NEW YORK and SAN FRANCISCO (Oct. 19th, 2026) – The American Institute of CPAs (AICPA) and Artificial Intelligence Underwriting Company (AIUC) are rolling out a joint assurance certification that provides the first comprehensive, independent review of business risk related to AI systems and agents.
Artificial intelligence is a transformative technology for many organizations, but misfires have raised serious concerns about its safety and security in critical business operations. AI agents now hold credentials, call APIs and act inside core systems, so an AI failure is increasingly a security breach.
The AICPA-AIUC offering is built on standards and frameworks pioneered by the two partners and used by thousands of companies globally. Last year, over 40,000 organizations obtained a SOC 2® attestation or AIUC-1 certification.
“Companies have made substantial investments in AI and investors, clients and other stakeholders deserve a fuller, objective picture of whether the technology is safe, reliable and properly governed,” AICPA President and CEO Mark Koziel said. “This joint offering delivers that and, with CPAs leading the engagement, organizations are able to leverage the expertise, integrity and professional judgment that builds trust across our capital markets.”
Enterprises deploying AI agents need assurance that both the agents and the systems they touch are secure. AI developers must prove their agents behave as promised and meet enterprise security requirements. Trust is negotiated one security questionnaire at a time: a slow, costly exchange that rarely settles the question and hinders AI adoption.
The joint offering — a single report delivered by one CPA-led engagement — ends that cycle, creating the reference for assurance on AI. It combines a System and Organization Controls (SOC 2®) report, globally recognized for demonstrating that an organization has effective controls to protect data, manage risk, and build stakeholder trust, and an AIUC-1 certification – the world’s first standard for AI agent safety, security, and reliability.
SOC 2® is an independent examination performed by a licensed CPA under the AICPA Attestation Standards that evaluates controls relevant to the security, availability, processing integrity, confidentiality or privacy of a system. The resulting report includes an opinion on the design and operating effectiveness of controls supporting the system.
AIUC-1 was developed by aconsortium of over 250 CISOs and security leaders and is updated quarterly to keep pace with real-world AI risks. Its controls span six principles (data and privacy, security, safety, reliability, accountability, and society) and map to frameworks including MITRE ATLAS, ISO 42001 and the EU AI Act.
“AI agents do real work, faster than anyone can check it. This joint certification provides an independent answer to the two questions every organization now asks: What is our security posture? And do AI agents behave as intended?” said Rajiv Dattani, cofounder of AIUC. “What sets AIUC-1 apart is live testing of AI agent behavior, not just a review of policies and guardrails. Agents are tested across hundreds of risk and attack combinations, from hallucinations and data leakage to manipulative requests and adversarial prompt injection.”
Dattani added, “Each combination is evaluated through iterative conversations, with a typical evaluation covering thousands of scenarios.”
Because risk is always evolving, both SOC 2 reports and AIUC-1 certifications require annual renewal, in addition to quarterly AIUC-1 technical retesting. This provides organizations and their stakeholders with independent verification that the organization continues to meet evolving standards for trust, security, and reliability.
Several CPA firms are now delivering a joint SOC 2® plus AIUC-1 offering to clients. Once initial engagements have concluded, a full launch of the joint certification is expected to take place in early 2027.