Quick Summary
The AICPA and the AI Underwriting Company (AIUC) have announced a joint offering that combines a SOC 2 examination with AIUC-1 certification of AI agents and platforms in one coordinated engagement. Organizations considering it should focus on scope, criteria, control ownership and the quality of retained evidence before the examination begins.
Introduction
AICPA & CIMA has announced a new artificial intelligence assurance offering developed with the AI Underwriting Company (AIUC), reflecting growing demand for independent evaluation of the controls that support artificial intelligence (AI) systems. The announcement followed the AICPA’s September 11, 2026, release of technical questions and answers (TQA) in Q&A Section 9561, “SOC Examinations: Effect of the Service Organization’s Use of Artificial Intelligence on SOC 1 and SOC 2 Examinations.”
The TQA addresses an increasingly common question as organizations deploy AI: How does AI affect the scope, system description, controls, and examination procedures of an existing SOC program? AIUC complements this guidance by providing a control-oriented framework for evaluating how organizations govern and operate AI systems. For organizations that adopt or provide AI-enabled products, the practical issue now extends beyond whether an AI policy exists. Customers, boards, and other stakeholders increasingly expect evidence that stated requirements are supported by defined responsibilities, policies, procedures, and implemented controls.
What Is AIUC?
AIUC, the AI Underwriting Company, developed AIUC-1 as a common control framework for evaluating specified AI agents or platforms and their security, safety and reliability risks through a combination of technical and governance requirements. In the joint offering, licensed CPA firms perform the SOC 2 and AIUC-1 engagement and issue the report, while AIUC or an accredited technical evaluation body performs the required quarterly technical testing. The offering is particularly relevant to organizations developing or deploying AI agents or agent platforms in higher-risk or enterprise environments and may be less applicable where AI use is limited to lower-risk, internally facing applications.
Why AI Assurance Is Moving Toward Evidence-Based Evaluation
AI risk can span governance, data management, model development, deployment, monitoring, security and third-party dependencies. A sound assurance process therefore requires clear criteria, an understood system boundary and evidence that relevant controls are designed and operating as described. AIUC-1 also includes technical evaluations of the AI agents within scope. According to AIUC, in-scope systems are tested against 1,000 to 5,000 or more real-world scenarios based on applicable risks, with technical evaluations performed quarterly as part of the certification process.
For organizations already familiar with SOC 2, the joint offering provides a way to pursue a full SOC 2 attestation and AIUC-1 certification through a coordinated engagement. Both frameworks are scoped upfront and pursued during the same audit window with the organization’s SOC 2 auditor. SOC 2 addresses the organizational systems within its examination scope and the selected trust services criteria, while AIUC-1 addresses specified AI agents or platforms and their security, safety and reliability risks. The final deliverable is a unified report that combines the SOC 2 attestation report with the AIUC-1 certification report, including applicable technical evaluation results. Organizations should not assume that an existing SOC 2 report automatically addresses AI-specific risks.
The Control Environment Still Matters
Organizations preparing for AI assurance should begin with the control environment around the AI system. Relevant practices may include assigned accountability, documented risk assessment, approved use cases, data provenance, access management, change control, testing, incident response, vendor oversight and ongoing performance monitoring. The specific controls should reflect the organization’s use of AI and the risks created by that use.
Existing control environments may provide a foundation for the joint engagement. Identity and access management, secure development, change management, incident response and third-party risk processes may already support the underlying SOC 2 environment, and a crosswalk between SOC 2 and AIUC-1 can reduce duplicative evidence requests. AIUC-1 then adds agent-specific security, safety and reliability requirements and technical evaluations that are not necessarily addressed by a traditional SOC 2 scope. Management still needs to identify the agents or platforms in scope, relevant commitments, applicable requirements and supporting controls rather than assuming existing coverage is sufficient.
A Practical Readiness Approach
A readiness effort should first establish the scope of the AI agents or platforms and the parties responsible for them. For organizations considering the joint SOC 2 and AIUC-1 offering, that means understanding which existing SOC 2 controls apply, which AIUC-1 requirements require additional controls or evidence and which systems will be subject to technical evaluation. This process often exposes gaps such as informal approvals, AI use cases that have not been formally documented and approved, inconsistent model inventories, unclear ownership of third-party AI components or monitoring that is performed but not retained. Documenting and approving each use case helps ensure that AI output is used only for its intended purpose and not relied on in ways it was not designed to support.
Conclusion
The AICPA and AIUC announcement is another indication that AI governance is moving toward structured, evidence-based assurance. Organizations considering such an engagement should focus on scope, criteria, control ownership and the quality of retained evidence before the examination begins.
A disciplined readiness process can help management distinguish established controls from practices that are still informal. That distinction is important for producing assurance information that stakeholders can understand and use.
How Can Schneider Downs Help?
The Schneider Downs IT Risk Advisory Services team can help organizations evaluate AI governance and control readiness in the context of their broader risk and compliance environment. This may include defining scope, documenting systems and data flows, mapping risks to controls, assessing evidence and identifying areas that require remediation before an independent assurance engagement.
Our professionals can also help organizations consider how AI-related controls intersect with an existing SOC 2 control environment, including readiness for a coordinated SOC 2 and AIUC-1 engagement based on the agents or platforms in scope, intended users and service commitments. That readiness work can identify where established trust services criteria controls may be leveraged and where AIUC-1 security, safety, reliability or technical evaluation requirements require additional components.
Sources
- AICPA & CIMA, “Auditors Meet Urgent Demand for AI Assurance with New Offering from AICPA and AIUC”
- AICPA & CIMA, formal guidance addressing the effect of a service organization’s use of artificial intelligence on a SOC 2 examination.
- AI Underwriting Company (AIUC), “Earn SOC 2 & AIUC-1 Together”
About Schneider Downs IT Risk Advisory Services
The Schneider Downs IT Risk Advisory Services team helps organizations navigate evolving compliance, security, and third-party risk demands. Our professionals work with clients to design, assess, and report on controls through SOC 1, SOC 2, SOX ITGC, ISO 27001, NIST 800-171, CMMC, HITRUST, PCI, and HIPAA engagements, as well as third-party risk management programs. Through attestation, advisory, and readiness services, we help organizations build resilient, risk-based control environments aligned with their operating requirements and client expectations. To learn more, visit our IT Risk Advisory Services page.
