---
title: "AICPA-AIUC AI Agent Certification: What It Means for Vendors"
description: "The AICPA and AIUC are bundling SOC 2 with AIUC-1 agent testing in one engagement. What changes for companies shipping AI agents before 2027."
canonical: "https://axipro.co/aicpa-aiuc-ai-agent-certification/"
language: "en-US"
modified: "2026-10-20T04:41:14+00:00"
generator: "WordPress 7.1.3"
---

[Home](https://axipro.co)

/ [AI](https://axipro.co/category/ai/), [News](https://axipro.co/category/news/), [SOC-2](https://axipro.co/category/soc-2-2/)

/ The Auditors Are Coming for Your AI Agents: What the AICPA-AIUC Certification Means for Every Company Shipping Agents

# The Auditors Are Coming for Your AI Agents: What the AICPA-AIUC Certification Means for Every Company Shipping Agents

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- October 20, 2026

Copy Link

On October 19, 2026, the AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering that bundles a **SOC 2 report** with an **AIUC-1 certification** in one CPA-led engagement. A few CPA firms are already running pilots. The full launch is set for early 2027.

If you sell AI agents into enterprises, this one’s about you. SOC 2 is the report your prospects already ask for in procurement. AIUC-1 is the standard that checks whether your agent can be talked into leaking data, inventing a refund policy, or calling an API it was never supposed to touch. Putting both into one engagement, under the AICPA’s attestation standards, changes what *audit-ready* means for any company whose software acts inside other people’s systems.

Here’s what was announced, what AIUC-1 tests, why the AICPA’s name matters more than the certificate itself, and what you should do about it if you’re working on SOC 2 or ISO 42001 right now.

## What the AICPA and AIUC Announced

The offering is a single report from one engagement led by a licensed CPA. It combines two things. The first is a standard [SOC 2 examination](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) under the AICPA Attestation Standards, with an opinion on the design and operating effectiveness of controls across the Trust Services Criteria. The second is an [AIUC-1 certification](https://www.aiuc-1.com/), the AI agent safety and security standard AIUC launched in 2025.

Both parts need **annual renewal**, and AIUC-1 adds **quarterly technical retesting** on top. The AICPA’s own framing is that trust between AI vendors and enterprise buyers currently gets negotiated one security questionnaire at a time, and that this report is meant to end that by becoming the reference document for AI assurance.

There’s real scale behind it. According to the [AICPA announcement](https://www.aicpa-cima.com/news/article/auditors-meet-urgent-demand-for-ai-assurance-with-new-offering-from-aicpa-and-aiuc), more than 40,000 organizations got a SOC 2 attestation or AIUC-1 certification last year. AIUC cofounder Rajiv Dattani described the joint report as an independent answer to the two questions enterprises now ask every AI vendor: what’s your security posture, and do your agents behave as intended?

## What AIUC-1 Actually Tests

AIUC-1 is the half that most SOC 2 veterans won’t recognize. A consortium of more than 250 CISOs and security leaders built it, it gets updated quarterly, and its controls sit under six principles: data and privacy, security, safety, reliability, accountability, and society. Those controls map to [MITRE ATLAS](https://atlas.mitre.org/), [ISO/IEC 42001](https://www.iso.org/standard/42001), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), and the [EU AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj).

What sets it apart from everything else on your compliance roadmap is **live testing of the agent itself**. Dattani called it *“live testing of AI agent behavior, not just a review of policies and guardrails.”* Each agent gets run through hundreds of risk and attack combinations, in iterative conversations covering thousands of scenarios: prompt injection, data leakage, hallucination, manipulative requests, harmful outputs, and unauthorized tool calls. A SOC 2 auditor samples your access reviews. An AIUC-1 evaluation tries to talk your agent into doing something it shouldn’t.

