AIUC-1
A006

Prevent PII leakage

Establish safeguards to prevent personal data leakage through AI outputs

Keywords
Personal Data Leakage
Application
Mandatory
Frequency
Every 12 months
Type
Preventative
Crosswalks
AML-M0020: Generative AI Guardrails
Article 72: Post-Market Monitoring by Providers and Post-Market Monitoring Plan for High-Risk AI Systems
MEASURE 2.10: Privacy risk assessment
LLM02:25 - Sensitive Information Disclosure
LLM05:25 - Improper Output Handling
LLM08:25 - Vector and Embedding Weaknesses

Control activities

Establishing data segregation controls. For example, isolating user sessions, implementing user-specific boundaries, preventing reuse of prompts or outputs containing personal identifiers, maintaining dataset isolation.

Establishing safeguards to prevent personal data leakage between users. For example, isolating user sessions, applying user-specific output boundaries, and preventing reuse of prompts or outputs containing personal identifiers.

Documenting protection procedures and incident management. For example, identifying PII, defining output handling policies, maintaining leakage incident records and remediation actions.

Implementing output monitoring. For example, scanning outputs for cross-customer data leakage, validating data source attribution.

Implementing automated detection and redaction of personal data in AI outputs. For example, using named entity recognition (NER) or data classification tools to scan and remove PII before output is delivered to end users.

Integrating with existing data loss prevention (DLP) systems to monitor and block outputs containing personal data in violation of policy.

Organizations can submit alternative evidence demonstrating how they meet the requirement.

AIUC-1 is built with industry leaders

Phil Venables

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Google Cloud
Phil Venables
Former CISO of Google Cloud
Dr. Christina Liaghati

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."

MITRE
Dr. Christina Liaghati
MITRE ATLAS lead
Hyrum Anderson

"Today, enterprises can't reliably assess the security of their AI vendors— we need a standard to address this gap."

Cisco
Hyrum Anderson
Senior Director, Security & AI
Prof. Sanmi Koyejo

"Built on the latest advances in AI research, AIUC-1 empowers organizations to identify, assess, and mitigate AI risks with confidence."

Stanford
Prof. Sanmi Koyejo
Lead for Stanford Trustworthy AI Research
John Bautista

"AIUC-1 standardizes how AI is adopted. That's powerful."

Orrick
John Bautista
Partner at Orrick and creator of the YC SAFE
Lena Smart

"An AIUC-1 certificate enables me to sign contracts must faster— it's a clear signal I can trust."

SecurityPal
Lena Smart
Head of Trust for SecurityPal and former CISO of MongoDB
© 2025 Artificial Intelligence Underwriting Company. All rights reserved.