AICPA and AIUC start a joint certification for AI agents

On Monday, AICPA, the American Institute of CPAs, and AIUC, the Artificial Intelligence Underwriting Company, announced a joint certification for AI agents. It adds a SOC 2 report, an external check of company controls, to AIUC-1 certification, which tests how agents work. Pilots are in progress, and the launch is for the first quarter of 2027.

How it works

AIUC-1 tests an agent against many scenarios for its work. A finance agent can get incorrect invoices or payment instructions. The tests look for prompt injection (incorrect instructions in emails or documents), data leaks, and work that the agent must not do. The company fixes each weak point and the agent gets a new test. The report shows the results of the 2 tests.

The numbers

The groups gave no test results. They set 2 requirements. One is a retest each quarter. The other is a renewal of the SOC 2 report and the AIUC-1 certification each year.

What is not known

Amy Pawlicki of AICPA tells us that the certification does not remove all risk. The pilots are not complete. The groups gave no price and no names of pilot companies.

Insight: Proof of control is becoming a product

2 US bills can make AI developers or agent operators liable for injury. On 17 October, 3 US agencies told companies to write stop rules and use monitors that are not AI. This reads as a move to set the proof that buyers and courts accept, before the law sets it. Buyers get control if they tell vendors to show it. Look for a bill that names a certification.