> ## Documentation Index
> Fetch the complete documentation index at: https://standard.aiuc-1.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Earn SOC 2 & AIUC-1 together

[AICPA](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) and AIUC-1 have partnered to let organizations earn SOC 2 and AIUC-1 together:

* One engagement with your existing SOC 2 auditor
* One comprehensive audit report
* Quarterly testing of agents against real-world risks

The engagement is offered by all Big 4 firms and several other CPA firms including Schellman, Grant Thornton, EisnerAmper and BDO.

**Organizations earn a full SOC 2 attestation and AIUC-1 certification**\
Unlike other "SOC plus" engagements (e.g. SOC 2 + HITRUST), where organizations are required to pursue full certification as a separate engagement, the SOC 2 + AIUC-1 engagement is designed so that organizations earn a full SOC 2 attestation and AIUC-1 certification.

## Joint audit process

Both frameworks are scoped upfront and pursued in the same audit window, in one engagement with your organization’s existing SOC 2 auditor.

This helps organizations to cover agents & cybersecurity in one engagement.

**Typical SOC 2 + AIUC-1 process**

![Timeline of the joint SOC 2 and AIUC-1 audit process](https://mintcdn.com/aiuc-28e27073/7jVrfOJQme2j0R-0/images/CleanShot-2026-10-16-at-17.26.08@2x.png?fit=max\&auto=format\&n=7jVrfOJQme2j0R-0\&q=85\&s=3862507633636a5fce564588c71c57d8)

### Scoping

Each framework is scoped to its relevant domain. SOC 2 covers the organizational systems within its audit scope. AIUC-1 covers the specified agents or platforms and their security, safety and reliability risks.

![AIUC-1 agents within the organization-wide SOC 2 audit scope](https://mintcdn.com/aiuc-28e27073/7jVrfOJQme2j0R-0/images/CleanShot-2026-10-16-at-17.31.33@2x.png?fit=max\&auto=format\&n=7jVrfOJQme2j0R-0\&q=85\&s=085482a1419860554d83f667ccd45342)

> ****Read more:** SOC 2 coverage**
>
> * Scope defined in the Management Assertion
> * Covers security and data controls across the whole organization: access, encryption, change management, incident response
> * Mix of technical and governance controls

> ****Read more:** AIUC-1 coverage**
>
> * Scope defined in the Management Assertion - limited to AI agent systems
> * Covers agent-specific security, safety and reliability risks
> * Mix of technical & governance controls
> * Includes quarterly technical evaluations of agents themselves
>
> Read more about AIUC-1 scoping [here](https://standard.aiuc-1.com/scoping.md). To earn AIUC-1 certification, the AI systems in scope are tested against 1,000-5,000+ real-world scenarios covering different attack types for applicable risks. \
> \
> More on the testing methodology [here](https://standard.aiuc-1.com/auditors/deliver-and-certify/scoping/agent-and-evaluation-scope.md).

> ****Read more:** Certifying individual agents vs. agent platforms**
>
> AIUC-1 Certification is used by organizations in two ways:
>
> ![Clean Shot 2026 10 16 At 17 36 14@2x](https://mintcdn.com/aiuc-28e27073/7jVrfOJQme2j0R-0/images/CleanShot-2026-10-16-at-17.36.14@2x.png?fit=max\&auto=format\&n=7jVrfOJQme2j0R-0\&q=85\&s=8e957aa8fe91ca6d44fa0fc2a0a63e6c)

### Evidence Collection

The joint engagement simplifies evidence collection for organizations:

* Auditors typically share one combined request list
* Overlapping requests are only submitted once
* Organizations can use their desired GRC platform for the joint engagement - e.g. Vanta, Drata, Fieldguide

**Full crosswalk between SOC 2 & AIUC-1 [here](https://standard.aiuc-1.com/crosswalks/soc-2.md)**

### Final deliverable

After completing the full audit, organizations will receive one unified audit report combining:

* Full SOC 2 attestation report of selected SOC 2 TSCs
* Full AIUC-1 certification report of applicable AIUC-1 requirements including technical evaluation results of agent behaviour.

## FAQs

> **Which auditors offer SOC 2 & AIUC-1 together**
>
> SOC 2 + AIUC-1 is available with BDO, Deloitte, EisnerAmper, EY, Grant Thornton, KPMG, PwC and Schellman. Additional firms hold provisional AIUC-1 accreditation - contact us [here](https://www.aiuc-1.com/contact) if you are interested in pursuing agent certification with another auditor.

> **When is SOC 2 & AIUC-1 relevant for organizations?**
>
> SOC 2 + AIUC-1 is relevant for organizations:
>
> * Developing agents & agent platforms sold to enterprises
> * Deploying agents in high-risk environments - whether developed in-house or by vendors
> * Subject to regulatory requirements for agents such as SOX, the EU AI Act, CA SB 243, NYC Local Law 144
> * Using coding agents for production code (coding-agents are a typical AIUC-1 use case)
> * Facing AI security reviews or questionnaires from enterprise buyers

> **When is SOC 2 & AIUC-1 not relevant for organizations?**
>
> SOC 2 + AIUC-1 is less relevant for organizations:
>
> * Primarily using AI chatbots like Copilot, Claude or ChatGPT
> * Using agents for low-risk use cases that are internally facing
> * Restricting agents from accessing sensitive data and activate tools
> * Not subject to new AI regulation
> * Developing agents primarily sold to small companies with limited security requirements

> **What does this add to SOC 2 on its own?**
>
> The joint offering adds AI agent security to your SOC 2 audit through one combined engagement. AIUC-1 covers agent-specific security, safety and reliability risks and requires technical evaluations to validate agent deployments.

> **Who are all parties involved and the responsibilities of each?**
>
> * Licensed CPA firms perform the SOC 2 & AIUC-1 engagement and issue the report.
> * AIUC or accredited technical evaluation body runs the quarterly technical testing.

37.782274° N -122.392147° W
FIG. A (SITE INDEX)

Artificial Intelligence Underwriting Company

SFO

NYC

LON

Code
Structural unit
a.
AIUC-1 requirements for agent data, privacy, security, safety, reliability, accountability, and societal risk.
b.
Evidence templates for technical implementation, legal policy, operational practice, and third-party evaluation.
c.
Crosswalks to AI regulations, standards, and security frameworks.
d.
Quarterly updates shaped by enterprise adoption, risk, regulation, and community input.

I. Standard

<ul>
  <li>[Overview](/index.md)</li>
  <li>[Crosswalks](/crosswalks)</li>
  <li>[Evidence](/evidence)</li>
  <li>[Changelog](/changelog.md)</li>
</ul>

II. Learn

<ul>
  <li>[About AIUC-1](/learn/about.md)</li>
  <li>[Contribute](/learn/contribute.md)</li>
  <li>[Scoping](/scoping.md)</li>
  <li>[FAQ](/faq.md)</li>
</ul>

III. Office

<ul>
  <li>[Consortium](/consortium)</li>
  <li>[Contact](https://www.aiuc-1.com/contact)</li>
  <li>[Privacy policy](/legal/privacy.md)</li>
  <li>[Terms of use](/legal/terms.md)</li>
</ul>

100
© AIUC — ALL RIGHTS RESERVED


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.