The American Institute of Certified Public Accountants (AICPA) and Artificial Intelligence Underwriting Company (AIUC) have announced a new joint assurance offering designed to help organizations evaluate the security, safety, and reliability of artificial intelligence (AI) systems.
Announced October 19, 2026, this program combines the established System and Organization Controls (SOC 2) reporting framework with AIUC-1, a standard developed specifically to assess the risks associated with AI agents.
The initiative introduces a new area of opportunity for certified public accountants (CPAs) and assurance professionals as businesses increasingly incorporate AI into their operations and seek independent verification of the technology they use.
The joint SOC 2 and AIUC-1 offering brings together two complementary approaches to evaluating organizational risk.
SOC 2 is an established assurance framework used by CPAs to examine controls relevant to security, availability, processing integrity, confidentiality, and privacy. These engagements provide organizations and their stakeholders with independent information about the design and, when applicable, operating effectiveness of internal controls.
AIUC-1 focuses specifically on AI agents, systems capable of performing tasks, interacting with software, and taking actions with varying degrees of autonomy.
The AIUC-1 standard addresses six areas of AI-related risk:
In addition to evaluating organizational controls, AIUC-1 incorporates technical testing of AI systems. According to the AIUC-1 standard, these evaluations address security, safety, and reliability risks, including adversarial testing, potential exposure of sensitive information, harmful or unintended outputs, and inaccurate AI-generated responses.
The combined offering is designed to provide a single CPA-led engagement incorporating SOC 2 assurance and AIUC-1 certification.
As organizations expand their use of AI, the technology is moving beyond basic content generation and administrative assistance.
AI agents can now interact with business applications, access sensitive information, initiate transactions, and perform activities that previously required direct human involvement. These capabilities create new considerations for internal controls, cybersecurity, data governance, and organizational accountability.
Traditional assurance engagements provide an established method for evaluating many of the controls surrounding information systems. However, AI agents introduce additional questions about how technology behaves when making decisions or interacting with other systems.
The standard is maintained through the AIUC-1 Consortium, which brings together over 300 security executives, researchers, technology professionals, and other specialists. It is updated quarterly to reflect evolving AI capabilities and emerging risks.
By combining this technical approach with the AICPA's established attestation framework, the organizations aim to provide a more comprehensive evaluation of both organizational controls and AI agent behavior.
For accounting professionals, the announcement represents a development in the relationship between technology, risk management, and independent assurance.
CPAs have long played a role in evaluating internal controls and providing assurance over financial and nonfinancial information. As organizations incorporate AI into operational processes, the need to evaluate controls surrounding those systems becomes increasingly relevant.
The new offering has implications for several areas of the profession, such as expanding assurance services, supporting client risk management, and evaluating technology vendors.
According to the AICPA's announcement, several CPA firms are already delivering combined SOC 2 and AIUC-1 engagements, with a broader launch expected in early 2027.
The initiative is relevant to several groups:
The joint assurance initiative also reflects increasing attention to organizational responsibility for AI systems.
In its September 2026 whitepaper, Board Accountability and Agentic AI, AIUC-1 identifies three governance priorities for boards: translating AI principles into measurable controls, improving understanding of agentic AI, and owning AI governance.
As AI systems become more integrated into business operations, organizations may need to assess not only whether appropriate policies exist but also whether the technology operates consistently with those policies.
The combined SOC 2 and AIUC-1 offering is currently in its initial implementation stage, with a broader launch anticipated in early 2027. This program also calls for annual renewal of SOC 2 reporting and AIUC-1 certification, along with quarterly technical retesting of AI agents.
For accounting professionals, the immediate opportunity is to become familiar with the framework, understand how AI-specific risks differ from traditional information technology risks, and evaluate whether AI assurance is relevant to their clients or service offerings.
As AI systems take on more responsibilities within business operations, the need for independent assurance of their security, reliability, and governance is becoming increasingly important.
This article was written with the assistance of AI and edited by a human.