complylock.ai / aiuc-1-vs-iso-42001

AIUC-1 vs ISO 42001

ISO 42001 certifies an AI management system: the policies, roles, risk process and governance around how you build AI. AIUC-1 goes at the product, with controls that ask what the deployed agent does under adversarial pressure, including whether it can be talked into a tool call it has no authority to make. That difference matters most in the tool-call controls (D003, D004, B006, B007, A003), where a documented policy is not evidence and a test result is. Vendors often hold both: ISO 42001 for the buyer's governance questionnaire, AIUC-1 for the buyer who wants to know the agent itself was attacked and held. ComplyLock works only on the AIUC-1 tool-call side.