The authoritative third-party certification standard covering security, capability, data handling, compliance, and governance — independently verified by certified auditors.
Every AATCS certification evaluates agents across five independent dimensions. Agents must meet minimum thresholds across all dimensions — a high score in one area cannot compensate for a failure in another.
Security audit evaluates the agent's resistance to adversarial inputs, the robustness of its data protection mechanisms, and the completeness of its audit trail. Auditors conduct red-team exercises against the agent and review its infrastructure architecture.
Capability verification independently tests whether the agent can perform the tasks it claims. Based on the Agent Capability Breathalyzer framework (AATCS-107), auditors run agents through standardized task sets and compare outputs against documented capability claims.
Data handling assessment verifies that agents correctly identify, protect, and manage data throughout its lifecycle. Auditors test PII detection accuracy, verify data retention configurations, and confirm that deletion requests are properly honored.
Operational compliance evaluates whether the agent operates within defined boundaries and can explain its decisions. Auditors test decision audit logs, run bias testing suites, verify human escalation triggers, and confirm rollback capabilities.
Organizational governance reviews the vendor's practices around AI oversight, incident response, and business continuity. Auditors examine model cards, human-in-the-loop policies, and what happens to agent operations if the vendor fails.
AATCS offers two audit tiers to serve agents at different maturity levels — from early-stage vendors seeking initial credibility to established agents requiring enterprise-grade certification.
Light audit passed. All mandatory criteria met. Minimum viable trust signal for agent marketplaces.
Full audit passed. Strong trust signal for regulated industry procurement and enterprise contracts.
Full audit with distinction. Highest trust grade. Accepted as sufficient due diligence by enterprise procurement in regulated industries.
| Score | Rating | Criteria |
|---|---|---|
| 5 | Exceptional | Exceeds industry standards; best-in-class practices observed |
| 4 | Strong | Fully meets requirements; minor improvements recommended |
| 3 | Adequate | Meets minimum requirements; some gaps identified |
| 2 | Insufficient | Significant gaps; remediation required before certification |
| 1 | Critical Failure | Material security or compliance issues; immediate action required |
All AATCS-certified agents are listed here. Filter by certification grade, status, or search by agent and vendor name. Click any agent to view their full certification breakdown.
| Agent | Vendor | Cert # | Grade | Security | Capability | Data | Compliance | Governance | Valid Until | Status |
|---|
Certified agents receive a unique badge displaying their grade, certification number, and expiration date. Badges are available in SVG and PNG formats for digital and print use.
Join the growing network of certified AI agents trusted by enterprise procurement teams worldwide.
Enterprise procurement teams can use this pre-written acceptance letter template to cite AATCS certification as sufficient due diligence, dramatically reducing review time for certified agents.
Re: Acceptance of AATCS Certification as Sufficient Due Diligence for AI Agent Procurement
Dear [Compliance Team / Legal Team],
This letter documents our acceptance of the AI Agent Trust Certification Standard (AATCS) as sufficient due diligence evidence for AI agent procurement evaluations.
Background
[Company Name] has identified the AATCS certification standard as an authoritative, independently verified trust signal for AI agents. The standard covers five critical dimensions:
Policy
Effective immediately, AI agents bearing a valid AATCS certification at the following grades are accepted as meeting our baseline due diligence requirements:
| Certification Grade | Acceptance Level | Notes |
|---|---|---|
| Gold | Full acceptance | No additional security review required |
| Silver | Acceptance pending security review | Review limited to dimension-specific gaps |
| Bronze | Baseline only | Requires full internal security review |
Verification
All AATCS certifications are verifiable in the public AATCS registry at aatcs.org using the certification number. Certifications expire after 12 months; renewal status can be confirmed via the registry's real-time status field.
Scope
This acceptance applies to AI agents used for: internal operations, customer-facing automation, data processing involving regulated data (PHI, PII, financial data), and decision-making with material business impact.
Agents performing high-risk autonomous actions (as defined by EU AI Act Article 6 Annex III) require additional human oversight provisions regardless of certification grade.
Sincerely,
[Procurement Officer Name]
[Title]
[Company Name]