AIUC-1 accredited its first auditor in February 2026; the first agent operator shipped a certified-and-insured deployment days later; by May 2026 an underwriter had a standing paper offering up to $50M of agent-risk coverage. What none of that changes is the standing demand underneath it: a certificate stays valid only against quarterly technical testing, and an underwriter prices agent risk on deterministic, replayable behavior evidence — not a claim of good behavior. This guide walks through the three tools that prepare that evidence: a readiness checkrun against AIUC-1's requirement families, a quarterly test-evidence pack that chains one quarter to the next, and a structured incident record an underwriter can consume after something goes wrong.
Readiness comes first, before a certificate exists. The quarterly pack is the standing obligation that keeps an issued certificate valid. The incident record is what you produce the one time something goes wrong.
Maps AIUC-1's requirement families — safety, security, reliability, accountability, governance — to evidence steps, each carrying an attestation or receipt digest as its evidence requirement. Runs as a fixture to produce a readiness bundle before you ever approach an auditor. Versioned by aiuc_version, so a quarterly revision to the requirement text is a data re-pin, not a rebuild.
Composes a quarterly technical-testing pack: test-suite identity and digests, per-test receipts, pass rates, and a regression comparison against the prior quarter's pack — chained by that prior pack's digest, so a tampered prior-quarter figure is detectable rather than silently accepted. This is the artifact that keeps an issued certificate valid quarter over quarter.
Structures a declared incident into a signed record: agent identity, the failure description, session evidence digests, and remediation status — cross-linked to the same escalation-tier vocabulary used elsewhere in the suite. Built for an underwriter to consume after an incident, not to detect one or to determine fault.
| Underwriting question | What the evidence set answers |
|---|---|
| Is this operator ready to pursue AIUC-1 certification? | The readiness checkrun's bundle, mapped against the requirement families pinned to the current aiuc_version. |
| Has this operator kept up quarterly technical testing since the certificate issued? | The quarterly test-evidence pack, chained quarter to quarter by digest, with regression called out explicitly. |
| Can I trust that a prior quarter's testing figures weren't altered after the fact? | The digest chain's tamper check on the prior-quarter pack. |
| What actually happened in an incident, and is it fixed? | The incident record's failure description, session evidence digests, and remediation status. |
| Is any of this a certification or a fault determination? | No. Every artifact here is declared evidence prepared for AIUC-1 review; AIUC certifies, underwriters price risk, this suite prepares the record. |