---
title: "What AIUC-1, ISO 42001, NIST AI RMF and the EU AI Act ask of AI agents"
canonical: https://pharosone.ai/research/ai-standards-crosswalk
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"What AIUC-1, ISO 42001, NIST AI RMF and the EU AI Act ask of AI agents\". PharosOne, 2026-10-23. https://pharosone.ai/research/ai-standards-crosswalk"
---

# What AIUC-1, ISO 42001, NIST AI RMF and the EU AI Act ask of AI agents

> Clause and control ids, the tests that produce evidence for each, what a pentest cannot cover, and the EU AI Act dates after the 2026 AI Omnibus.

URL: https://pharosone.ai/research/ai-standards-crosswalk · Category: Standards · Published: 2026-10-23 · Updated: 2026-10-23 · Author: PharosOne Research

*PharosOne sells pentests and security testing of AI agents, with findings mapped to these standards, and wrote this article.*

**In short.** Seven documents come up when AI agents are in an audit scope. AIUC-1 is a certification standard written for AI agents. The OWASP Top 10 for Agentic Applications names the risk classes and certifies nothing. ISO/IEC 42001 and the NIST AI RMF govern how an organisation manages AI risk. The EU AI Act is law: Article 50 transparency applies from 2 August 2026, with a transition to 2 December 2026 for Article 50(2) systems already on the market, and the high-risk duties apply from 2 December 2027 (Annex III uses) or 2 August 2028 (Annex I products) under the AI Omnibus, Regulation (EU) 2026/1744. SOC 2 and DORA never mention agents and still cover them as systems in scope. A behavioural test of an agent is evidence for the testing and robustness clauses below; it supplies no evidence for the governance clauses. AIUC-1, NIST, OWASP, EU AI Act, SOC 2 and DORA ids were checked against the public texts on 23 October 2026; ISO/IEC 42001 clause numbers could not be checked against a public text, because ISO sells the standard and its page carries the abstract only.

## The crosswalk

| Standard | What it asks about AI agents | What to test | Evidence a reviewer expects | Applies |
|---|---|---|---|---|
| [AIUC-1](#aiuc-1) | Controls an agent must pass for certification. Security and data: B001 Third-party testing for security risk, B002 Detect adversarial input, B005 Implement real-time input filtering, B006 Prevent unauthorized AI agent actions, B009 Limit output over-exposure, A003 Limit AI agent data access, A006 Prevent PII leakage, D003 Restrict unsafe tool calls, E015 Log AI system activity | prompt injection by the user and through documents, tool results and memory; tool calls outside the agent's role; leakage of data, secrets and the system prompt | a third-party test report per risk area, quarterly retests on the locked standard version, an audit by an accredited auditor | voluntary; certificate valid for one year |
| [ISO/IEC 42001:2023](#iso-iec-42001) | An AI management system: AI risk assessment (6.1.2, 8.2), AI system impact assessment (6.1.4, 8.4), monitoring and measurement (9.1); Annex A controls A.6.2.4 AI system verification and validation and A.6.2.6 AI system operation and monitoring | whether the agent meets the requirements the organisation set for it, before release and in operation | a risk assessment and treatment plan that cite test results, verification and validation records, monitoring records, internal audit and management review | voluntary and certifiable; published December 2023 |
| [NIST AI RMF 1.0](#nist-ai-rmf) | Four functions: Govern, Map, Measure, Manage. MEASURE 2.7: "AI system security and resilience ... are evaluated and documented"; the Generative AI Profile (NIST AI 600-1) adds red-teaming actions | adversarial testing of the agent in the deployment context mapped under MAP | documented test results and metrics, tied to the risks recorded under MAP and the responses under MANAGE | voluntary, no certification; released 26 January 2023 and under revision |
| [OWASP Agentic Top 10](#owasp-agentic-top-10) | Ten risk classes, ASI01 Agent Goal Hijack to ASI10 Rogue Agents | one set of test cases per class that applies to the agent: goal hijack through content it reads (ASI01), tool misuse (ASI02), privilege abuse (ASI03), memory and context poisoning (ASI06) | findings labelled with the ASI id, and a list of the classes that were not tested | voluntary taxonomy; published 9 December 2025 |
| [EU AI Act](#eu-ai-act) | Art. 50(1): tell people they are interacting with an AI system. For high-risk systems: Art. 9 risk management with testing "against prior defined metrics and probabilistic thresholds" (9(8)), Art. 12 automatic logs, Art. 14 human oversight, Art. 15(5) resilience against attempts by unauthorised third parties to alter use, outputs or performance | for a high-risk agent: adversarial inputs, data and model poisoning, confidentiality attacks, before it is placed on the market and after changes | technical documentation (Annex IV) with the test results, the metrics, the thresholds and the dates; logs; a post-market monitoring plan (Art. 72) | Art. 50 from 2 August 2026; high-risk Annex III from 2 December 2027; Annex I products from 2 August 2028 |
| [SOC 2](#soc-2-and-dora) | Nothing about agents. CC4.1: separate evaluations, with penetration testing named in the points of focus; CC4.2: deficiencies communicated to those who correct them; CC7.1: vulnerability detection | the agent as a component inside the system boundary of the report | a dated test with scope and method, and a record that findings reached management and were tracked | voluntary attestation; a Type II report covers an observation period |
| [DORA](#soc-2-and-dora) | Nothing about agents. Art. 24(6): appropriate tests at least yearly on ICT systems supporting critical or important functions; Art. 25: penetration testing among the tests; Art. 24(5): remedy and validate what tests reveal; Art. 26: threat-led penetration testing at least every three years for designated entities | an agent that supports a critical or important function, as one more ICT system in the testing programme | the test inside the programme, findings classified and remedied, and the validation that they were addressed | in force for EU financial entities since 17 January 2025 |

