About CTS-1
CTS-1 is the Caudals Trust Standard, a certification standard for AI agents. It sets out what a trustworthy agent must do, and how to verify that it does.
What CTS-1 is
CTS-1 sets 36 requirements for an AI agent deployed to customers or used in internal operations. The requirements cover three risks. Operational risk means the agent makes errors or takes unintended actions. Security risk means the agent is manipulated or leaks data. Legal and financial risk means the agent breaks rules or incurs unexpected costs.
Caudals certifies an agent against CTS-1 by testing it directly. We run tests built from the company's own documentation, attack the agent with the owner's authorization, and review the controls behind what we observe. An agent that meets every applicable requirement receives a certificate, an entry in the public registry, and the right to display the CTS-1 badge.
Why it exists
Companies are deploying AI agents faster than they can verify their safety. The teams that must approve them, such as security, legal, enterprise buyers, or regulators, ask the same questions each time and get different kinds of answers from every vendor.
Existing certifications address only part of the problem. ISO/IEC 42001 evaluates how an organization manages AI. SOC 2 examines service controls. Neither standard checks whether the agent gives a customer the correct answer or obeys an instruction hidden in a document. CTS-1 tests those behaviors directly, producing results that buyers can verify.
How it is organized
The standard is organized into three pillars, one for each risk. Each pillar has four domains, and each domain contains three requirements. Each requirement includes an identifier, such as S1.2, a statement of what must be true, the method used to verify it, and the evidence examined.
| Risk | Domains | Requirements |
|---|---|---|
| O. Operational risk | O1 Accuracy, O2 Agent behavior, O3 Testing and change, O4 Oversight and continuity | 12 |
| S. Security risk | S1 Adversarial resistance, S2 Data protection, S3 Access and agency, S4 Supply chain and operations | 12 |
| L. Legal and financial risk | L1 Transparency, L2 Governance and regulation, L3 Rights and fair treatment, L4 Financial exposure | 12 |
Some requirements apply to every agent. Others apply only when the agent has specific capabilities, such as taking actions through tools or handling personal data. Scoping explains how that scope is decided.
The ideas behind it
- Tested, not declared. Most requirements are verified by running tests against the live agent. A policy document alone never satisfies a requirement about behavior.
- Built from your own sources. Operational tests are drawn from the company's documentation and real questions. Domain experts validate every expected answer. The agent is measured against what it is supposed to know.
- Attacked with permission. Security requirements are verified by attempting the attack directly. Caudals runs adversarial tests only with the owner's written authorization.
- Kept current. A certificate lasts twelve months. The agent is retested every quarter with new test cases and the latest attack techniques.
- Public and checkable. The standard, its changelog, and the registry of certificates are public. A badge links directly to the record that backs it.
Who it is for
CTS-1 is for companies that build or deploy AI agents and must show customers, auditors, or regulators that the agent can be trusted. It is also for buyers who need a common way to compare different agents.
It covers agents that work with text and documents, such as customer service agents on the web, in apps, or on messaging channels, voice agents through their transcripts, internal assistants, agents that act through tools, and AI features inside a product.
What a certificate means
A CTS-1 certificate states that a named agent, in a defined scope, met every applicable requirement of a named version of the standard on a given date. It confirms that no critical or high findings remain open, and that the agent has passed every quarterly retest since.
It is not a guarantee that the agent will never fail, and no test could give one. It is not a conformity assessment under the EU AI Act, a certification under the GDPR, an ISO certificate, or a SOC 2 report. CTS-1 maps to those frameworks and produces evidence that supports them. The crosswalks show how.
Who maintains it
Caudals wrote CTS-1 and maintains it. Caudals is an AI evaluation company based in Valladolid, Spain. CTS-1 is its own standard, not one issued by a standards body. We say so plainly because the value of the certificate rests on what is tested and on the record being public, not on a seal of authority.
The standard is versioned. Changes are announced in the changelog. Requirement identifiers are never reused, and a certificate always names the version it was issued against. Comments and proposals are welcome at [email protected].
Where to go next
- How certification works, step by step.
- All requirements on one page.
- How we test, including severity levels and the decision rule.
- Framework crosswalks for the EU AI Act, ISO/IEC 42001, NIST AI RMF, OWASP, MITRE ATLAS, SOC 2, and others.