Underwriting Superintelligence: Backing Agents you can Sue — Rune Kvist, AIUC

What it claims

AIUC-1 is a certification for production agents. An agent passes only if an independent party tests how well its guardrails work, not just whether they exist. AIUC says the gap it fills is operational: frameworks like OWASP define risks well, but no one runs third-party audits that produce a report an enterprise buyer can accept. Kvist's practical finding from audits is that most agent companies already have the right building blocks, such as model-provider guardrails or their own filters between model and user. Those filters "just don't work very well," because teams optimise the happy path and rarely stress-test adversarial phrasings. His example is a medical-advice classifier that fails against the reframing tricks described in the literature.

How it works

The standard has six categories. The host cites 51 requirements and 130 controls. Each requirement carries a crosswalk to other AI risk frameworks, plus specific control activities and the evidence expected. For example, D001.1 is "configure a groundedness filter" under hallucination, in the reliability category.

There are three kinds of control, with different checkers:

• Technical controls. An auditor such as KPMG or Schellman confirms only that the control exists, using a screenshot or a code review.
• Test controls. AIUC itself runs thousands of simulated attacks for jailbreaks, hallucination and data leakage to measure whether the control actually works.
• Policy controls. Examples are a named accountable person and a plan for notifying customers.

flowchart LR
  S[Spec handed to vendor] --> A[Auditor: controls exist?]
  S --> T[AIUC adversarial testing]
  T -->|fails| R[Vendor remediates]
  R --> T
  A --> C[Certified, 1 year]
  T -->|passes| C
  C --> Q[Quarterly retest + standard refresh]
  T --> L[Eval results feed Lloyd's pricing]

The process runs as follows:

• Timeline. The whole process takes 3–10 weeks, depending on how mature the vendor's security programme already is.
• Testing. Testing, including remediation, takes "a couple of weeks." Failing a test and then adding safeguards is described as common.
• Validity and retesting. Certification lasts a year, with retesting every quarter.
• Standard updates. A consortium of risk leaders from banks, hospitals and critical infrastructure meets twice a quarter, and the standard is revised quarterly.
• Coverage over time. The standard began text-based and focused on customer support. It was then extended to coding, voice and automation agents. Q2 added MCP and agent-to-agent communication.
• Current buyer focus. Buyers' newest questions are about coding agents and agent interactions.

Insurance. Lloyd's of London takes most or all of the financial risk, and AIUC does not carry it. Lloyd's uses AIUC-1 as its underwriting framework, and AIUC's eval results feed directly into pricing. ElevenLabs bought what is described as the first AI-agent policy of this kind. Its coverage is limited to specific perils its customers had asked about, and it shows the contract, with its limits, to those customers. Kvist frames the insurance mainly as a trust signal, citing Waymo stacking insurance to get its San Francisco permit, rather than as compensation.

Evidence

The page gives no pass rates, attack success rates or loss figures. It names Cursor, Harvey, Lovable, ElevenLabs, Intercom and Sierra as customers. The $40M Series A was led by Ribbit Capital and First Harmonic, and the company has 20 people.

Limits

• Testing is in-house. AIUC sells the certification and also runs the effectiveness tests. External auditors only verify that controls exist.
• Possible bias. Kvist argues that for-profit standards aligned with insurers resist racing to the bottom, but he is not a neutral source on this point.
• Copyright. He calls copyright one of the hardest risks to insure.
• Jailbreaks. He states that every model can be jailbroken, so certification attests to effort and measured robustness, not immunity.
• Model-level audits. These are a roadmap item and were flagged in the interview as not yet announced.
• Truncated source. Only the first 60k of about 111k characters was available. The sections on the $200M crash liability case, Air Canada, adverse selection, eval awareness, engineer certification and the roadmap are not reflected here.