AICPA and AIUC Introduce New AI Assurance Program

The American Institute of Certified Public Accountants (AICPA) and Artificial Intelligence Underwriting Company (AIUC) have announced a new joint assurance offering designed to help organizations evaluate the security, safety, and reliability of artificial intelligence (AI) systems.

Announced October 19, 2026, this program combines the established System and Organization Controls (SOC 2) reporting framework with AIUC-1, a standard developed specifically to assess the risks associated with AI agents.

The initiative introduces a new area of opportunity for certified public accountants (CPAs) and assurance professionals as businesses increasingly incorporate AI into their operations and seek independent verification of the technology they use.

What is the new AI assurance program?

The joint SOC 2 and AIUC-1 offering brings together two complementary approaches to evaluating organizational risk.

SOC 2 is an established assurance framework used by CPAs to examine controls relevant to security, availability, processing integrity, confidentiality, and privacy. These engagements provide organizations and their stakeholders with independent information about the design and, when applicable, operating effectiveness of internal controls.

AIUC-1 focuses specifically on AI agents, systems capable of performing tasks, interacting with software, and taking actions with varying degrees of autonomy.

The AIUC-1 standard addresses six areas of AI-related risk:

• Data and privacy: Protecting sensitive information, intellectual property, and customer data.
• Security: Evaluating vulnerabilities, access controls, and potential manipulation of AI systems.
• Safety: Identifying harmful, inappropriate, or unintended system behavior.
• Reliability: Assessing whether AI systems perform consistently and operate within established boundaries.
• Accountability: Establishing appropriate oversight, documentation, and responsibility for AI-related decisions.
• Society: Addressing broader risks associated with the misuse of AI technology.

In addition to evaluating organizational controls, AIUC-1 incorporates technical testing of AI systems. According to the AIUC-1 standard, these evaluations address security, safety, and reliability risks, including adversarial testing, potential exposure of sensitive information, harmful or unintended outputs, and inaccurate AI-generated responses.

The combined offering is designed to provide a single CPA-led engagement incorporating SOC 2 assurance and AIUC-1 certification.

Why was the program developed?

As organizations expand their use of AI, the technology is moving beyond basic content generation and administrative assistance.

AI agents can now interact with business applications, access sensitive information, initiate transactions, and perform activities that previously required direct human involvement. These capabilities create new considerations for internal controls, cybersecurity, data governance, and organizational accountability.

Traditional assurance engagements provide an established method for evaluating many of the controls surrounding information systems. However, AI agents introduce additional questions about how technology behaves when making decisions or interacting with other systems.

The standard is maintained through the AIUC-1 Consortium, which brings together over 300 security executives, researchers, technology professionals, and other specialists. It is updated quarterly to reflect evolving AI capabilities and emerging risks.

By combining this technical approach with the AICPA's established attestation framework, the organizations aim to provide a more comprehensive evaluation of both organizational controls and AI agent behavior.

Why accountants should be leading AI compliance efforts

For accounting professionals, the announcement represents a development in the relationship between technology, risk management, and independent assurance.

CPAs have long played a role in evaluating internal controls and providing assurance over financial and nonfinancial information. As organizations incorporate AI into operational processes, the need to evaluate controls surrounding those systems becomes increasingly relevant.

The new offering has implications for several areas of the profession, such as expanding assurance services, supporting client risk management, and evaluating technology vendors.

Who can get involved?

According to the AICPA's announcement, several CPA firms are already delivering combined SOC 2 and AIUC-1 engagements, with a broader launch expected in early 2027.

The initiative is relevant to several groups:

• CPA firms and assurance professionals can contact AIUC to inquire about participation in the joint offering.
• Organizations using AI agents can explore AIUC-1 certification, which involves evaluation against applicable requirements by accredited auditors.
• Accounting and risk management professionals can review the publicly available AIUC-1 standard to better understand AI-related risks and controls.

A broader focus on AI governance and accountability

The joint assurance initiative also reflects increasing attention to organizational responsibility for AI systems.

In its September 2026 whitepaper, Board Accountability and Agentic AI, AIUC-1 identifies three governance priorities for boards: translating AI principles into measurable controls, improving understanding of agentic AI, and owning AI governance.

As AI systems become more integrated into business operations, organizations may need to assess not only whether appropriate policies exist but also whether the technology operates consistently with those policies.

What comes next?

The combined SOC 2 and AIUC-1 offering is currently in its initial implementation stage, with a broader launch anticipated in early 2027. This program also calls for annual renewal of SOC 2 reporting and AIUC-1 certification, along with quarterly technical retesting of AI agents.

For accounting professionals, the immediate opportunity is to become familiar with the framework, understand how AI-specific risks differ from traditional information technology risks, and evaluate whether AI assurance is relevant to their clients or service offerings.

As AI systems take on more responsibilities within business operations, the need for independent assurance of their security, reliability, and governance is becoming increasingly important.

This article was written with the assistance of AI and edited by a human.