AICPA And AIUC Pair SOC 2 With AIUC-1: What A Single AI Agent Assurance Report Changes For Your Next Audit

On 19 October 2026 the American Institute of CPAs and the Artificial Intelligence Underwriting Company announced a joint assurance certification that combines a SOC 2 report with AIUC-1 certification. The result is a single report from one CPA led engagement that covers both conventional system controls and the behaviour of AI systems and agents. Several CPA firms are already delivering it to early clients, and the two organisations say a full launch is expected in early 2027 once those first engagements conclude. If you sell an AI product to enterprise buyers, or you run agents that hold credentials inside your own systems, this is the first assurance product designed for exactly that question.

Start with what does not change. SOC 2 is still an examination performed by a licensed CPA under the AICPA Attestation Standards, still assessed against the Trust Services Criteria, and security is still the required baseline with availability, processing integrity, confidentiality and privacy as optional categories. The report still contains an opinion on the design and operating effectiveness of your controls. Your existing SOC 2 programme, whether it runs in Vanta, Drata, Secureframe, Sprinto, Thoropass or Hyperproof, remains the foundation. AIUC states that organisations earn both the attestation and the certification in one engagement with their existing SOC 2 auditor, so this is an extension of a process you already know rather than a second audit relationship.

What AIUC-1 adds is a set of AI specific controls in six categories. Data and privacy covers data use policies, intellectual property, personal data exposure and secrets leakage. Security covers adversarial testing, input filtering, access controls and secure code patterns. Safety covers a risk taxonomy, pre deployment and third party testing, and preventing harmful or out of scope outputs. Reliability covers hallucination prevention and restrictions on unsafe tool calls. Accountability covers failure plans, ownership, vendor due diligence, logging, transparency and quality management. Society covers the prevention of AI enabled cyber misuse and catastrophic misuse. The published SOC 2 crosswalk is honest about overlap: it records no AIUC-1 coverage for areas such as capacity management, backups, recovery plan testing, physical access and board oversight, which is why the two are packaged together rather than one replacing the other.

The part that will feel new to most compliance teams is live testing. A SOC 2 examination mostly tests whether controls exist and operated over a period, using configuration evidence, tickets, logs and samples. AIUC-1 certification requires agents to pass all applicable requirements validated by an accredited auditor and to submit to evaluations that, according to AIUC, run hundreds of risk and attack combinations, from hallucination and data leakage to manipulative requests and adversarial prompt injection, with a typical evaluation covering thousands of scenarios. In other words, the auditor is not only reading your guardrail policy, they are attacking the agent to see whether the guardrail holds. A screenshot of a system prompt will not carry this engagement.

The cadence is also tighter than SOC 2. Both the SOC 2 report and AIUC-1 certification renew annually, but AIUC-1 adds quarterly third party technical retesting of agents, and the standard itself is updated quarterly by a consortium of more than 250 CISOs and security leaders. That matters for change management. Every model swap, system prompt rewrite, new tool binding or retrieval source is a change to the system under test, and a quarterly retest will find the regression your release process missed. If your agents currently change through a prompt edit in a vendor console with no pull request, no review and no record, fix that first, because it is the evidence trail both halves of this engagement will lean on.

There is a useful mapping story for teams carrying several frameworks. AIUC states that its controls map to MITRE ATLAS, ISO 42001 and the EU AI Act, and the documentation also lists crosswalks to the NIST AI Risk Management Framework and the OWASP Top Ten. That does not make AIUC-1 a substitute for an ISO 42001 certificate, which certifies a management system rather than the behaviour of a specific agent, and it is not a conformity assessment under the AI Act. It does mean that red team results, logging and ownership records produced for AIUC-1 can be reused as evidence in your ISO 42001 Annex A controls and in the technical documentation the AI Act expects from providers. Build the evidence once and tag it to each framework in your compliance platform.

Buyers will notice. The announcement frames the current process as trust negotiated one security questionnaire at a time, and that is the daily reality for any AI vendor selling into regulated customers. A combined report gives procurement a single artefact that answers both whether your security posture is sound and whether your agents behave as intended. Expect enterprise security reviews in 2027 to start asking whether you hold AIUC-1, in the same way they began asking for SOC 2 Type 2 rather than Type 1. If you are an early stage company choosing where to spend audit budget, the practical question is whether your customers are already asking about agent behaviour in their questionnaires. If they are, scoping AIUC-1 into your next SOC 2 window is likely cheaper than a separate engagement later.

Three caveats before you commit. First, the full launch is not until early 2027, so pricing, auditor availability and the final report format may still move, and you should ask your CPA firm directly whether they are one of the firms already delivering it. Second, the scope is the agent, so define precisely which agents, models, tools and data sources are in the system description, and keep internal experiments out of it. Third, live testing will produce findings. Treat the first evaluation as a readiness exercise, run your own prompt injection and data leakage tests beforehand, and budget engineering time for remediation before the period starts.

A short preparation plan for the next quarter. Inventory every agent that holds credentials or calls internal APIs and name an owner for each. Put prompts, tool definitions and model versions under version control with review, so change management covers them. Turn on logging of agent tool calls and keep it for at least the audit period. Run a basic adversarial test against your highest risk agent and record the results and fixes. Then ask your current SOC 2 auditor whether they can scope AIUC-1 into your next examination window, and check whether your compliance platform can map the new controls alongside your existing SOC 2 and ISO 42001 work.