This isn’t a paper standard waiting for adopters. Cursor, Lovable, Harvey, ElevenLabs, KPMG, UiPath, and Intercom’s Fin have all certified products against it, and in September 2026 AIUC [raised a $40 million Series A](https://siliconangle.com/2026/09/15/ai-agent-certification-startup-aiuc-raises-40m-to-begin-auditing-frontier-models/) to extend the model from agents to frontier models. ElevenLabs used its certification to get insurance coverage for its voice agents, which is the other half of AIUC’s business: the certificate is the underwriting basis for agent liability insurance.

|  | SOC 2 | ISO 42001 | AIUC-1 |
| --- | --- | --- | --- |
| **What it evaluates** | Controls over the service organization’s systems and data | The organization’s AI management system (governance, risk, lifecycle) | The behavior and security of a specific AI agent |
| **Issued by** | Licensed CPA firm under AICPA standards | Accredited certification body | AIUC, based on an accredited auditor’s report plus AIUC’s own technical testing |
| **Testing approach** | Evidence sampling over a review period | Management system audit, Stage 1 and Stage 2 | Adversarial testing of the live agent across thousands of scenarios |
| **Cadence** | Annual report | Three-year certificate with annual surveillance | Annual certificate with quarterly technical retests |
| **Typical timeline** | 4 to 12 weeks of readiness plus the observation period | 3 to 6 months | 4 to 8 weeks, per published auditor estimates |

**Important:** AIUC-1 explicitly doesn’t duplicate SOC 2, ISO 27001, or GDPR. It assumes you already hold them and adds agent-specific requirements on top. A company with no SOC 2 can’t skip ahead by going for AIUC-1. It still needs the baseline controls first, which is the whole logic behind bundling the two.

## Why the AICPA's Name Matters More Than the Certificate

Until this week, the main criticism of AIUC-1 was about structure, not technical rigor. AIUC wrote the standard, accredits the auditors, runs the technical evaluations, issues the certificates, and sells the insurance the certificate unlocks. That’s a lot of hats for one venture-backed company, and skeptics pointed out that calling AIUC-1 a *standard* rested on AIUC’s own say-so rather than any outside accreditation body. AIUC’s answer has been that its insurance exposure keeps it honest, because losses on a badly certified agent land on its own balance sheet.

The AICPA tie-in changes that. SOC 2 carries weight in procurement because licensed CPAs perform it, and CPAs answer to state boards, peer review, and professional attestation standards with real consequences for getting it wrong. Putting a CPA in charge of the combined engagement brings that accountability to the AI half of the report, at least for whatever the CPA opines on. A procurement team that has never heard of AIUC but has required SOC 2 for a decade now has a logo it already trusts on the AI assurance.

It doesn’t settle everything. The announcement talks about a single report but doesn’t say whether the AIUC-1 portion becomes part of the CPA’s opinion or stays a separately issued AIUC certificate attached to it. It also doesn’t say who runs the quarterly technical retests between annual engagements. Those two details will decide how much weight a buyer’s security team gives the AI half of the document.

## Five Things That Change for Companies Shipping Agents

### 1. The procurement question grows a second clause

“Do you have SOC 2?” becomes “Do you have SOC 2 and AI assurance?” Enterprise security teams have wanted a standard way to ask about agent risk since the first agent showed up in a vendor review, and a combined AICPA-backed report gives them one. A plain SOC 2 won’t become worthless. But for any vendor whose product acts on its own inside a customer’s systems, it will start to read as half an answer. The [MAS AI Risk Management Guidelines](https://axipro.co/mas-ai-risk-management-guidelines/) in Singapore show where this is headed: regulators make institutions accountable for third-party AI, and institutions pass that obligation down to vendors.

### 2. Someone who isn't you will red-team your agent

For most AI startups, AIUC-1 will be the first time an outside party attacks the product rather than the perimeter around it. Teams that have run a [penetration test](https://axipro.co/services/penetration-testing/) on their infrastructure often assume the agent is covered. It isn’t. Infrastructure testing checks whether an attacker can get in. Agent testing checks whether a user who’s already in can convince the agent to misbehave. Those are different failure modes, and the second one is where most agent incidents in 2026 have come from.

