scope. The badge answers whether a defined system cleared a defined process. It does not tell a stranger what that system or process was.

The insurance question

The same certificate can also open the door to insurance. AIUC says its model combines standards, audits and insurance. Its February announcement with ElevenLabs said unnamed leading insurers could cover risks created by deployed agents, including incorrect information supplied to customers. Historical specialist reporting names Beazley as a capacity provider for an AIUC liability product; a separate report described certified Lovable customers as insured through the Lloyd’s market.

Those reports may describe compatible pieces of the same arrangement. They do not establish the current carrier entity, policyholder, trigger, limits, exclusions, jurisdictions, loss allocation, claims process or how much risk AIUC retains. I found no public claim record showing what happens after a certified agent causes a covered loss.

Zeltser’s answer on that point was direct: “I’d need evidence before giving much weight to AIUC’s insurance argument.” He said he would want the claims history, policy exclusions and the amount of risk AIUC keeps on its own books.

What would count as proof

Here’s what I think. AIUC may be building a useful assurance market for systems that badly need one. Combining technical tests, outside audit work, certification and an insurance route can make deployment safer. But integration is not independence, and a badge is not the report beneath it. The practical test is whether a qualified buyer can learn what exact system was examined, what material problems survived, and what loss the insurance actually transfers before treating the certificate as permission to deploy.

The next proof will not be another funding round, customer list or test count. It will be a buyer, auditor or insurer showing what the certificate changed: a deployment limit, a procurement decision, the price of coverage, or the handling of a claim after failure.

Until then, the trustmark is public. The evidence has a receptionist.

If you buy, audit, insure or operate an AIUC-1-certified agent, tell me what evidence you received, what exclusions were visible before purchase and whether the certification affected deployment or a claim. Suggested subject line: “AIUC-1 evidence.” Anonymous notes and source-protection requests are welcome. Email [email protected]. I read every message.

Listen to Episode 63

Episode 63, "The Certificate You Have to Ask For", is live now.

Download the episode or subscribe to the feed.

Sources

Send tips, corrections, and source notes to [email protected].