Seven dimensions, weighted to one hundred.
This is how Agent Certified scores one AI agent in production. It names the seven dimensions and their weights, the evidence each one asks for, the rubric that turns evidence into a number, the five tiers that number falls into, and the instruments the method is built on.
One score, built from evidence.
An assessor scores each dimension from 0 to 10 against the rubric below. Each score is multiplied by the dimension's weight, the seven results are added, and the total is expressed on a scale of one hundred.
A score of 0 is reserved for a dimension where no controls or evidence exist. A score of 10 needs positive evidence of good practice and of tested effectiveness. The assessor records the evidence cited for every score next to the score itself, so a third party can follow how each number was reached.
Evidence may be documentation, architecture artefacts, policy records, incident history, observability output or interviews with the people accountable for the agent. Evidence must be current: produced within the last twelve months or, for living artefacts such as a risk register, as of the day it is submitted.
The weights are fixed for the life of a major version. They do not change with sector, agent type or operator size. A change to any weight needs a new major version and public consultation.
Overall score = (Σ raw score × weight) ÷ 1,000 × 100, rounded to the nearest whole number.
The maximum is 1,000 weighted points: a 10 on every dimension multiplied by weights that total 100. Version 1.0 used a denominator of 720 from an earlier scoring model; version 2.0 corrected it, and scores produced under v1.0 are indicative only.
| Dimension | Weight | Maximum weighted points |
|---|---|---|
| Trust and Safety | 18 | 180 |
| Context Integrity | 14 | 140 |
| Distribution Control | 12 | 120 |
| Product Maturity | 14 | 140 |
| Governance | 16 | 160 |
| AI Integration | 12 | 120 |
| Autonomy Envelope | 14 | 140 |
| Total | 100 | 1,000 |
The seven, and what each weighs.
The seal below is drawn from the weights themselves. Trust and Safety reaches furthest because a failure there can harm people before any other control acts. Governance follows, because it decides whether anyone notices.
- 01
Trust and Safety
18The measurable prevention of unsafe, unauthorised or harmful actions in production, and how quickly unsafe outputs are detected, contained and put right.
- 02
Context Integrity
14The quality of what the agent reasons over: provenance, freshness, lineage, and the controls that keep poisoned or stale data out of its working memory.
- 03
Distribution Control
12Who can invoke the agent, under what authority, and how far its downstream actions can reach. Where identity, authorisation and blast radius meet.
- 04
Product Maturity
14Whether the agent behaves as a production system: reliability, versioning, regression discipline and evaluation coverage that keep behaviour predictable.
- 05
Governance
16The institution around the agent: known to the board, owned by a named senior role, bound by written policy, logged in a way that survives an audit.
- 06
AI Integration
12How the agent sits inside existing systems of record, identity, approval and escalation, and whether it extends institutional memory or bypasses it.
- 07
Autonomy Envelope
14The written line between what the agent does alone and what a person confirms, with revocation, rollback and hard stops. The clearest single determinant of operational risk.
01 Trust and Safety Weight 18, the highest.
The measurable prevention of unsafe, unauthorised or harmful actions by the agent in production, and the discipline with which unsafe outputs are detected, contained and remediated.
Evidence the assessor asks for
- A guardrail specification, with its scope of coverage and update cadence, covering prompt injection, jailbreak, data exfiltration and unsafe tool use.
- A red team report with dated findings and evidence of remediation.
- The monitoring dashboard or alert configuration that shows misuse is detected in real time.
- An incident playbook with named roles and verified access to the kill switch, at the agent and at the tool access layer.
- An incident log, or a confirmation that no material safety event has occurred together with the method used to judge materiality.
| Score | What the evidence shows |
|---|---|
| 0 | No safety consideration. The agent acts up to its technical capability with no documented limit, detection, containment or playbook. |
| 3 | Safety is left to model defaults. No organisation level guardrails, no red team exercise, no misuse monitoring beyond the provider's. |
| 6 | Guardrails documented and deployed. At least one red team exercise with tracked findings. Detection is ad hoc. A containment playbook exists but has not been drilled. |
| 8 | Guardrails tested quarterly. Continuous detection alerting an on call function. Kill switch verified and reachable by non engineering staff. Incident response drilled within six months. |
| 10 | Layered guardrails, continuous adversarial testing tied to a remediation register, real time detection with automatic containment, and a record of at least one real contained event with a written retrospective. |
02 Context Integrity Weight 14.
The quality of the information the agent reasons over: provenance, freshness, lineage, and the controls that keep poisoned, stale or unauthorised data out of its working memory and retrieval pipeline.
