Key Takeaways
- The offering combines two things in one engagement. A SOC 2® report covers security, availability, processing integrity, confidentiality, or privacy controls, while AIUC-1 certification focuses on the safety, security, and reliability of AI agents.
- It is still early. Several firms are delivering pilot engagements, and a full launch is expected in early 2027, so details such as pricing and scope may continue to evolve.
- Auditwerx helps you build the foundation first. A strong SOC 2® program, supported by SOC readiness work, is the base on which any future AI assurance rests, and the Auditwerx team follows these developments closely, so clients are never surprised.
What Is the New Joint SOC 2® and AI Agent Assurance Offering from AICPA and AIUC?
On October 19, 2026, the AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering that pairs a SOC 2® report with an AIUC-1 certification, delivered as one report from one engagement. It is currently in a pilot phase, with a full launch expected in early 2027. Its goal is to give buyers independent evidence about both security controls and AI agent behavior.
If your inbox is filled with questions about “AI assurance,” you are not alone. Companies are racing to deploy AI agents, buyers are racing to verify them, and everyone is tired of trading spreadsheets of security questions. This guide breaks down what the joint offering includes, how AIUC-1 testing works, who benefits, what is still unknown, and what you can do right now to get ready, without waiting for the final launch.
Bottom line: According to the announcement, more than 40,000 organizations earned either a SOC 2® attestation or an AIUC-1 certification last year.
Speak to a Compliance Specialist.
Why Is Trust in AI Agents So Hard to Establish?
AI agents are not just chatbots that answer questions. According to the announcement, they now hold credentials, call APIs, and act inside core business systems. That changes the risk equation: an AI failure is increasingly a security breach, not merely an awkward answer.
Meanwhile, the way companies establish trust has barely changed. A buyer sends a security questionnaire. The vendor answers it. The buyer follows up. The vendor clarifies. Weeks pass. The announcement describes this pattern as trust negotiated one questionnaire at a time, a process that is slow, costly, and rarely settles the question.
The data shows why buyers are nervous. IBM’s 2025 Cost of a Data Breach Report found that 13% of organizations reported breaches involving AI models or applications, and nearly all of those organizations lacked proper AI access controls. When the technology is moving this quickly, a self-completed questionnaire does not feel like enough.
The joint offering is designed to replace that cycle with a single, independent reference point.
What Exactly Is in the Joint Offering?
The offering has two components delivered together:
- A SOC 2® report. An independent examination performed by a licensed practitioner under the AICPA Attestation Standards. It evaluates controls relevant to the security, availability, processing integrity, confidentiality, or privacy of a system and includes an opinion on the design and operating effectiveness of those controls.
- An AIUC-1 certification. A standard focused specifically on AI agent safety, security, and reliability, described in the announcement as the world’s first of its kind.
The pairing is intentional. The SOC 2® report speaks to the organization’s control environment. AIUC-1 speaks to how its AI agents behave.
Dimension | SOC 2® Report | AIUC-1 Certification |
Primary question answered | Are your controls designed and operating effectively? | Do your AI agents behave as intended and resist attack? |
Focus | System security, availability, processing integrity, confidentiality, privacy | Agent safety, security, reliability, accountability, data and privacy, society |
Method | Examination of control design and operation under attestation standards | Standard-based review plus live testing of agent behavior |
Output | Report with an opinion | Certification |
Renewal | Annual | Annual, plus quarterly technical retesting |
Delivered in the joint offering | Yes | Yes, in a single report from one engagement |
Notice that the joint offering does not replace SOC 2®. It builds on it.
What Is AIUC-1, and Who Is Behind It?
According to the announcement, AIUC-1 was developed by a consortium of more than 250 chief information security officers and security leaders, and it is updated quarterly to keep pace with real-world AI risks. That update cadence is notable. Many traditional standards change every few years. A quarterly rhythm reflects how quickly agent risks evolve.
The controls span six principles:
- Data and privacy. How data used by agents is collected, protected, and limited.
