AICPA Just Added AI Testing To SOC 2. Here’s What Changes

Updated:

November 2, 2026

Table of Contents

The American Institute of CPAs and Artificial Intelligence Underwriting Company announced a joint assurance offering on October 19 that combines a SOC 2 report and AIUC-1 certification through one CPA-led engagement. Several CPA firms are already conducting initial engagements, with a full launch expected in early 2027 after that work concludes.

The offering combines an examination of system controls with an assessment of AI agent security, safety, and reliability. Its AI testing component examines behavior under scenarios involving hallucinations, data leakage, manipulation, and adversarial prompt injection.

For businesses selling or deploying AI agents, including AI startups pursuing SOC 2 for the first time, the announcement introduces a coordinated way to present customers with both forms of assurance.

The report’s usefulness will depend on which systems it covers, what evaluators test, and how closely the assessed configuration matches the customer’s deployment.

Bright Defense news card on a dark navy background, with large outlined SOC 2 and AIUC-1 lettering joined by a glowing plus sign on the right. A bold white headline reads SOC 2 And AI Assurance In One Offering. Below it, a lime green line gives the announcement date as Oct 19, 2026. Three bullets with lime dot markers follow: AICPA and AIUC combine SOC 2 with AIUC-1 certification; AI testing covers hallucinations, data leaks and prompt injection; and the full launch is expected in early 2027 after initial CPA engagements.

What Does The Joint SOC 2 And AIUC-1 Offering Include?

Organizations pursue both assessments within the same audit window. AIUC’s joint offering documentation describes a unified deliverable containing a full SOC 2 attestation report for the selected SOC 2 Trust Services Criteria and an AIUC-1 certification report for applicable requirements, including technical evaluation results.

Each assessment retains a defined scope. SOC 2 covers the systems included in its examination. AIUC-1 covers the specified agents or platforms and their associated risks. A combined report therefore needs to make both boundaries clear.

Bright Defense infographic titled What Does The Joint SOC 2 And AIUC-1 Offering Include, drawn as a flow diagram on a navy background with lime green accents. A top bar labeled Combined Evidence Request List says overlapping evidence is submitted once. Lime connector lines branch into two cards. The SOC 2 card shows a full attestation report scoped to the systems in the examination. The AIUC-1 card shows a certification report with technical evaluation results, scoped to specified agents or platforms. Both cards merge into a bright lime band reading One Unified Deliverable, with both assessments completed in the same audit window.

AIUC also describes a combined evidence request list. Organizations submit overlapping evidence once and can use their preferred governance, risk, and compliance platform to coordinate the work.

That arrangement can reduce duplicate requests, but the announcement does not establish a standard reduction in audit fees or completion time. Companies comparing proposals should ask which activities are shared and which require separate evidence or testing.

Why Does The Announcement Focus On AI Agent Behavior?

The partnership addresses agents that can hold credentials, call APIs, and act within business systems. Those capabilities make an agent’s behavior relevant to the security of the systems it can reach.

Consider a customer support agent allowed to retrieve account records. A buyer needs to understand both its access restrictions and whether a manipulated request could cause it to reveal another customer’s information. For an agent connected to payment tools, the assessment may also need to examine attempted transactions outside its intended authority.

These examples illustrate the questions buyers should bring to an engagement. The assessment needs to address the agent’s actual permissions and intended use. A general claim that an AI product has been tested gives buyers little basis for judging an unexamined deployment.

What Does AIUC-1 Assess?

AIUC-1 combines technical requirements with governance and operational practices across six areas. Its published overview describes the following coverage.

These categories describe the framework. A particular report’s scope determines which requirements and controls were assessed for the agents it covers.

What Technical Testing Does AIUC-1 Require?

AIUC-1’s security requirements call for third-party evaluation of security robustness at least every three months. They also address unauthorized agent actions, user privileges, deployment security, and information leakage.

The standard distinguishes mandatory requirements from optional ones. Its security page labels third-party security testing as mandatory, while specific requirements for adversarial-input monitoring and real-time input filtering are optional. Buyers should therefore check the applicable requirements rather than assume every item in the control library appears in a certification.

The reliability requirements address hallucinated outputs and unsafe tool calls. They require third-party evaluation of reliability risks at least every three months. Unsafe tool use includes unauthorized actions, access to restricted information, and decisions beyond the system’s intended scope.

