On October 19, 2026, the AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering that bundles a SOC 2 report with an AIUC-1 certification in one CPA-led engagement. A few CPA firms are already running pilots. The full launch is set for early 2027.
If you sell AI agents into enterprises, this one’s about you. SOC 2 is the report your prospects already ask for in procurement. AIUC-1 is the standard that checks whether your agent can be talked into leaking data, inventing a refund policy, or calling an API it was never supposed to touch. Putting both into one engagement, under the AICPA’s attestation standards, changes what audit-ready means for any company whose software acts inside other people’s systems.
Here’s what was announced, what AIUC-1 tests, why the AICPA’s name matters more than the certificate itself, and what you should do about it if you’re working on SOC 2 or ISO 42001 right now.
What the AICPA and AIUC Announced
The offering is a single report from one engagement led by a licensed CPA. It combines two things. The first is a standard SOC 2 examination under the AICPA Attestation Standards, with an opinion on the design and operating effectiveness of controls across the Trust Services Criteria. The second is an AIUC-1 certification, the AI agent safety and security standard AIUC launched in 2025.
Both parts need annual renewal, and AIUC-1 adds quarterly technical retesting on top. The AICPA’s own framing is that trust between AI vendors and enterprise buyers currently gets negotiated one security questionnaire at a time, and that this report is meant to end that by becoming the reference document for AI assurance.
There’s real scale behind it. According to the AICPA announcement, more than 40,000 organizations got a SOC 2 attestation or AIUC-1 certification last year. AIUC cofounder Rajiv Dattani described the joint report as an independent answer to the two questions enterprises now ask every AI vendor: what’s your security posture, and do your agents behave as intended?
What AIUC-1 Actually Tests
AIUC-1 is the half that most SOC 2 veterans won’t recognize. A consortium of more than 250 CISOs and security leaders built it, it gets updated quarterly, and its controls sit under six principles: data and privacy, security, safety, reliability, accountability, and society. Those controls map to MITRE ATLAS, ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act.
What sets it apart from everything else on your compliance roadmap is live testing of the agent itself. Dattani called it “live testing of AI agent behavior, not just a review of policies and guardrails.” Each agent gets run through hundreds of risk and attack combinations, in iterative conversations covering thousands of scenarios: prompt injection, data leakage, hallucination, manipulative requests, harmful outputs, and unauthorized tool calls. A SOC 2 auditor samples your access reviews. An AIUC-1 evaluation tries to talk your agent into doing something it shouldn’t.
This isn’t a paper standard waiting for adopters. Cursor, Lovable, Harvey, ElevenLabs, KPMG, UiPath, and Intercom’s Fin have all certified products against it, and in September 2026 AIUC raised a $40 million Series A to extend the model from agents to frontier models. ElevenLabs used its certification to get insurance coverage for its voice agents, which is the other half of AIUC’s business: the certificate is the underwriting basis for agent liability insurance.
| SOC 2 | ISO 42001 | AIUC-1 | |
|---|---|---|---|
| What it evaluates | Controls over the service organization’s systems and data | The organization’s AI management system (governance, risk, lifecycle) | The behavior and security of a specific AI agent |
| Issued by | Licensed CPA firm under AICPA standards | Accredited certification body | AIUC, based on an accredited auditor’s report plus AIUC’s own technical testing |
| Testing approach | Evidence sampling over a review period | Management system audit, Stage 1 and Stage 2 | Adversarial testing of the live agent across thousands of scenarios |
| Cadence | Annual report | Three-year certificate with annual surveillance | Annual certificate with quarterly technical retests |
| Typical timeline | 4 to 12 weeks of readiness plus the observation period | 3 to 6 months | 4 to 8 weeks, per published auditor estimates |
Important: AIUC-1 explicitly doesn’t duplicate SOC 2, ISO 27001, or GDPR. It assumes you already hold them and adds agent-specific requirements on top. A company with no SOC 2 can’t skip ahead by going for AIUC-1. It still needs the baseline controls first, which is the whole logic behind bundling the two.
Why the AICPA's Name Matters More Than the Certificate
Until this week, the main criticism of AIUC-1 was about structure, not technical rigor. AIUC wrote the standard, accredits the auditors, runs the technical evaluations, issues the certificates, and sells the insurance the certificate unlocks. That’s a lot of hats for one venture-backed company, and skeptics pointed out that calling AIUC-1 a standard rested on AIUC’s own say-so rather than any outside accreditation body. AIUC’s answer has been that its insurance exposure keeps it honest, because losses on a badly certified agent land on its own balance sheet.
The AICPA tie-in changes that. SOC 2 carries weight in procurement because licensed CPAs perform it, and CPAs answer to state boards, peer review, and professional attestation standards with real consequences for getting it wrong. Putting a CPA in charge of the combined engagement brings that accountability to the AI half of the report, at least for whatever the CPA opines on. A procurement team that has never heard of AIUC but has required SOC 2 for a decade now has a logo it already trusts on the AI assurance.
