An overview
The American Institute of CPAs (AICPA) and the Artificial Intelligence Underwriting Company (AIUC) announced on October 18, 2026 a new joint offering that gives organizations an independent review of business risk tied to AI systems and agents.
At the center of the offering is AIUC-1, a certification standard for the security, safety, and reliability of AI agents. Under the new arrangement, an AIUC-1 certification can be paired with a SOC 2 report and delivered through a single CPA-led engagement.
What is an AIUC-1 certification?
For companies that build or use AI-powered tools, an AIUC-1 certification offers external validation that the tools touching their data are working as intended and provides a clearer view of AI risk.
Unlike a policy review, AIUC-1 doesn’t stop at how AI agents should behave. It tests how they actually behave in practice. Its controls cover six principles and maps them to established compliance frameworks:
- Data and privacy
- Security
- Safety
- Reliability
- Accountability
- Society
What happens during an AICU-1 testing?
Agents are tested across hundreds of combinations of risks and attacks, including:
- Hallucinations
- Data leakage
- Manipulative requests
- Prompt injections
A typical evaluation covers thousands of scenarios. The most serious findings must be fixed before a certificate can be issued. Certification is renewed annually, with technical retesting every quarter.
Is an AIUC-1 certification right for your business?
As new certifications emerge and evolve, they won’t immediately impact every company. If you answer yes to any of the questions below, AIUC-1 may be worth a closer look.
- Do you sell AI products to larger companies or highly regulated/high-risk industries, such as healthcare or financial services?
- Are AI questionnaires slowing down your deals?
- Are you using AI in high-visibility settings, such as customer service, sales, or claim adjudication, where one mistake could damage trust?
- Do your AI tools have access to sensitive data or act on their own as agents?
If your AI use is limited to low-risk internal tools, strong existing controls may be enough for now.
What should businesses do now?
A full launch of the joint SOC2 + AIUC-1 certification is expected in early 2027.
Have questions about whether AICU-1 certification belongs on your roadmap? Aprio’s Risk Advisory and Assurance Services (RAAS) team can help you understand what these changes mean for your business.