- Protection against unauthorized access, manipulation, and misuse.
- Preventing harmful or unintended behavior.
- Consistent, accurate performance, including limiting hallucinations.
- Clear ownership, oversight, and responsibility for agent actions.
- Broader impacts of AI systems beyond the organization.
The controls also map to well-known frameworks including MITRE ATLAS, ISO 42001, and the EU AI Act. That mapping matters because many organizations are already tracking those frameworks. If you have worked on ISO-style governance or reviewed the AI threat landscape, you will recognize familiar themes.
How Does the Live Testing of AI Agents Work?
The biggest difference between AIUC-1 and a traditional controls examination is the emphasis on testing behavior, not just reviewing policies.
The announcement explains that agents are tested across hundreds of risk and attack combinations. These include:
- Hallucinations
- Data leakage
- Manipulative requests
- Adversarial prompt injection
Each combination is evaluated through iterative conversations, and a typical evaluation covers thousands of scenarios. In plain English, instead of asking “Do you have a policy against data leakage?” the process asks, “What happens when someone actively tries to make your agent leak data?”
This is a meaningful shift. Policies show intent. Testing shows outcomes. For buyers who are about to give an agent access to customer records or financial workflows, outcomes are what matter.
For your team, it also suggests a new type of readiness: not only documenting controls, but also running your own adversarial tests and keeping the results.
How Often Does the Certification Need to Be Renewed?
Both parts of the offering require annual renewal. AIUC-1 adds quarterly technical retesting on top of that. The rationale is simple: AI risks change quickly, and a certificate that is two years old says little about an agent that was updated last week.
Activity | Frequency |
SOC 2® report refresh | Annual |
AIUC-1 certification renewal | Annual |
AIUC-1 technical retesting | Quarterly |
AIUC-1 standard updates | Quarterly |
For planning purposes, that means evidence collection, testing, and remediation become a steady rhythm instead of a once-a-year sprint. Teams that treat compliance as continuous, with owners, calendars, and automated evidence, will find it easier to keep up.
Who Benefits Most from the Joint Offering?
The announcement highlights two groups.
- AI developers and vendors. If you build AI agents, buyers want proof that they behave as promised and meet enterprise security requirements. A single independent report can shorten sales cycles and reduce the number of custom questionnaires.
- Enterprises deploying AI agents. If you are the buyer, you need assurance that both the agents and the systems they touch are secure. Independent evidence helps procurement, security, and legal teams make faster, better-informed decisions.
A useful way to think about it:
If you are… | The offering helps you… |
A software vendor with AI agents | Differentiate in competitive evaluations and reduce questionnaire fatigue |
A company embedding third-party agents in workflows | Compare vendors using consistent independent evidence |
A security or risk leader | Gain a clearer picture of agent behavior, not just policy statements |
A board or investor group | See objective evidence on AI safety and governance |
What Do We Still Not Know?
Good thought leadership acknowledges uncertainty. Because the offering is in its pilot phase, several questions remain open:
- Pricing and effort. Costs and timelines for the combined engagement have not been widely established.
- Which firms will offer it. The announcement says several firms are delivering the offering, but availability across the market will likely grow after the initial engagements conclude.
- How buyers will weigh it. It will take time to see whether procurement teams treat it as a requirement, a differentiator, or a nice-to-have.
- How it will evolve. With a quarterly update cycle for AIUC-1 and an exposure draft proposing changes to the SOC 2® criteria, details will keep shifting.
If someone claims to know exactly how all of this will look in two years, be skeptical. The best strategy is to prepare for direction, not for specifics.
How Does This Fit with Other Recent SOC Developments?
Three developments are landing close together, and it helps to see them as one story.
- TQA Section 9561 (September 11, 2026). Guidance clarifying that AI does not create a separate SOC examination model and that existing criteria apply.
- The joint AICPA and AIUC offering (October 19, 2026). A pilot that pairs SOC 2® with an AI agent certification.