### 3. Annual compliance becomes quarterly

AIUC-1 requires technical retesting every quarter on top of the annual certificate. That’s four audit-grade events a year for the agent, and it kills the “scramble before the audit window” model that plenty of SOC 2 programs still run on. Controls that only exist for two weeks a year won’t survive a quarterly cadence. Continuous evidence collection stops being a nice-to-have and becomes the only practical way to keep up.

### 4. Your SOC 2 auditor may not be able to deliver this

Adversarial agent testing isn’t a skill most CPA firms have in-house, and AIUC accredits auditors one by one. Expect a two-tier market in 2027: firms that can deliver the joint engagement, and firms that will only ever offer the SOC 2 half. If you’re partway through your first SOC 2, auditor selection just became a question about next year as well as this one. Ask prospective auditors now whether they’re accredited for AIUC-1 or plan to be.

### 5. An agent failure is now, formally, a security incident

The announcement’s own framing is that agents hold credentials, call APIs, and act inside core systems, so an agent failure is increasingly a breach. That moves hallucinations, unauthorized actions, and manipulated outputs out of the product quality bucket and into the CISO’s incident response remit. If your incident response plan has no category for “the agent did something it shouldn’t have,” that’s the first gap an AIUC-1 reviewer will find.

**Pro Tip:** Start logging agent tool calls today, with the authorization decision attached to each one. In readiness work with AI vendors, the control most often missing evidence is tool-call authorization: the agent can call an API, but nobody can produce the list of APIs it was approved to call or a log of what it actually called. That one log satisfies SOC 2 logical access criteria, maps to ISO 42001 accountability requirements, and is the raw material for AIUC-1 testing.

## What the Announcement Doesn't Answer

The press release is two minutes of reading and leaves the questions a buyer cares about open. Cost isn’t published, either for the joint engagement or for AIUC-1 on its own. Since AIUC runs the technical testing rather than the audit firm, expect the combined engagement to cost meaningfully more than a SOC 2 alone, with the agent testing priced separately from the CPA’s fee. It’s also unclear whether one opinion covers both halves, or whether the report is a SOC 2 with an AIUC certificate stapled to it.

Timing is unresolved too. Standalone AIUC-1 engagements have taken four to eight weeks at companies with mature AI governance, and UiPath’s first certification took eight. How that overlaps with a SOC 2 Type II observation period, which usually runs three to twelve months, will decide whether the joint engagement saves time or just saves a second contract.

And the offering is American in origin. If you sell into the EU or the GCC, [ISO 42001](https://axipro.co/iso-42001-certification/) is still the certification buyers and regulators recognize, and the [EU AI Act](https://axipro.co/eu-ai-act-compliance-and-certification/) has its own conformity path that no private certificate replaces. AIUC-1 maps to both, which helps, but mapping isn’t equivalence.

## What to Do Before the 2027 Launch

The right move depends on where you are. If you’re starting [SOC 2 compliance](https://axipro.co/soc-2/) in the next six months, scope agent controls into the system description from day one: tool-call authorization, agent activity logging, human oversight thresholds, and an incident response category for agent misbehavior. None of that is required for SOC 2 today. All of it is required for AIUC-1, and bolting it on in twelve months means reopening a system description your auditor has already signed off on.

If you already hold ISO 42001, you’re in a better spot than you might think. The management-system work covers most of AIUC-1’s accountability and governance requirements, so what’s left is the technical testing. Teams already managing [AI-generated code under SOC 2 and ISO 27001 change management](https://axipro.co/ai-generated-code-soc-2-iso-27001-change-management/) will find the same discipline extends to agent behavior.

If you have neither, don’t jump straight to AIUC-1. The standard assumes baseline security controls, and procurement teams will still ask for SOC 2 first. Get the baseline, scope it for agents, and treat the joint certification as your renewal path rather than your starting point.

