AICPA AI Assurance: SOC 2 Plus AIUC-1 Explained

AICPA AI assurance is a joint offering from the American Institute of CPAs and the Artificial Intelligence Underwriting Company (AIUC) that gives organizations one CPA-led report covering both their AI systems and their AI agents. It combines a SOC 2 report with an AIUC-1 certification in a single engagement. The offering is in a pilot phase now, with several CPA firms already delivering it to clients, and a full launch is expected in early 2027. It matters most for CPAs in attest practice, firms advising clients on AI, and organizations that deploy AI agents in core operations.

AICPA AI assurance: what the offering is

AICPA AI assurance is a single CPA-led engagement that produces one report combining a SOC 2 examination of system controls with AIUC-1 certification of AI agent safety, security, and reliability, now in pilot with a full launch expected in early 2027.

The announcement came on October 19, 2026, from New York and San Francisco. The AICPA and AIUC describe the offering as the first comprehensive, independent review of business risk related to AI systems and agents. That wording matters. Until now, an organization that wanted independent comfort over AI had to assemble it from separate pieces. This offering puts two established pieces into one engagement with one report at the end.

Two points in that description deserve attention. First, the engagement is CPA-led. SOC 2 examinations are performed by licensed CPAs under AICPA attestation standards, which is why the report carries weight with investors, clients, and other stakeholders. Second, the offering covers both systems and agents. The SOC 2 half examines the controls around the system. The AIUC-1 half tests how the agents themselves behave. Either half alone would leave a gap, and the gap is exactly where AI risk lives.

AICPA AI assurance: why it exists now

AI agents have moved from demos into core operations. They hold credentials, call application programming interfaces, and act inside systems that move money, data, and decisions. When an agent like that misfires, the result can be a data leak, an unauthorized action, or a security breach. As the AICPA announcement puts it, an AI failure is increasingly a security breach.

That shift is why policy reviews alone no longer settle the question. An organization can have sound AI governance documents and still run an agent that leaks data when pushed, follows a manipulative instruction, or falls for an adversarial prompt injection. Trust in AI vendors is currently negotiated one security questionnaire at a time. The AICPA describes that exchange as slow and costly, and says it rarely settles the question and hinders AI adoption. A single independent report is meant to replace that questionnaire cycle with evidence.

For CPAs, the timing is also a market signal. More than 40,000 organizations obtained a SOC 2 attestation or an AIUC-1 certification last year, according to the joint announcement. That figure counts the two separate programs, not the joint offering, but it shows the demand the joint report now serves in one engagement.

AICPA AI assurance: the SOC 2 half

SOC 2 is the familiar half of the offering: an independent examination performed by a licensed CPA under the AICPA Attestation Standards. It evaluates controls relevant to the security, availability, processing integrity, confidentiality, or privacy of a system, and the resulting report includes an opinion on the design and operating effectiveness of those controls.

In plain language, the SOC 2 half answers this question: are the controls around the system designed well, and do they actually operate as designed over time? That covers the platform the agent runs on, the data it can reach, and the access rules that govern it. Without it, even a well-behaved agent runs on an unexamined system.

AICPA AI assurance: the AIUC-1 half

AIUC-1 is the newer and more distinctive half. The AICPA describes it as the world first standard for AI agent safety, security, and reliability. It was developed by a consortium of more than 250 chief information security officers and security leaders, and it is updated quarterly to keep pace with real-world AI risks.

Its controls span six principles: data and privacy, security, safety, reliability, accountability, and society. They map to frameworks including MITRE ATLAS, ISO 42001, and the EU AI Act. That mapping means the certification speaks a language security and compliance teams already use. Mapping to a framework is not the same as legal compliance with it, and readers should not treat the certification as a substitute for legal advice on any specific regulation.

What sets AIUC-1 apart, according to AIUC cofounder Rajiv Dattani, is live testing of agent behavior rather than a review of policies and guardrails alone. Agents are tested across hundreds of risk and attack combinations, including hallucinations, data leakage, manipulative requests, and adversarial prompt injection. With a typical evaluation covering thousands of scenarios.

What is tested	What it looks like in practice
Hallucinations	An agent states false facts with confidence, for example inventing a policy, a figure, or a source that does not exist.
Data leakage	An agent reveals information it should not share, such as internal data, another customer data, or credentials.
Manipulative requests	An agent is talked into an action it should refuse, through pressure, reframing, or a false premise.
Adversarial prompt injection	Hidden or hostile instructions inside content the agent reads override what the user actually asked for.

AICPA AI assurance: the single report model

The joint offering delivers one report from one CPA-led engagement. That single-report design is the whole point. A client does not hire one firm for SOC 2 and another provider for AI testing and then try to reconcile two documents with different scopes and dates. One engagement covers the system controls and the agent behavior, and one report speaks to both.

Part of the report	Who performs it	What it covers
SOC 2 report	Licensed CPA under AICPA attestation standards	Controls for security, availability, processing integrity, confidentiality, or privacy, with an opinion on design and operating effectiveness
AIUC-1 certification	AIUC technical testing, inside the CPA-led engagement	AI agent safety, security, and reliability across six principles, tested live

For the organization being examined, the benefit is a cleaner story: investors, enterprise clients, and regulators each get the same reference document instead of a different questionnaire answer. For the CPA firm, it is a broader engagement built on attest skills the firm already has.