Evidence the assessor asks for
- An inventory of every knowledge source and retrieval surface the agent uses.
- The provenance metadata specification applied to retrieved documents.
- A refresh cadence policy and evidence of staleness alerts in production.
- Input validation covering user supplied and external content that reaches the agent.
- A version controlled lineage diagram from source to reasoning output.
| Score | What the evidence shows |
|---|---|
| 0 | Context sources are unknown to the operator. No inventory, no provenance, no staleness detection. |
| 3 | Sources are informally understood. No provenance metadata. Staleness undetected. User content reaches the agent unvalidated. |
| 6 | Sources catalogued. Manual, periodic refresh. Provenance for primary sources only. Basic validation of user content. |
| 8 | Full provenance on every retrieved document. Automated freshness checks with alerts. Validation of external and user content. Lineage documented from source to decision. |
| 10 | End to end lineage verified by tooling, tested resistance to prompt injection through retrieved content, automatic quarantine of untrusted sources, and source integrity monitored in production. |
03 Distribution Control Weight 12.
Who can invoke the agent, under what authority, and how its downstream actions are bounded. A weak position here means the agent can be called by people who should not reach it, with more scope than they may authorise.
Evidence the assessor asks for
- Identity and access configuration for invocation, with credential type and rotation policy. No shared credentials.
- A role based access policy mapped to organisational roles and tied to the identity provider.
- Rate limit, spend cap and tool quota configuration per caller type.
- An architecture diagram showing segregation of development, staging and production.
- A blast radius assessment for every tool the agent can call, with the maximum impact quantified.
An access claim is evidenced on four points: the agent's own identity, its written scope, its downstream bounds, and revocation with logging. A claim that cannot be shown on all four does not score.
| Score | What the evidence shows |
|---|---|
| 0 | Open invocation. No authentication or per caller limits. Anyone with network access can call the agent at full capability. |
| 3 | Basic authentication with shared credentials. No per caller limits. Environments not segregated. |
| 6 | Individual credentials. Basic rate limits. Development and production separated. Blast radius understood informally. |
| 8 | Role based authorisation through the identity provider. Per caller spend caps and tool quotas enforced. Blast radius documented and measured for every tool. Segregation enforced by infrastructure. |
| 10 | Zero trust invocation, real time quota enforcement, blast radius tested through controlled chaos exercises, per call audit trails in an immutable log, and least privilege at the level of each tool. |
04 Product Maturity Weight 14.
Whether the agent behaves as a production system: reliability, regression discipline, evaluation coverage and the engineering practice that keeps behaviour predictable over time.
Evidence the assessor asks for
- Version history for prompts, model configuration and tool definitions, with each change attributed.
- Uptime and latency for the prior 90 days, against a defined service level objective.
- The regression suite specification: number of test cases, coverage rationale and run frequency.
- Observability at the level of the reasoning trace, beyond the final response.
- A dated behaviour change log covering the prior twelve months.
| Score | What the evidence shows |
|---|---|
| 0 | A prototype. No versioning, uptime measurement or evaluation suite. Behaviour unmonitored between deployments. |
| 3 | Code is versioned, prompts and model configuration are not. Uptime tracked informally. No regression suite. |
| 6 | Prompts and models under change control. Uptime measured. Partial regression suite on major changes. Change log kept after the fact. |
| 8 | Published service level objectives. Regression required on every change. Trace level observability. Behaviour changes communicated ahead of time. |
| 10 | Objectives enforced with automated alerts, canary or staged release for every change, evaluation coverage reviewed each quarter, and drift detection that flags distributional shifts. |
05 Governance Weight 16, the second.
The evidence that the agent is known to the board, owned by a named senior role, bound by written policy and logged in a way that will survive an audit. When something goes wrong, governance decides who knows, who can act and what record exists.
Evidence the assessor asks for
- The named accountable owner, role title and scope of accountability, in writing.
- An AI risk policy that addresses agentic systems, with effective date and review history.
- Board or risk committee minutes referring to the agent or its risk category within the last twelve months.
- A risk register entry with current rating and mitigations.
