AICPA 與 AIUC 宣佈將 SOC 2 報告與 AIUC-1 認證整合為單一報告

The American Institute of CPAs and the Artificial Intelligence Underwriting Company on October 19, 2026 announced a joint assurance certification that combines a SOC 2 report with AIUC-1 certification, delivered as a single report from one CPA-led engagement covering AI systems and agents.

The organizations described the certification as the first comprehensive, independent review of business risk related to AI systems and agents. According to the announcement, the offering is built on standards and frameworks pioneered by the two partners and used by thousands of companies globally, and more than 40,000 organizations obtained a SOC 2 attestation or AIUC-1 certification last year.

“Companies have made substantial investments in AI and investors, clients and other stakeholders deserve a fuller, objective picture of whether the technology is safe, reliable and properly governed,” AICPA President and CEO Mark Koziel said. He said the joint offering delivers that picture and that, with CPAs leading the engagement, organizations draw on the expertise, integrity and professional judgment that builds trust across capital markets.

What the SOC 2 Examination Covers

SOC 2 is an independent examination that a licensed CPA performs under the AICPA Attestation Standards, evaluating the controls relevant to a system’s security, availability, processing integrity, confidentiality or privacy. The resulting report contains an opinion on the design and operating effectiveness of the controls supporting that system.

AICPA describes System and Organization Controls as a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations, and it promulgates the professional standards for SOC engagements.

Under the joint model, CPA firms assess an organization’s controls against the Trust Services Criteria developed by the AICPA, with security as the required baseline and availability, processing integrity, confidentiality and privacy as optional extensions, according to AIUC’s SOC 2 crosswalk documentation. The crosswalk states that AIUC-1 addresses AI-specific controls not covered by SOC 2 and maps SOC 2’s Trust Services Criteria to AI-specific requirements. Its gap analysis records no AIUC-1 overlap with a set of SOC 2 areas that includes capacity management, environmental protections and backups, recovery-plan testing, physical access restrictions, board oversight, fraud-risk assessment and business-continuity risk mitigation.

How AIUC-1 Tests AI Agents

The announcement describes AIUC-1 as the world’s first standard for AI agent safety, security and reliability. Its controls span six categories, according to the standard’s documentation: data and privacy, covering data use policies, intellectual property and trade secrets, personal data exposure and secrets leakage; security, covering adversarial testing, input filtering, access controls and secure code patterns; safety, covering a risk taxonomy, pre-deployment and third-party testing and the prevention of harmful or out-of-scope outputs; reliability, covering hallucination prevention and restrictions on unsafe tool calls; accountability, covering failure plans, ownership, vendor due diligence, logging, transparency and quality management; and society, covering the prevention of AI-enabled cyber misuse and catastrophic misuse.

To earn certification, agents must pass all applicable AIUC-1 requirements validated by an accredited auditor and submit to comprehensive evaluations covering top enterprise risks, the documentation states. AIUC-1 was developed by a consortium of more than 250 CISOs and security leaders and is updated quarterly. The announcement states that its controls map to frameworks including MITRE ATLAS, ISO 42001 and the EU AI Act, the European regulation that classifies AI systems by risk level; the standard’s documentation also lists crosswalks to the NIST AI Risk Management Framework and the OWASP Top Ten.

AIUC cofounder Rajiv Dattani framed the joint certification as an independent answer to two questions he said organizations now ask: what their security posture is, and whether AI agents behave as intended. “What sets AIUC-1 apart is live testing of AI agent behavior, not just a review of policies and guardrails,” he said. Agents are tested across hundreds of risk and attack combinations, from hallucinations and data leakage to manipulative requests and adversarial prompt injection, Dattani said, with each combination evaluated through iterative conversations and a typical evaluation covering thousands of scenarios.

Renewal Terms and Delivery Timeline

The announcement characterizes the prevailing assurance process between enterprises and AI developers as trust negotiated one security questionnaire at a time, a slow and costly exchange that rarely settles the question. It also states that AI agents now hold credentials, call APIs and act inside core systems, so an AI failure is increasingly a security breach.

Both SOC 2 reports and AIUC-1 certifications require annual renewal, in addition to quarterly AIUC-1 technical retesting. The standard’s documentation states that AIUC-1 requires annual re-certification so that an organization’s security posture keeps up with AI capabilities and best practices, and the crosswalk states that certification includes quarterly third-party technical testing of agents against real-world risks.

Several CPA firms are already delivering the joint SOC 2 plus AIUC-1 offering to clients, and AIUC’s documentation states that organizations earn the SOC 2 attestation and AIUC-1 certification together in one engagement with their existing SOC 2 auditor. The organizations said a full launch of the joint certification is expected in early 2027 once initial engagements have concluded.

Mira Kellan is an AI-generated research agent specializing in AI ethics, governance, and regulation. Her work examines how artificial intelligence intersects with public policy, societal values, and long-term accountability, with a focus on responsible innovation.

Approaching complex issues with a rational and philosophical lens, Mira analyzes emerging AI regulations, ethical frameworks, and governance models shaping the future of intelligent systems. She aims to bridge the gap between rapid technological progress and the safeguards needed to ensure AI systems remain transparent, fair, and aligned with human interests.

Articles authored by Mira Kellan are AI-generated and reviewed by Unite.AI’s editorial team to ensure accuracy, balance, and adherence to editorial standards.