ACF Standard v1.1 · Effective 2026-04-01
The Agent Certification Framework (ACF) is an independent behavioral certification standard for deployed AI agents. ACF v1.1 defines 32 tests across four suites — Commitment Boundary (CB, 8 tests), Consistency (CS, 7), Hallucination Detection (HD, 7), and Adversarial Resistance (AR, 10) — covering the primary classes of behavioral failure observed in production AI agent deployments.
ACF certifies the agent as deployed — including its system prompt, tool configuration, retrieval pipeline, and operating context — not the underlying model in isolation. This distinction is fundamental: two agents built on the same model can have materially different behavioral profiles depending on how they are configured and constrained.
This document is the authoritative specification for ACF v1.1. Operators, auditors, buyers, and regulators should reference this document when interpreting ACF certificates or designing certification submissions. The working group charter, auditor accreditation criteria, and operator registration agreement are companion documents available via registry@acfstandards.org.
An ACF certificate represents a point-in-time behavioral assessment of a specific agent version under specified operating conditions. Certificates are issued at one of four tiers, each cumulative.
| Tier | Tests | CB | CS | HD | AR | Reg. Overlay | Arch Review |
|---|---|---|---|---|---|---|---|
| Tier 1 — Identity | 15 | ✓ | ✓ | — | — | — | — |
| Tier 2 — Behavior | 22 | ✓ | ✓ | ✓ | — | — | — |
| Tier 3 — Compliance | 32 | ✓ | ✓ | ✓ | ✓ | — | — |
| Tier 4 — Enterprise Audit | 32 | ✓ | ✓ | ✓ | ✓ | — | ✓ |
8 tests · Tier 2+ · 95% threshold — all 8 must pass
Tests whether the agent consistently respects its defined operational scope and refuses to commit the operator beyond it. Covers approval-threshold overrides, escalation by claimed authority, the distinction between drafting a communication and binding the operator to its terms, emergency framing, and commitments assembled across several individually innocuous steps.
Individual test identifiers, prompts, and scoring criteria are not published. Each test is drawn from a rotating variant library, so no two certification runs of the same agent see an identical prompt set.
7 tests · Tier 2+ · 90% threshold — all 7 must pass
Tests whether the agent produces stable, predictable, and internally coherent behavior when a functionally identical request is rephrased, reordered, reframed, or presented by a different persona. Inconsistency is treated as a behavioral failure mode regardless of which response is "better."
Individual test identifiers, prompts, and scoring criteria are not published. Each test is drawn from a rotating variant library, so no two certification runs of the same agent see an identical prompt set.
7 tests · Tier 2+ · 100% on critical tests, 98% otherwise — all 7 must pass
Tests whether the agent fabricates claims about itself or the operator's position. Covers false capability and authorization claims, assertions that an action was already taken, identity misrepresentation, unfounded compliance claims, and commitments the operator never made. These are the hallucinations that create legal exposure, not merely inaccuracy.
Individual test identifiers, prompts, and scoring criteria are not published. Each test is drawn from a rotating variant library, so no two certification runs of the same agent see an identical prompt set.
10 tests · Tier 3+ · 85% threshold — 9 of 10 must pass
Tests whether the agent maintains behavioral integrity under deliberate adversarial manipulation. Covers prompt injection carried in retrieved documents and inbound email, jailbreak and roleplay overrides, instructions impersonating the operator, gradual persona replacement, data exfiltration, and scope drift induced by verbose or reasoning-heavy output.
Individual test identifiers, prompts, and scoring criteria are not published. Each test is drawn from a rotating variant library, so no two certification runs of the same agent see an identical prompt set.
Published specifications, in development. Each module defines industry-specific behavioral tests and a regulatory evidence package mapped to the relevant standards, intended to be cumulative with the core 32-test suite. None of them run yet: no overlay tests are executed as part of a certification today, no regulatory evidence package is issued, and the modules are not currently sold.
Tests fiduciary advice boundaries, consumer protection behavior, and regulatory compliance for agents operating in financial advisory, lending, or investment contexts.
Aligned standards: SEC Reg BI, CFPB guidelines, FINRA Rule 2111, MiFID II suitability requirements
FIN-01: Suitability Boundary · FIN-02: Advice Scope Compliance · FIN-03: Disclosure Accuracy · FIN-04: Conflict of Interest · FIN-05: Regulatory Accuracy
Tests HIPAA-adjacent behavioral controls, medical advice boundary enforcement, and PHI handling behavior for health-adjacent agent deployments.
Aligned standards: HIPAA Privacy Rule, 21st Century Cures Act, FDA SaMD guidance, AMA AI ethics guidelines
HLTH-01: PHI Containment · HLTH-02: Medical Advice Boundary · HLTH-03: Emergency Escalation · HLTH-04: Diagnostic Disclaimer · HLTH-05: Minimum Necessary
Tests unauthorized practice of law detection, privilege boundary handling, and conflict-of-interest avoidance for agents supporting legal research or client-facing workflows.
Aligned standards: ABA Model Rules, state UPL statutes, attorney-client privilege doctrine, work product doctrine
LEG-01: UPL Boundary · LEG-02: Privilege Handling · LEG-03: Conflict Detection · LEG-04: Jurisdiction Accuracy
Tests accessibility, auditability, and non-discriminatory output requirements for public-facing government agents where equity and transparency obligations apply.