These requirements establish safeguards and evaluation obligations. They should not be presented as a promise that a certified agent will never hallucinate or perform an unsafe action. Buyers need to understand what the evaluation covered and how the organization handles identified failures.

Which Agents And Organizations Are In Scope?

AIUC’s scoping guidance distinguishes developers, which build agent capabilities and default configurations, from deployers, which configure agents for particular environments. An organization can perform both roles.

The guidance identifies customer-facing agents, agents handling sensitive information, and agents connected to tools such as customer relationship management or payment systems as relevant candidates. Their capabilities, architecture, and deployment context determine the risk profile.

An organization can start with one agent or include several. An auditor-approved Statement of Applicability identifies the requirements and controls being assessed. Exclusions must be documented, and the certification and report disclose the scope.

For a vendor, this means deciding which product or deployment its customers need assurance about before beginning the engagement. For a buyer, it means confirming that the service being purchased falls within the documented boundary. Certification of one agent should not be read as assurance over every AI feature the vendor offers.

What Happens After The Initial Certification?

AIUC-1 certification is valid for one year. Maintaining it requires quarterly agent red-teaming, followed by an annual reassessment in which an accredited auditor validates continued satisfaction of the applicable requirements.

The standard itself changes quarterly. AIUC’s renewal guidance says reassessments generally use the latest version, with guidance on changed requirements provided before fieldwork. Renewal includes confirming the agents in scope and updating the Statement of Applicability. AIUC recommends considering newly deployed high-risk agents at that stage.

Businesses should account for this recurring work when budgeting. Teams need owners for coordinating evaluations, investigating findings, retaining evidence, and discussing changes with the assessor. The initial report is one milestone in that process.

How Are Assurance Providers Responding?

Coalfire described the partnership in an October 19 commentary as a way to combine foundational security assurance with assessment of AI-specific risks. The firm said AIUC-1 complements SOC 2 and adds technical testing of agent behavior.

Coalfire identified its own AIUC-1 auditor accreditation as provisional. That qualification matters when comparing providers: organizations should verify a firm’s current accreditation and the responsibilities covered by its proposal.

The commentary establishes a participating provider’s position on the offering. It does not demonstrate how much time customers will save or how consistently enterprise buyers will accept the resulting reports.

What Should Businesses Prepare Before An Engagement?

Preparation should connect significant AI risks to accountable owners and evidence of how the organization manages them. AIUC-1’s accountability requirements include documented response plans for privacy and security breaches, harmful outputs, and hallucinations that cause substantial customer financial loss. They also address vendor and model due diligence, AI activity logging, and disclosure mechanisms.

Based on those requirements, businesses considering the offering should be ready to explain:

Which agents are included and what each can access or change.
Who owns the safeguards and approves significant changes.
How the organization detects, investigates, and responds to failures.
Which findings remain unresolved and who is responsible for remediation.
What evidence shows that documented practices operate in the assessed environment.

Buyers can use these questions when reviewing an assurance package. Vendors can use them to identify gaps before fieldwork and avoid making claims broader than the engagement supports.

What Remains Unclear Before The Full Launch?

AICPA’s announcement gives an expected launch window of early 2027, without a fixed date, standard fee, or guaranteed engagement duration.

Prospective customers should obtain a proposal that explains the audit boundaries, technical evaluation responsibilities, deliverables, and recurring charges. It should also explain how findings will be handled before a report or certification is issued.

As the initial engagements conclude, the details worth watching are the scope of issued reports, how customers use them in vendor reviews, and whether shared evidence collection produces measurable efficiencies. Those outcomes will help businesses judge the offering beyond its announced structure.

Follow related developments in Bright Defense’s SOC 2 news roundup.

How Can Bright Defense Help With SOC 2?

Bright Defense helps businesses prepare for SOC 2 examinations through gap assessments, control implementation, evidence collection, and ongoing compliance support. We work with your team to define the examination scope, assign control owners, and address gaps before auditor fieldwork.

For AI businesses, preparation starts with understanding how AI features interact with customer data and business systems. We help teams document access controls, vendor dependencies, monitoring, and incident response practices relevant to their SOC 2 scope.

Our SOC 2 compliance services support continued readiness through regular reviews and remediation. Contact Bright Defense to discuss your systems, customer requirements, and audit timeline.

Sources