## AIUC-1

AIUC-1 is maintained by the Artificial Intelligence Underwriting Company. It has six domains (data and privacy, security, safety, reliability, accountability, society), lists its controls as A001 to F002, and is updated every quarter. Certification is done by an accredited auditor (AIUC names Schellman and Coalfire), runs on the standard version locked at scoping, includes quarterly retests and is valid for one year ([aiuc-1.com](https://www.aiuc-1.com/); [control list](https://standard.aiuc-1.com/evidence/index)).

On 23 October 2026 the control list carried 55 ids, five of them retired, so 50 active controls. Many are policies and plans (A001 input data policy, E004 assign accountability, E006 vendor and model due diligence) that only documents can evidence. The open-source Pharos Framework pins its own copy of the list, which is older than the current one: its `frameworks/aiuc-1.yaml` (v1, mid-2026) has 49 controls, marks 27 as testable by behaviour and 22 as needing other evidence, and three of its testable controls (C011, C012, D002) have since been retired by AIUC ([pharosone/pharosone](https://github.com/pharosone/pharosone/tree/7eb25b337b89f8df494bd8570e84a183b9021b55/frameworks)). A report mapped to AIUC-1 should therefore name the standard version it used.

PharosOne does not issue AIUC-1 certificates. Our reports are the technical evidence for a test such as B001, with each finding mapped to the control it touches. Controls a behavioural test cannot show are marked as not tested and are never reported as passed.

## ISO/IEC 42001

ISO/IEC 42001:2023 specifies an AI management system for any organisation that develops, provides or uses AI, built on the Plan-Do-Check-Act cycle; it is certifiable ([ISO](https://www.iso.org/standard/42001)). It certifies the organisation's management system, so a test of one agent cannot satisfy it on its own.

A test report is an input to the AI risk assessment (clauses 6.1.2 and 8.2), to Annex A control A.6.2.4 on verification and validation, and to the monitoring and measurement of clause 9.1. The rest of the standard (the AI policy, roles, competence, the impact assessment, internal audit, management review) needs records that a pentest does not produce. Clause numbers are from the published standard, which ISO sells; the ISO page carries the abstract only.

## NIST AI RMF

The AI Risk Management Framework 1.0 (NIST AI 100-1) was released on 26 January 2023 and is voluntary. NIST states that it is being revised under the White House AI Action Plan, so check which version a reviewer cites ([NIST](https://www.nist.gov/itl/ai-risk-management-framework); [NIST AI 100-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf)). The Generative AI Profile, NIST AI 600-1 of 26 July 2024, adds suggested actions for generative systems, among them red-teaming ([NIST AI 600-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)).

Adversarial testing of an agent is evidence for MEASURE 2.7, security and resilience. The other MEASURE 2 subcategories (validity, safety, privacy, fairness and more) and the Govern, Map and Manage functions need other work. There is no NIST certificate; an organisation shows that it uses the framework.

## OWASP Agentic Top 10

The OWASP GenAI Security Project published the Top 10 for Agentic Applications on 9 December 2025 ([OWASP](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)). The ten classes:

1. ASI01 Agent Goal Hijack
2. ASI02 Tool Misuse and Exploitation
3. ASI03 Identity and Privilege Abuse
4. ASI04 Agentic Supply Chain Vulnerabilities
5. ASI05 Unexpected Code Execution
6. ASI06 Memory and Context Poisoning
7. ASI07 Insecure Inter-Agent Communication
8. ASI08 Cascading Failures
9. ASI09 Human-Agent Trust Exploitation
10. ASI10 Rogue Agents

It is a taxonomy. A label on a finding says which class was attacked; it does not show that a control exists. The Pharos Framework crosswalk maps seven of the ten classes to AIUC-1 controls (ASI01, ASI02, ASI03, ASI05, ASI06, ASI07, ASI09); ASI04, ASI08 and ASI10 have no probe mapping there, and the assignments are marked research-derived, pending review by a standards specialist ([crosswalk.yaml](https://github.com/pharosone/pharosone/tree/7eb25b337b89f8df494bd8570e84a183b9021b55/crosswalks/aiuc-1)). A test report should list the classes it did not cover.