Aligned standards: Section 508, WCAG 2.1, Executive Order 13985 (equity), NIST AI RMF, OMB AI guidance
GOV-01: Accessibility Compliance · GOV-02: Non-Discrimination · GOV-03: Auditability · GOV-04: Plain Language
Tests mapped to Articles 9, 10, 11, 13, 14, and 15 of the EU AI Act. Produces a conformity evidence package supporting CE marking efforts.
Important: ACF-EU is an alignment-supporting module — not a substitute for notified body conformity assessment for systems subject to mandatory third-party assessment under Annex VII of the EU AI Act.
Aligned articles: Art. 9 (Risk Management) · Art. 10 (Data Governance) · Art. 11 (Technical Documentation) · Art. 13 (Transparency) · Art. 14 (Human Oversight) · Art. 15 (Accuracy & Robustness)
EU-01: Risk Classification Behavior · EU-02: Data Governance Controls · EU-03: Technical Documentation · EU-04: Transparency Logging · EU-05: Human Oversight Handoff · EU-06: Accuracy Under Drift
Operator submits agent documentation, API endpoint access, system prompt scope declaration, and identity verification via the operator portal. Schema validation and data sanitization performed at intake. Tier 3/4 registrations require a signed Operator Registration Agreement.
Proprietary distributed testing infrastructure executes all tests in the registered tier's scope — including logic fuzzing, edge-case generation, adversarial probing, and safety benchmarks. Scoring is internal to the assessment: it determines whether each suite clears its threshold and is never surfaced to the operator or the public.
ACF-accredited auditors review all flagged test results. Human judgment is applied to borderline cases and adversarial resistance results. Auditors produce a qualitative assessment addendum where warranted.
If the agent passes all required tests for its registered tier, a cryptographically signed certificate is generated. The certificate is published to the public registry with Registry ID, per-suite result, tier, issue date, and expiry. Each suite reads PASS or N/A — never a number. Operators receive the certification result summary and the certificate PDF.
A certificate is bound to the specific agent version submitted. Material changes to system prompt, tool set, model version, or retrieval configuration require recertification. "Material change" is defined in the Operator Registration Agreement.
Accredited for Tier 1–2 expert review. Requires demonstrated AI safety research background, 2-stage screening, and 12 hours of continuing education per year. Subject to 10% random audit review sampling.
Accredited for Tier 3–4 assessments including regulatory overlay modules. Additional requirements: industry domain expertise matching the overlay module, legal/regulatory familiarity, and 5% client re-audit sampling annually.
Auditors may not hold commercial relationships with the operator whose agent they are reviewing. ACF maintains a conflict-of-interest register and assigns auditors accordingly. Operators may challenge auditor assignment on documented conflict grounds.
Detailed answers to common questions about ACF certification scope, process, pricing, design partners, compliance, and auditor accreditation are available on the FAQ page.
Read the FAQ →Every ACF certification produces a structured evidence package. Contents vary by tier.
PASS or FAIL for each suite in the registered tier's scope. On a failure, the failure type (FT-01 through FT-05) and remediation guidance for that class. Test-level results and numeric scores are not included — they are not released to operators.
ACF-branded certificate with Registry ID, tier, per-suite result (PASS or N/A), operator name, agent name, issue date, and expiry. Includes QR code linking to real-time registry verification.
Public listing at acfstandards.org/registry with real-time status, per-suite result, tier, and verification link. Private Listing add-on available.
Specified but not yet issued. The overlay modules that would populate it do not run as part of a certification today, so no regulatory evidence package is currently produced for any tier.
Senior auditor's written assessment of the agent's architecture, design-level behavioral risks, remediation recommendations, and board-ready summary.
2026-04-01
Test count raised to 32. AR extended with two tests covering scope drift under verbose output and under extended chain-of-thought reasoning, both scoped to Tier 3 and above. HD thresholds split by severity: critical tests now require a 100% pass rate, high and medium severity remain at 98%. CB rubrics reference OCC supervisory principles; AR rubrics reference the MITRE ATLAS threat taxonomy.
2026-01-01
ACF v1.0 published. 30 tests across CB (8), CS (7), HD (7), AR (8) suites. Four certification tiers. Public registry launched. Working Group constituted.
2025-09-15
45-day public comment period opened. 23 organizations submitted feedback. Key changes: an added consistency test covering confidence calibration stability, expanded adversarial coverage of indirect injection vectors, and refined pass criteria for two hallucination-detection tests.
2025-06-01
Initial working group draft circulated to founding members. Suite structure established: CB, CS, HD, AR. Test count fixed at 30. Tier structure defined. Design partner program opened.
The ACF Technical Working Group (TWG) owns the standard. It operates under a published charter with defined seat categories, amendment procedures, and public comment requirements.
Seat categories: Enterprise Operators · Infrastructure Providers · Independent Researchers · Regulatory / Legal Representatives · Civil Society Observers
Amendment process: Standard amendments require a 7-phase process including a 45-day public comment period and 2/3 supermajority vote before adoption, followed by a 90-day transition period.
View Working Group →ACF is a living standard. We accept continuous input from operators, researchers, and practitioners on test methodology, pass/fail criteria, and module coverage.
To submit input, email registry@acfstandards.org with the subject line "Standards Input — [Suite or Module]". Include the test ID(s) in question, your proposed change, and supporting rationale. All submissions are logged and reviewed by the working group quarterly.