- Vendor and model supplier due diligence, current within twelve months.
- An audit trail specification: retention period, access controls and evidence that the log is complete.
| Score | What the evidence shows |
|---|---|
| 0 | No formal owner, no policy referring to the agent, and a board unaware of its scope or risk. |
| 3 | Known to management, unknown to the board. No named owner or risk register entry. Incomplete audit trail. |
| 6 | Named senior owner. A risk policy covering agentic systems. Board informed at least once a year. Audit trail partial but consistent. |
| 8 | Risk register entry reviewed at least twice a year. Board review on a set cadence. Supplier due diligence current. Audit trail meets sector retention rules. |
| 10 | AI governance inside enterprise risk management, quarterly board review with written minutes, independent assurance already performed, and a full audit trail tested and available to regulators on request. |
06 AI Integration Weight 12.
How the agent sits inside the organisation's systems of record, identity, approval and escalation. A well integrated agent reads, in an audit, like a trusted internal operator: attributed, routed through the right channels, recorded with provenance.
Evidence the assessor asks for
- An integration diagram showing the connections to systems of record, the identity provider and the approval workflow.
- Proof that writes to systems of record carry the agent's identity, a timestamp and the provenance of the action.
- Escalation routing to named reviewers, with verified notification paths.
- Agent logs held in the same observability stack as the rest of the organisation.
- An audit trail extract from a real agent initiated action, attributed end to end.
| Score | What the evidence shows |
|---|---|
| 0 | The agent runs parallel to core systems. Writes go to shadow systems. One service account for everything. No escalation path. |
| 3 | Some outputs reach systems of record without attribution. Informal escalation. Agent logs kept apart from the organisation's. |
| 6 | Most writes attributed. Approval flows exist with bypass paths. Escalation to a named team. Logs partly centralised. |
| 8 | Integration follows the authority chain. Identity carried end to end. Escalation to named individuals. Logs in the central stack. |
| 10 | Every write, approval, escalation and decision attributed, timestamped and kept with the organisation's records, tested through a simulated audit within twelve months. |
07 Autonomy Envelope Weight 14, read first.
The explicit, written boundary between what the agent may do without human confirmation and what needs a person. It is the single clearest determinant of operational risk, and the first thing an insurer or a supervisor reads.
Evidence the assessor asks for
- A written envelope that classifies every action class as fully autonomous, threshold gated or permanently prohibited.
- Configuration showing the thresholds are enforced in code, set by impact rather than convenience.
- A revocation procedure that named non technical roles can use, with the access time verified.
- A rollback procedure and at least one test of it against a real action class.
- A register of hard stops, the actions never delegated, each with its rationale.
- Dated quarterly sign off by the named accountable owner.
| Score | What the evidence shows |
|---|---|
| 0 | No envelope. Autonomy is assumed up to technical capability. |
| 3 | An informal sense of what the agent should not do alone, undocumented, unenforced and unreadable to non technical people. |
| 6 | A written policy referenced in governance documents. Some thresholds in code. Revocation needs an engineer. Rollback possible but untested. |
| 8 | Envelope enforced in code. Named non technical roles can revoke within two minutes. Rollback tested for at least one action class. Hard stops documented with rationale. |
| 10 | The envelope is the operating contract: signed off every quarter, tied to insurance policy wording, every action class classified, the rationale version controlled. |
Five tiers, each with a floor.
The overall score places the agent in a tier. Every tier also sets a minimum on each dimension. An agent whose total qualifies for a tier but misses that minimum on any single dimension is placed in the tier below until the floor is met.
Pre Assessment
Baseline recorded. A gap report, no mark.
In Progress
At least 2 on every dimension. No mark.
Certified
At least 4 on every dimension. The entry point for the mark.
Advanced
At least 6 on every dimension.
Elite
At least 8 on every dimension.
The floor exists so that a strong score in one area cannot carry a weak one. A total that would indicate Advanced with a 5 anywhere is Certified. The worked example shows exactly this, and certification levels sets out what each tier requires and how long it stays valid.
Six weeks, from questionnaire to report.
