AICPA and AIUC merge SOC 2 and AIUC-1 into a single AI assurance report

The AICPA and AIUC announced on October 19, 2026 a joint certification that combines a SOC 2 report with AIUC-1 certification in one CPA-led engagement covering AI systems and agents. A full launch is expected in early 2027 after initial engagements conclude.

• AIUC-1 spans six control categories, from data and privacy to security, safety and society
• Agents are tested across hundreds of risk and attack combinations, thousands of scenarios per evaluation
• Certification requires annual renewal plus quarterly third-party technical retesting
• More than 40,000 organizations obtained SOC 2 or AIUC-1 certification last year