{
  "aiuc1_version": "2026-Q1",
  "note": "Illustrative encoding of the public AIUC-1 standard (aiuc-1.com), scoped to what lint_aiuc1_control_evidence (art-303) actually scores. The 23 automatable controls are fully modeled (control_id, pillar, mandatory, automatable, expected_evidence_types, crosswalk stub); the 26 procedural controls (automatable:false) are stubbed to id/pillar/mandatory only, per §A.0. Pillar names A-F (Data & Privacy, Security, Safety, Reliability, Accountability, Society) are the real public AIUC-1 taxonomy; individual control text/crosswalk citations are placeholders pending the full published control catalog. Standard + expected-evidence lists are public and free at aiuc-1.com.",
  "pillars": {
    "A": "Data & Privacy",
    "B": "Security",
    "C": "Safety",
    "D": "Reliability",
    "E": "Accountability",
    "F": "Society"
  },
  "automatable_scope": 23,
  "procedural_controls_out_of_scope": 26,
  "requirements": [
    {
      "req_id": "AIUC1-REQ-A-AUTO",
      "pillar": "A",
      "title": "Data & Privacy - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-A-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Data access control evidence"
        },
        {
          "control_id": "AIUC-A-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Data retention/deletion evidence"
        },
        {
          "control_id": "AIUC-A-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "PII redaction / input filtering test"
        },
        {
          "control_id": "AIUC-A-04",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Data residency attestation evidence"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-A-PROC",
      "pillar": "A",
      "title": "Data & Privacy - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-A-P01",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-A-P02",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-A-P03",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-A-P04",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-A-P05",
          "mandatory": false,
          "automatable": false
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-B-AUTO",
      "pillar": "B",
      "title": "Security - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-B-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Adversarial robustness / red-team test"
        },
        {
          "control_id": "AIUC-B-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Prompt injection resistance test"
        },
        {
          "control_id": "AIUC-B-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Unauthorized tool invocation test"
        },
        {
          "control_id": "AIUC-B-04",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Credential/secret leakage test"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-B-PROC",
      "pillar": "B",
      "title": "Security - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-B-P01",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-B-P02",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-B-P03",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-B-P04",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-B-P05",
          "mandatory": true,
          "automatable": false
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-C-AUTO",
      "pillar": "C",
      "title": "Safety - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-C-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Harmful-output filter test"
        },
        {
          "control_id": "AIUC-C-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Out-of-scope refusal test"
        },
        {
          "control_id": "AIUC-C-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "High-risk action confirmation-gate test"
        },
        {
          "control_id": "AIUC-C-04",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Content-policy conformance test"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-C-PROC",
      "pillar": "C",
      "title": "Safety - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-C-P01",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-C-P02",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-C-P03",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-C-P04",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-C-P05",
          "mandatory": false,
          "automatable": false
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-D-AUTO",
      "pillar": "D",
      "title": "Reliability - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-D-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Hallucination-rate benchmark"
        },
        {
          "control_id": "AIUC-D-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Unsafe tool-invocation rate benchmark"
        },
        {
          "control_id": "AIUC-D-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Determinism / replay-consistency test"
        },
        {
          "control_id": "AIUC-D-04",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Fallback / degraded-mode test"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-D-PROC",
      "pillar": "D",
      "title": "Reliability - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-D-P01",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-D-P02",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-D-P03",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-D-P04",
          "mandatory": false,
          "automatable": false
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-E-AUTO",
      "pillar": "E",
      "title": "Accountability - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-E-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Execution logging completeness evidence"
        },
        {
          "control_id": "AIUC-E-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Incident-response runbook test"
        },
        {
          "control_id": "AIUC-E-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Escalation-path evidence"
        },
        {
          "control_id": "AIUC-E-04",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Audit-trail integrity evidence"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-E-PROC",
      "pillar": "E",
      "title": "Accountability - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-E-P01",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-E-P02",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-E-P03",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-E-P04",
          "mandatory": false,
          "automatable": false
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-F-AUTO",
      "pillar": "F",
      "title": "Society - automatable control set",
      "controls": [
        {
          "control_id": "AIUC-F-01",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Cybercrime-misuse resistance test"
        },
        {
          "control_id": "AIUC-F-02",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Catastrophic-harm scenario test"
        },
        {
          "control_id": "AIUC-F-03",
          "mandatory": true,
          "automatable": true,
          "expected_evidence_types": [
            "receipt",
            "test_report"
          ],
          "crosswalk": {
            "nist_ai_rmf": [],
            "iso42001": [],
            "eu_ai_act": [],
            "owasp_llm_agentic": [],
            "mitre_atlas": [],
            "csa_aicm": []
          },
          "title": "Dual-use capability disclosure evidence"
        }
      ]
    },
    {
      "req_id": "AIUC1-REQ-F-PROC",
      "pillar": "F",
      "title": "Society - procedural control set (out of automatable scope)",
      "controls": [
        {
          "control_id": "AIUC-F-P01",
          "mandatory": true,
          "automatable": false
        },
        {
          "control_id": "AIUC-F-P02",
          "mandatory": false,
          "automatable": false
        },
        {
          "control_id": "AIUC-F-P03",
          "mandatory": true,
          "automatable": false
        }
      ]
    }
  ]
}