What happened
On 19 October 2026 the American Institute of CPAs (AICPA) and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering that combines a SOC 2 report (performed under AICPA Attestation Standards) with an AIUC-1 certification in a single CPA-led engagement — billed as the first comprehensive independent review of business risk related to AI systems and agents. AIUC-1 is described as the industry's first standard for AI agent safety, security and reliability: built by a consortium of 250+ CISOs, organised under six principles (data and privacy, security, safety, reliability, accountability, society), mapping to MITRE ATLAS, ISO/IEC 42001, NIST AI RMF and the EU AI Act, and validated via live adversarial testing of the agent across hundreds of risk/attack combinations. Both components require annual renewal plus quarterly AIUC-1 technical retesting; several CPA firms are running pilots with a full launch expected in early 2027.
Why it matters
It establishes a single reference assurance model for AI agents, pairing organizational-control attestation (SOC 2) with live, behaviour-based agent testing (AIUC-1) — addressing the 'trust negotiated one security questionnaire at a time' problem in AI procurement. It makes AI-agent security and behaviour an auditable, CPA-attested matter and connects the combined report to the major AI frameworks (ATLAS, ISO 42001, NIST AI RMF, EU AI Act).
Action needed
Evaluate the AIUC-1 control mappings and the combined SOC 2 + AIUC-1 report against your AI-agent assurance and procurement requirements; if you sell agents into enterprises, assess readiness for combined-report audits.