## Conclusion

The AICPA and AIUC have put the accounting profession’s brand on AI agent assurance, and once the joint engagement launches in early 2027, enterprise procurement will have a standard document to ask for. The certification is still young and a few details are unresolved, but the direction is clear: live adversarial testing of agents, every quarter, delivered through the same CPA firms that already issue SOC 2 reports. Companies shipping agents that scope their SOC 2 for this now will renew into it. The ones that don’t will do the work twice.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- October 20, 2026
- [AI](https://axipro.co/category/ai/), [News](https://axipro.co/category/news/), [SOC-2](https://axipro.co/category/soc-2-2/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [AI](https://axipro.co/category/ai/), [News](https://axipro.co/category/news/), [SOC-2](https://axipro.co/category/soc-2-2/)

- October 20, 2026

#### [The Auditors Are Coming for Your AI Agents: What the AICPA-AIUC Certification Means for Every Company Shipping Agents](https://axipro.co/aicpa-aiuc-ai-agent-certification/)

On October 19, 2026, the AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering that bundles a SOC 2 report with an AIUC-1 certification in one CPA-led engagement. A few CPA firms are already running pilots. The full launch is set for early 2027. If you sell AI agents into enterprises, this one’s about you. SOC 2 is the report your prospects already ask for in procurement. AIUC-1 is the standard that checks whether your agent can be talked into leaking data, inventing a refund policy, or calling an API it was never supposed to touch. Putting both into one engagement, under the AICPA’s attestation standards, changes what audit-ready means for any company whose software acts inside other people’s systems. Here’s what was announced, what AIUC-1 tests, why the AICPA’s name matters more than the certificate itself, and what you should do about it if you’re working on SOC 2 or ISO 42001 right now. What the AICPA and AIUC Announced The offering is a single report from one engagement led by a licensed CPA. It combines two things. The first is a standard SOC 2 examination under the AICPA Attestation Standards, with an opinion on

[Read more](https://axipro.co/aicpa-aiuc-ai-agent-certification/)

- [HIPAA](https://axipro.co/category/hipaa/)

- October 19, 2026

#### [HIPAA Compliance Letter: Templates, Examples, and the Claims That Get Rejected](https://axipro.co/hipaa-compliance-letter/)

A HIPAA compliance letter is a signed statement in which an organization confirms how it protects protected health information (PHI). No federal regulation requires a general one, and no government body issues one. Yet it is one of the most requested documents in healthcare procurement, and one of the most common reasons a health tech deal stalls in security review. The confusion starts with the name. “HIPAA compliance letter” covers at least seven different documents, from a vendor attestation sent to a hospital’s procurement team to a breach notice mailed to 40,000 patients. Some are optional business documents. Others, like breach notification letters, carry hard legal deadlines and mandatory content under the HIPAA Breach Notification Rule, with civil monetary penalties behind them. This guide covers each type, what to include, how to write one that survives legal and procurement review, five templates you can adapt, and the documentation that has to sit behind the letter for it to mean anything. What Is a HIPAA Compliance Letter? A HIPAA compliance letter is a formal written statement from a covered entity or business associate that describes its compliance with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. It identifies who

[Read more](https://axipro.co/hipaa-compliance-letter/)

- [EU AI Act](https://axipro.co/category/eu-ai-act/)

- October 16, 2026

#### [EN 18286 Explained: What the EU’s First AI Act Standard Requires From High-Risk AI Providers](https://axipro.co/en-18286/)

EN 18286 is the quality management system (QMS) standard that providers of high-risk AI systems can follow to meet Article 17 of the EU AI Act, and since October 14, 2026, following it carries legal weight. That’s the day the European Commission cited the standard in the Official Journal of the EU, which means an AI provider that conforms to it now benefits from a presumption of conformity with the AI Act’s QMS requirements. It’s the first AI Act harmonized standard to reach that point, and most of the other high-risk obligations depend on the QMS it describes. Below, we walk through what EN 18286:2026 requires and how it’s organized, how it compares with ISO/IEC 42001, and what a realistic plan looks like before high-risk obligations kick in in December 2027. What Is EN 18286? EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes, is a European Standard that specifies requirements and guidance for defining, implementing and maintaining a quality management system for organizations that provide AI systems. It isn’t tied to any sector, so a hiring platform, a credit-scoring engine and an AI-enabled medical device can all build on it. Background and Development The

[Read more](https://axipro.co/en-18286/)

WhatsApp us