You Can Now Earn SOC 2 and AIUC-1 in One Audit: What the AICPA + AIUC Offering Means

You can now earn a SOC 2 report and an AIUC-1 certification from a single audit.

On October 19, 2026, the American Institute of Certified Public Accountants (AICPA) and the Artificial Intelligence Underwriting Company (AIUC) launched a joint offering, so one engagement can build trust in your AI agents and produce your SOC 2 report at the same time.

Buyers keep asking harder questions about how your AI behaves, and SOC 2 was never designed to answer them. By layering AIUC-1 onto your SOC 2, you can now give buyers independent, tested proof that your agents do what you say, in the same audit cycle as your SOC 2 report.

How AIUC-1 and SOC 2 Combine

The requirements for SOC 2 and AIUC-1 haven't changed. The SOC 2 Trust Services Criteria are the same as they were before the announcement, and AIUC-1 hasn't adapted to cover any ground already in your SOC 2. The partnership means that you can cover both frameworks in one comprehensive report with a single auditor.

CPA firms will assess your controls against the SOC 2 Trust Services Criteria and simultaneously check the AI-specific controls required by AIUC-1. The two work together well because AIUC-1:

• Addresses AI-specific controls not covered by SOC 2
• Maps SOC 2 TSCs to AI requirements
• Tests AI agents against real-world risks

Both frameworks still require full implementation. But tackling them in the same engagement minimizes duplicated effort and streamlines the audit, because the work they share gets collected once.

Underneath that single report, the work splits between your auditor and AIUC.

The CPA firm runs the engagement and issues the joint report. It assesses your controls against the SOC 2 Trust Services Criteria and, in the same engagement, reviews your evidence against the AIUC-1 requirements and issues a verdict on each one.

AIUC runs the technical testing of your agents and issues the AIUC-1 certificate. Today, AIUC performs those evaluations itself. The auditor doesn't design or run the agent tests; the auditor confirms the testing happened, followed the methodology, and cleared the pass bar. AIUC then signs the certification statement and issues the certificate.

Why This Matters Now

Over the last year, AI has moved from a footnote in security questionnaires to one of the first things enterprise buyers ask about. They want to know which models you build on, how those models touch customer data, and what an agent is allowed to do on its own.

Until now, proving your AI agents were secure through AIUC-1 meant working on a separate timeline alongside your SOC 2. The combined offering removes most of that duplication. Overlapping evidence requests get submitted once, so the work that SOC 2 and AIUC-1 share doesn't get done twice.

Which Firms Offer the Joint Engagement

As of November 2026, AIUC lists eight firms offering the joint engagement: BDO, Deloitte, EisnerAmper, EY, Grant Thornton, KPMG, PwC, and Schellman.

On availability, the AICPA says 'several CPA firms are now delivering' the offering, and a full launch is 'expected in early 2027' once the initial engagements wrap. So it's real and running today, but still in its early innings. There's no firm general-availability date yet.

Should You Pursue SOC 2 + AIUC-1?

SOC 2 + AIUC-1 is designed for organizations developing AI agents and agentic platforms sold to enterprise buyers, those deploying agents in high-risk environments, and those subject to regulatory requirements.

Any company building or deploying agentic AI that sells to enterprises should be paying attention to AIUC-1. But a combined credential being available doesn't mean every company should go get one this quarter.

Any decision to tackle a new framework alongside your SOC 2 should be based on business needs. It makes sense to pursue SOC 2 and AIUC-1 together if you fit the criteria mentioned above and are regularly facing questions and scrutiny around how your agents work and how they're set up to mitigate risk.

If your organization's primary use of AI is chatbots like Claude or ChatGPT, you're using agents for internal or low-risk tasks, or you're not subject to any AI regulation, SOC 2 + AIUC-1 might be less relevant for you right now. In that case, a clear, written position on how you govern AI risk is usually enough to get through security reviews.

Where AIUC-1 Fits on Your Roadmap

The combined SOC 2 and AIUC-1 audit makes proving your AI agents behave part of the compliance cycle you already run, instead of a separate program you bolt on later.

So use your next SOC 2 renewal as the decision point. If buyers are asking about your AI, or your agents are taking real actions in the world, scope AIUC-1 to see how it fits with your business goals and what doors it could open for you.

Our AIUC-1 practice helps you design and implement your AI agent program and prepare for AIUC-1 certification. If you're exploring AIUC-1 and want to understand what it would look like for your company, talk to our team.

FAQ

Does this replace a standalone SOC 2 or a standalone AIUC-1?

No. It bundles both into one engagement and one report. You can still pursue either on its own. The combined route makes sense when you want both credentials in the same window and want to avoid duplicating the shared work.

Does AIUC-1 replace ISO 42001?

No. They answer different questions and coexist. AIUC-1 tests how a specific AI agent behaves, whereas ISO 42001 certifies the management system around all of your AI.

Does my existing SOC 2 already cover AI?

AI-specific risks like agent behavior, hallucinations, and unsafe tool use sit outside the scope of a standard SOC 2. Learn how to extend your SOC 2 for AI here.