AICPA AI assurance: pilot, launch, and renewal

The offering is in a pilot phase now, with several CPA firms already delivering the joint offering to clients. Once initial engagements have concluded, a full launch is expected in early 2027. That sequence matters: this is not a concept announcement with nothing behind it, and it is not yet a fully launched program with published details for every firm.

Stage	Status
Announcement	October 19, 2026, by the AICPA and AIUC
Pilot phase	Running now; several CPA firms already delivering the joint offering to clients
Full launch	Expected in early 2027, once initial engagements have concluded
Renewal	Annual renewal for both SOC 2 reports and AIUC-1 certifications
AIUC-1 retesting	Quarterly technical retesting, in addition to annual renewal

The renewal cadence is one of the most important details for firms planning around this offering. Both SOC 2 reports and AIUC-1 certifications require annual renewal, and AIUC-1 requires quarterly technical retesting on top of that. The cadence exists because AI risk evolves constantly: stakeholders get independent verification that the organization continues to meet evolving standards. For firms, it also means recurring work rather than a one-time project.

Pricing is not published. The announcement does not state a fee, and no fee figure is given in this guide. Interested organizations should confirm pricing and scope directly with a participating CPA firm, since both will vary with the size and complexity of the systems and agents involved.

AICPA AI assurance: what it means for CPAs

For CPAs, this offering opens a service line that sits squarely inside existing attest competence and extends it into AI. The core skills are familiar: evaluating controls, testing operating effectiveness, and forming an opinion under attestation standards. The new layer is AI literacy: how agents work, where they fail, and what live behavior testing can and cannot prove.

Three groups of CPAs should pay attention first. CPAs in attest practice at firms that already deliver SOC 2 reports are closest to this work, since the joint offering builds directly on engagements they already sell. Those advising clients on technology risk or AI adoption can use the report as a practical recommendation when a client asks how to judge an AI vendor. CPAs in industry at organizations deploying agents should watch the full launch, because enterprise clients will increasingly ask for this report.

Students and early-career CPAs should treat this as a direction of travel rather than an exam to book. There is no individual exam, passing score, or credential letter announced for this offering. The sensible preparation is to build the underlying skills: a solid grounding in SOC 2 and attestation standards, plus working knowledge of how AI agents behave, how prompt injection works, and how AI controls map to frameworks such as ISO 42001. That combination is what this service line rewards.

Readers comparing CPA career paths can find the broader picture in our guide to choosing between the major certifications: CPA vs CFA vs ACCA: Which Certification to Choose?. The AICPA announcement itself is the primary source for every program fact in this guide: AICPA and AIUC joint AI assurance announcement.

AICPA AI assurance: what it does not do

Clear limits matter as much as the promise, so here are the boundaries readers should keep in mind.

First, this is not an individual certification that a CPA earns by passing an exam. It is an assurance service that CPA firms deliver to organizations. No exam format, passing score, eligibility rule, or post-nominal letter has been announced, and this guide claims none.

Second, a clean report does not guarantee that an agent will never fail. It shows that controls were designed and operating effectively and that agent behavior passed live testing at the time of evaluation, with quarterly retesting to keep that picture current as systems change.

Third, mapping to frameworks is not legal compliance. AIUC-1 controls map to MITRE ATLAS, ISO 42001, and the EU AI Act, but a certification report is not a legal opinion on compliance with any specific law.

Fourth, the offering does not promise jobs, salary gains, or client wins for any CPA or firm. It creates a new service area with real demand behind it, but turning that into revenue depends on the firm, its clients, and its execution.

AICPA AI assurance: how it differs from a traditional SOC 2

Readers who know SOC 2 will ask what is actually new. The table below gives the honest answer.

Dimension	Traditional SOC 2	Joint SOC 2 plus AIUC-1
Scope	System controls: security, availability, processing integrity, confidentiality, privacy	System controls plus AI agent behavior: safety, security, and reliability of agents
Testing method	Examination of control design and operating effectiveness	Control examination plus live testing of agents across hundreds of risk and attack combinations
Output	SOC 2 report with an opinion on controls	One report from one CPA-led engagement covering both halves
Renewal cadence	Annual renewal	Annual renewal for both halves, plus quarterly AIUC-1 technical retesting
Best fit	Organizations needing comfort over system controls	Organizations deploying AI agents where behavior itself is a risk

AICPA AI assurance: practical next steps

What a reader should do next depends on where they sit.

If you work in attest practice: read the full AICPA announcement, then assess which of your SOC 2 clients deploy AI agents. Ask what agents they run, what data those agents can reach, and whether any enterprise customer has already asked for AI assurance. Those answers will tell you whether this service line fits your firm now or at full launch.

If you advise clients on AI or vendor selection: add the joint report to your vendor checklist. When a vendor claims its agents are safe, ask whether it holds a SOC 2 report, an AIUC-1 certification, or the joint report, and when the last quarterly retesting took place.

If you work inside an organization deploying agents: start with an inventory. List every agent, what systems it can touch, what data it can read, and what actions it can take without human approval. That inventory is the preparation any assurance engagement will ask for.

If you are a student or early-career CPA: build the two foundations in parallel: SOC 2 and attestation standards, plus how agents work in practice, including prompt injection and evaluation. Watch for the full launch in early 2027, and confirm program details on the AICPA site as they are published.

AICPA AI assurance is best understood as the profession answer to a simple question: can we trust this AI agent with our data and our work? The answer it offers is not a policy document or a vendor promise. It is an independent report, led by a CPA, that examines the controls and tests the behavior.