It doesn’t settle everything. The announcement talks about a single report but doesn’t say whether the AIUC-1 portion becomes part of the CPA’s opinion or stays a separately issued AIUC certificate attached to it. It also doesn’t say who runs the quarterly technical retests between annual engagements. Those two details will decide how much weight a buyer’s security team gives the AI half of the document.
Five Things That Change for Companies Shipping Agents
1. The procurement question grows a second clause
“Do you have SOC 2?” becomes “Do you have SOC 2 and AI assurance?” Enterprise security teams have wanted a standard way to ask about agent risk since the first agent showed up in a vendor review, and a combined AICPA-backed report gives them one. A plain SOC 2 won’t become worthless. But for any vendor whose product acts on its own inside a customer’s systems, it will start to read as half an answer. The MAS AI Risk Management Guidelines in Singapore show where this is headed: regulators make institutions accountable for third-party AI, and institutions pass that obligation down to vendors.
2. Someone who isn't you will red-team your agent
For most AI startups, AIUC-1 will be the first time an outside party attacks the product rather than the perimeter around it. Teams that have run a penetration test on their infrastructure often assume the agent is covered. It isn’t. Infrastructure testing checks whether an attacker can get in. Agent testing checks whether a user who’s already in can convince the agent to misbehave. Those are different failure modes, and the second one is where most agent incidents in 2026 have come from.
3. Annual compliance becomes quarterly
AIUC-1 requires technical retesting every quarter on top of the annual certificate. That’s four audit-grade events a year for the agent, and it kills the “scramble before the audit window” model that plenty of SOC 2 programs still run on. Controls that only exist for two weeks a year won’t survive a quarterly cadence. Continuous evidence collection stops being a nice-to-have and becomes the only practical way to keep up.
4. Your SOC 2 auditor may not be able to deliver this
Adversarial agent testing isn’t a skill most CPA firms have in-house, and AIUC accredits auditors one by one. Expect a two-tier market in 2027: firms that can deliver the joint engagement, and firms that will only ever offer the SOC 2 half. If you’re partway through your first SOC 2, auditor selection just became a question about next year as well as this one. Ask prospective auditors now whether they’re accredited for AIUC-1 or plan to be.
5. An agent failure is now, formally, a security incident
The announcement’s own framing is that agents hold credentials, call APIs, and act inside core systems, so an agent failure is increasingly a breach. That moves hallucinations, unauthorized actions, and manipulated outputs out of the product quality bucket and into the CISO’s incident response remit. If your incident response plan has no category for “the agent did something it shouldn’t have,” that’s the first gap an AIUC-1 reviewer will find.
Pro Tip: Start logging agent tool calls today, with the authorization decision attached to each one. In readiness work with AI vendors, the control most often missing evidence is tool-call authorization: the agent can call an API, but nobody can produce the list of APIs it was approved to call or a log of what it actually called. That one log satisfies SOC 2 logical access criteria, maps to ISO 42001 accountability requirements, and is the raw material for AIUC-1 testing.
What the Announcement Doesn't Answer
The press release is two minutes of reading and leaves the questions a buyer cares about open. Cost isn’t published, either for the joint engagement or for AIUC-1 on its own. Since AIUC runs the technical testing rather than the audit firm, expect the combined engagement to cost meaningfully more than a SOC 2 alone, with the agent testing priced separately from the CPA’s fee. It’s also unclear whether one opinion covers both halves, or whether the report is a SOC 2 with an AIUC certificate stapled to it.
Timing is unresolved too. Standalone AIUC-1 engagements have taken four to eight weeks at companies with mature AI governance, and UiPath’s first certification took eight. How that overlaps with a SOC 2 Type II observation period, which usually runs three to twelve months, will decide whether the joint engagement saves time or just saves a second contract.
What to Do Before the 2027 Launch
The right move depends on where you are. If you’re starting SOC 2 compliance in the next six months, scope agent controls into the system description from day one: tool-call authorization, agent activity logging, human oversight thresholds, and an incident response category for agent misbehavior. None of that is required for SOC 2 today. All of it is required for AIUC-1, and bolting it on in twelve months means reopening a system description your auditor has already signed off on.
If you already hold ISO 42001, you’re in a better spot than you might think. The management-system work covers most of AIUC-1’s accountability and governance requirements, so what’s left is the technical testing. Teams already managing AI-generated code under SOC 2 and ISO 27001 change management will find the same discipline extends to agent behavior.
If you have neither, don’t jump straight to AIUC-1. The standard assumes baseline security controls, and procurement teams will still ask for SOC 2 first. Get the baseline, scope it for agents, and treat the joint certification as your renewal path rather than your starting point.
Conclusion
The AICPA and AIUC have put the accounting profession’s brand on AI agent assurance, and once the joint engagement launches in early 2027, enterprise procurement will have a standard document to ask for. The certification is still young and a few details are unresolved, but the direction is clear: live adversarial testing of agents, every quarter, delivered through the same CPA firms that already issue SOC 2 reports. Companies shipping agents that scope their SOC 2 for this now will renew into it. The ones that don’t will do the work twice.