- The proposed 2027 Trust Services Criteria update (October 28, 2026). An exposure draft that adds points of focus covering AI governance, model monitoring, prompt manipulation, data poisoning, and more, with comments due by January 15, 2027.
The common thread: AI is being folded into mainstream assurance, from several directions at once. The practical lesson is that waiting for a single “final answer” is not necessary. The preparation steps are the same either way.
How Can You Prepare for AI Assurance Today?
You do not need to wait for the full launch to get moving. Here is a practical eight-step readiness plan.
- Build an AI inventory. List every AI tool, model, agent, and provider, including those used by individual teams.
- Inventory agent permissions. Document which credentials, APIs, and systems each agent can access, and who owns each one.
- Strengthen your SOC 2® foundation. Access control, change management, vendor oversight, logging, and incident response underpin everything else.
- Document data flows. Know what data agents see, where it goes, and how long it is retained.
- Write AI governance policies. Cover approved tools, acceptable use, human oversight, and escalation paths.
- Test your own agents. Try prompt injection, data extraction, and manipulation scenarios, and record results and fixes.
- Review third-party providers. Know which outside models your agents depend on and how you oversee them.
- Create an evidence calendar. Schedule recurring reviews so artifacts stay current throughout the year.
If your organization already holds a SOC 2® report, you have a head start. If not, now is a great time to begin.
How Can Auditwerx Help You Stay Ahead?
Auditwerx is a security compliance reporting and advisory firm serving clients across the United States and internationally. As a division of CRI, Auditwerx offers large-firm resources with boutique-level service.
Here is where the Auditwerx team can help right now:
- SOC readiness. Identify gaps in access control, change management, vendor oversight, and documentation before your formal examination begins.
- SOC 1®, SOC 2®, and SOC 3® reporting. Build the independent assurance foundation that customers already request.
- Security compliance assessments. Evaluate your broader program, including AI-related risks, against recognized frameworks.
The Auditwerx team also keeps a close eye on evolving standards and shares what matters in plain language, so you can plan with confidence. Think of it as a good beekeeper: watching the weather so the hive is ready before the storm.
Prepare for AI Assurance With Auditwerx
The joint offering from the AICPA and AIUC signals a clear direction: buyers want independent, evidence-based confidence in AI agents, and professional assurance is moving to meet that demand. The offering is still in pilot, but the work that supports it, such as strong controls, clear ownership, thorough documentation, and regular testing, is valuable right now.
Organizations that start early will answer questions faster, close deals with fewer hurdles, and be better positioned as the market matures.
Here’s what to do next:
- Take Inventory – List your AI agents, the systems they touch, and the credentials they use.
- Shore Up the Foundation – Review your SOC 2® controls for access, change management, vendor oversight, and logging.
- Plan With a Partner – Contact Auditwerx to schedule a SOC readiness conversation and build a roadmap that fits your timeline.
Ready to earn trust in the age of AI agents? Get started today with Auditwerx, where confident compliance begins.
Frequently Asked Questions
Does the joint offering replace SOC 2®?
No. It combines a SOC 2® report with an AIUC-1 certification. SOC 2® remains the foundation for security and control assurance, and the AI agent certification adds a focus on agent behavior.
When will the offering be generally available?
According to the announcement, several firms are delivering it now as a pilot, and a full launch is expected in early 2027 once initial engagements conclude.
Does this matter if my company only uses AI internally?
It is aimed mainly at organizations that build or deploy AI agents with meaningful access to systems and data. Internal-only productivity use may not be in scope, though your security and privacy policies should still address it.
How does AIUC-1 relate to ISO 42001 and the EU AI Act?
The announcement says AIUC-1 controls map to frameworks including ISO 42001, the EU AI Act, and MITRE ATLAS. Mapping helps organizations reuse evidence, but each framework has its own scope and requirements.
What is the first step to prepare?
Build an inventory of every AI tool and agent, including the credentials and data each one can access. You cannot govern or test what you have not identified.
About the Author