The assessment combines the operator's own disclosure with independent review. A certification based on self disclosure alone is not valid under this methodology.
| When | Phase | What happens |
|---|---|---|
| Weeks 1 and 2 | Self assessment | The operator answers the readiness questionnaire, criterion by criterion, as yes, partial or no, and names the document, configuration or record behind each answer. The operator does not propose scores. |
| Week 3 | Evidence collection | The assessor names the gaps within five business days. One supplementary request follows for any criterion that cannot yet score above 3, with five business days to answer. There is no second request. |
| Weeks 4 and 5 | Independent review | Each dimension is scored against its rubric, with the evidence cited. Where evidence conflicts, the most conservative reading applies and the conflict is noted. The operator sees the draft and has three business days for factual corrections, without new evidence. |
| Week 6 | The report | The overall score and tier, every dimension score, the evidence cited, any floor that caps the tier, and a prioritised remediation plan. The operator decides whether the tier and score are published. |
| Afterwards | Monitoring | Trigger events are notified within 30 days. Advanced and Elite holders attest every quarter that nothing material has changed. A missed attestation suspends the result until it arrives. |
What triggers a new assessment
Any of these events requires notice and a re assessment within 90 days: a change of underlying model; a new tool, API or integration; a new data source in the retrieval pipeline; a material change in who can call the agent; a change of deployment context that alters the consequence of its actions; a regulatory change affecting a dimension; a material incident attributable to the agent; or a change of accountable owner without demonstrable continuity.
What holders keep doing
Logging at the level set in the report. Adversarial testing every quarter at Advanced and Elite, every six months at Certified. Regression evaluation on every material change. A quarterly review of the Autonomy Envelope signed by the owner. A yearly refresh of supplier due diligence. A result older than twelve months without re assessment is no longer current.
Built on what already exists.
Every dimension traces to at least one recognised instrument. The crosswalk shows where each dimension meets the NIST AI Risk Management Framework, ISO/IEC 42001:2023 and the EU AI Act, with the nearest pillar of AIUC-1 for readers comparing routes.
| Dimension | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | EU AI Act | Nearest AIUC-1 pillar |
|---|---|---|---|---|
| Trust and Safety | Govern 1.1, Manage 4.1, Manage 4.2 | Clause 8.4, Annex A.6 | Articles 9, 14, 15 | Safety, security |
| Context Integrity | Map 1.6, Map 3.1, Govern 6.1 | Annex A.7 | Article 10 | Data and privacy |
| Distribution Control | Govern 1.7, Map 2.2 | Annex A.9 | Article 26 | Security |
| Product Maturity | Measure 1.1, Measure 2.5, Manage 2.2 | Clause 9.1, Annex A.6 | Articles 12, 15 | Reliability |
| Governance | Govern 1.1, 1.2, 4.1, 5.1 | Clauses 5 and 6, Annex A.2 | Articles 9, 12, 27 | Accountability |
| AI Integration | Govern 6.2, Measure 4.1, Manage 3.1 | Annex A.8, Annex A.9 | Articles 14, 26 | Accountability |
| Autonomy Envelope | Govern 1.4, 1.5, Manage 1.3, 4.1 | Annex A.8 | Articles 14, 26 | Safety, accountability |
AIUC-1 is the AI agent standard published by the Artificial Intelligence Underwriting Company (AIUC): 51 requirements and 130 controls across six pillars, namely data and privacy, security, safety, reliability, accountability and societal risks. The pillar column is our reading of where each dimension sits closest; AIUC has not reviewed it. The supervisory reference for insurers is EIOPA's Opinion on AI governance and risk management, published on 6 August 2025, which is guidance and does not carry the force of law.
The EU AI Omnibus entered into force on 27 July 2026. High risk obligations now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I. Article 50 transparency applies from 2 August 2026, the Article 5 prohibitions since 2 February 2025. The articles mapped here kept their substance; only the dates moved, and the methodology is unchanged.
What the method does not yet cover.
A standard earns trust by naming its edges. These are the ones the v3.0 review will examine.
Judgement
Fixed rubrics aim at reproducibility, yet some calls need expertise. Two assessors from the same evidence should land within one point on any dimension. Quality review and the right of reply contain the rest.
Sectors and pipelines
There are no sector overlays yet for medical, financial or legal advice agents, and agent to agent pipelines are assessed one agent at a time. Both are open questions for the next major version.
The model itself
The method assesses the operator's deployment controls. It makes no judgement on the underlying model or on the provider's own safety measures.
Have one agent read against it.
One named agent, its evidence across the seven, a tier and a report that insurers, boards and buyers can read. The full cycle takes four to six weeks.