The American Institute of CPAs has partnered with the Artificial Intelligence Underwriting Company on a joint assurance certification that they say provides the first comprehensive, independent review of business risk pertaining to artificial intelligence systems and agents.
The new System and Organization Controls (SOC 2) plus AIUC-1 certification pairs CPA assurance rigor with the AIUC’s frontier AI technical testing so organizations can deploy AI with confidence, the AICPA said in a media release on Oct. 19.
The AICPA-AIUC offering is built on standards and frameworks pioneered by the two partners and used by thousands of companies globally. Last year, more than 40,000 organizations obtained a SOC 2 attestation or AIUC-1 certification.
“Companies have made substantial investments in AI and investors, clients, and other stakeholders deserve a fuller, objective picture of whether the technology is safe, reliable, and properly governed,” AICPA President and CEO Mark Koziel said in a statement. “This joint offering delivers that and, with CPAs leading the engagement, organizations are able to leverage the expertise, integrity, and professional judgment that builds trust across our capital markets.”
Enterprises deploying AI agents need assurance that both the agents and the systems they touch are secure. Developers must prove their agents behave as promised and meet enterprise security requirements. AI misfires “have raised serious concerns about its safety and security in critical business operations,” the AICPA said in the media release, and “AI agents now hold credentials, call APIs, and act inside core systems, so an AI failure is increasingly a security breach.”
“Trust is negotiated one security questionnaire at a time: a slow, costly exchange that rarely settles the question and hinders AI adoption,” the AICPA added.
The offering—a single report delivered by one CPA-led engagement—ends that cycle, the AICPA says, creating the reference for assurance on AI. It combines a SOC 2 report, recognized globally for demonstrating that an organization has effective controls to protect data, manage risk, and build stakeholder trust, and an AIUC-1 certification, the world’s first standard for AI agent safety, security, and reliability.
SOC 2 is an independent examination performed by a licensed CPA under the AICPA Attestation Standards that evaluates controls relevant to the security, availability, processing integrity, confidentiality, or privacy of a system. The resulting report includes an opinion on the design and operating effectiveness of controls supporting the system.
AIUC-1 was developed by a consortium of more than 250 chief information security officers and security leaders from Fortune 1000 companies, and is updated quarterly to keep pace with real-world AI risks. Its controls span six principles—data and privacy, security, safety, reliability, accountability, and society—and map to such frameworks as MITRE ATLAS, ISO 42001, and the EU AI Act.
“AI agents do real work, faster than anyone can check it. This joint certification provides an independent answer to the two questions every organization now asks: What is our security posture? And do AI agents behave as intended?” AIUC co-founder Rajiv Dattani said in a statement. “What sets AIUC-1 apart is live testing of AI agent behavior, not just a review of policies and guardrails. Agents are tested across hundreds of risk and attack combinations, from hallucinations and data leakage to manipulative requests and adversarial prompt injection.”
Dattani added, “Each combination is evaluated through iterative conversations, with a typical evaluation covering thousands of scenarios.”
Because risk is always evolving, both SOC 2 reports and AIUC-1 certifications require annual renewal, in addition to quarterly AIUC-1 technical retesting. This provides organizations and their stakeholders with independent verification that the organization continues to meet evolving standards for trust, security, and reliability, the AICPA says.
According to the media release, several CPA firms are now delivering a joint SOC 2 plus AIUC-1 offering to clients. Once initial engagements have concluded, a full launch of the joint certification is expected to take place in early 2027.
Photo credit: American Institute of CPAs
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
