AI governance grows a paper trail: certifications, registries, risk numbers
Cresta earns an AIUC-1 agent certification, Uptiq ships bank-grade agent governance, Airia argues the risk gap is the metric, and Naaia warns that where a governance tool is hosted is itself a compliance question.
- Cresta says its AI Agent earned AIUC-1 certification, a security, safety, and reliability standard for AI agents from the Artificial Intelligence Underwriting Company. Self-reported m:…2111
- Cresta says the AIUC-1 process combines an independent audit of agent build and governance with thousands of adversarial tests, and its agent had no failures across the critical categories. Self-reported m:…2111
- Uptiq says its GovernAI console gives financial institutions visibility, auditability, and role-based control over agent activity, starting with a central registry of agents. Self-reported m:…5130
- Airia argues the gap between inherent risk at intake and residual risk after treatment is the measurable value a governance program produces, and tracking it reveals treatments that are not working. m:…5461
- Naaia argues hosting data in Europe is not always sufficient for sovereignty if the vendor is subject to foreign extraterritorial laws, and notes AI registries hold sensitive strategic information including not-yet-public innovation projects. m:…2832
A certification for agents
Cresta announced that its AI Agent has earned AIUC-1 certification, a security, safety, and reliability standard for AI agents developed by the Artificial Intelligence Underwriting Company. The certification process combines an independent audit of agent build and governance with thousands of adversarial tests, including reviews of guardrails, policies, code, and logs by external evaluators. Adversarial evaluations probe for prompt injection, jailbreaks, data and personal-information leakage, hallucination, and unauthorized actions. m:…2111
Cresta says its agent had no failures across AIUC's critical categories during certification, and that it will run technical evaluations with AIUC every quarter and recertify annually. It uses the AI Red Team tool to run adversarial tests and score resilience, and plans to extend certification to additional channels as they ship. The company also maintains SOC 2 Type II, ISO/IEC 42001, HIPAA, and PCI DSS-aligned controls, and is investing in FedRAMP compliance. A certification that expires without re-testing is a snapshot; quarterly evaluations and annual recertification are the attempt to make it a habit. m:…2111
Uptiq's GovernAI takes the same idea into banking. The company launched the console to give financial institutions visibility, auditability, and role-based control over AI agent activity, starting with a central registry of agents across the enterprise and role-based permissions for agent rollouts. It is available immediately for existing Uptiq customers at no additional cost, which removes the procurement excuse for banks that already use the platform. m:…5130
Show the work behind every answer
GovernAI's most concrete feature is traceability: it displays the source document behind every figure in an AI-prepared credit memo, the specific internal policy applied to an output, the precise model version used, and the full approval chain. It mandates human approval at defined steps, grounds agents in the institution's own policies and procedures through a Knowledge Hub, and verifies through regression testing that policy updates do not alter agent outputs. It also tracks usage and costs by team. m:…5130
The console is organized around five features: an Agent Registry for agents built on all major agentic platforms, a Knowledge Hub for products, policies, and procedures, an Authority Grid for multi-approval systems, an Evaluator for testing agents before and after they run, and an Auditor for generating reports with underlying traces and logs. Planned updates include exam-ready report exports and policy-as-code validation. The target audience is clear from the feature list: an examiner, not just an engineer. m:…5130
Airia supplies the metric that ties these products together. Inherent risk is the risk a use case carries before any controls, assessed at intake when the use case is first registered, and residual risk is what remains after treatment. The gap between them is the measurable value a governance program produces, and tracking the gap reveals when treatments are not working. Risk can be treated through mitigation, acceptance, avoidance, or transfer, and residual risk is scored against the company's own risk tolerance, with high and critical use cases routed to a committee for approval. m:…5461
Where the registry lives matters
Naaia adds a jurisdictional warning. An AI governance tool maintains an inventory of AI systems, risk assessments, vulnerabilities, and compliance gaps, and those registries contain sensitive strategic information, including innovation projects not yet public. Foreign laws like the US CLOUD Act and Section 702 of FISA allow authorities to demand access to data held by providers under their jurisdiction, so hosting data in Europe is not always sufficient to ensure sovereignty if the vendor itself is subject to foreign extraterritorial laws. m:…2832
Naaia frames sovereignty across four dimensions, legal, technical, operational, and regulatory, and notes that AI governance in Europe is governed by the AI Act, GDPR, Cyber Resilience Act, and ISO/IEC 42001. Its own platform supports hosting with European providers such as Scaleway or OVH, and its compliance engine is updated continuously for those frameworks plus the NIST AI Risk Management Framework. The EU Data Act, applicable since September 2025, strengthens the right to switch cloud providers, which matters when the registry itself becomes a switching cost. m:…2832
The four announcements converge on one shift: governance is becoming something you can show. A certification with quarterly evaluations, a registry with traces and approval chains, a risk gap measured before and after treatment, and a hosting decision defended on sovereignty grounds are all artifacts an auditor can inspect. The policy document is no longer the product; the paper trail is. m:…2111 m:…5130
What is still unresolved
- Whether AIUC-1 certification becomes a recognized standard or remains one vendor's credential.
- Whether banks adopt GovernAI's registry model beyond Uptiq's existing customer base.
- How regulators will treat sovereignty claims for governance tools hosted by European providers under foreign-owned vendors.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.