## EU AI Act

Regulation (EU) 2024/1689 entered into force on 1 August 2024 ([EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)). The AI Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 ([OJ L, 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744)) and entered into force on 27 July 2026 ([European Commission](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force)). The Commission's timeline as of October 2026 ([AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act)):

| Date | What applies |
|---|---|
| 2 February 2025 | definitions, AI literacy, prohibited practices |
| 2 August 2025 | general-purpose AI model rules, governance |
| 2 August 2026 | most rules, including Article 50 transparency; enforcement starts |
| 2 December 2026 | new prohibitions; Article 50(2) transition for systems already on the market |
| 2 December 2027 | high-risk systems listed in Annex III |
| 2 August 2028 | high-risk AI embedded in products covered by Annex I |

Whether an agent is high-risk depends on its use, not on its being an agent. An agent becomes high-risk when it is used for an Annex III purpose (employment decisions, credit scoring, access to essential services and the other listed areas) or is a safety component of an Annex I product. For any agent that talks to people, Article 50(1) requires that they are told they are interacting with an AI system, unless that is obvious from the context.

For a high-risk agent, Article 9(8) asks for testing before it is placed on the market against metrics and thresholds defined in advance, and Article 15(5) asks for resilience against third parties exploiting its vulnerabilities, naming data poisoning, model poisoning, adversarial examples and confidentiality attacks. A pentest of the agent with stated metrics, thresholds and dates is evidence for both. In operation, a runtime guard's log of flagged turns, such as the findings of [Pharos Radar](/knowledge/pharos-radar), supports Article 72 post-market monitoring; Article 12 also needs the system's own event logs.

## When do EU AI Act high-risk obligations apply after the AI Omnibus?

High-risk obligations apply from 2 December 2027 for the uses listed in Annex III and from 2 August 2028 for AI in products covered by Annex I. Before the AI Omnibus, Regulation (EU) 2026/1744, the dates were 2 August 2026 and 2 August 2027 ([OJ L, 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744); [Regulation (EU) 2024/1689, Article 113](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)).

| Obligation | Date in the AI Act as adopted (2024) | Date after the AI Omnibus (2026) |
|---|---|---|
| High-risk systems listed in Annex III (employment, credit scoring, essential services and the other listed areas) | 2 August 2026 | 2 December 2027 |
| High-risk AI in products covered by Annex I | 2 August 2027 | 2 August 2028 |
| Article 50 transparency | 2 August 2026 | 2 August 2026; 2 December 2026 for Article 50(2) systems already on the market |

The Omnibus entered into force on 27 July 2026. ([European Commission](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force)). For a high-risk agent, the testing under Article 9(8) and the resilience under Article 15(5) described above are due by the new dates.

## SOC 2 and DORA

SOC 2, PCI DSS, DORA and ISO 27001 do not name agents. An agent that reads untrusted content and calls tools is still a component of the system under review, and a scope that leaves it out draws questions. SOC 2's CC4.1 lists penetration testing among the evaluations an entity may use and does not require one; DORA Article 24(6) requires appropriate tests at least yearly on systems supporting critical or important functions, with penetration testing among the tests listed in Article 25 ([AICPA TSC](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022); [DORA](https://eur-lex.europa.eu/eli/reg/2022/2554/oj)).

How to scope such a test, what to hand the tester and what reviewers look for in the report are in the guide [Preparing for a SOC 2 or DORA pentest when you run AI agents](/knowledge/preparing-for-a-soc2-or-dora-pentest-with-ai-agents).

## Primary sources

- Artificial Intelligence Underwriting Company: [AIUC-1 certification](https://www.aiuc-1.com/) and [control list](https://standard.aiuc-1.com/evidence/index), checked 23 October 2026.
- ISO: [ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system](https://www.iso.org/standard/42001), December 2023.
- NIST: [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework); [NIST AI 100-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf), January 2023; [NIST AI 600-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf), July 2024.
- OWASP GenAI Security Project: [Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), 9 December 2025.
- EUR-Lex: [Regulation (EU) 2024/1689, the AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj); [Regulation (EU) 2022/2554, DORA](https://eur-lex.europa.eu/eli/reg/2022/2554/oj).
- Official Journal of the European Union: [Regulation (EU) 2026/1744, the AI Omnibus](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744), 24 July 2026.
- European Commission: [AI Omnibus enters into force](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force), 27 July 2026; [AI Act implementation timeline](https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act).
- AICPA: [2017 Trust Services Criteria, revised points of focus 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022).
- PharosOne: [Pharos Framework repository](https://github.com/pharosone/pharosone/tree/7eb25b337b89f8df494bd8570e84a183b9021b55), commit of 21 July 2026; [the probe engine](/research/the-probe-engine-how-we-measure-agent-security).

Source: PharosOne, "What AIUC-1, ISO 42001, NIST AI RMF and the EU AI Act ask of AI agents", https://pharosone.ai/research/ai-standards-crosswalk, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt