When AI was merely a tool for suggesting text or summarizing a document, a mistake usually amounted to an incorrect answer that an employee could review.

But what happens when AI can access company systems, call software, handle data, and carry out real tasks?

The question then changes from:

Is the model good?

to:

Can we trust it in the workplace?

That is why the AICPA and the Artificial Intelligence Underwriting Company announced a collaboration to develop an assurance process combining a SOC 2 report with an AIUC-1 certification, with the aim of providing independent reviews of risks associated with AI systems and agents. A broader launch is planned after the initial participants complete the process in early 2027.

What does assurance actually mean?

In the business world, there is a difference between a company saying:

“Our system is secure”

and an independent party examining the evidence and providing a level of assurance about the controls in place.

That is the basic idea behind assurance services.

A SOC 2 report, for example, is examined by a licensed CPA under AICPA standards, and focuses on controls related to areas such as security, system availability, processing integrity, confidentiality, and privacy.

But AI has introduced a new problem:

A company’s technical infrastructure may be well protected, but what about the agent’s own behavior?

Policies don’t always tell us what an agent will do

A company can write an excellent policy stating that an agent must not disclose customer data.

But the real test is:

What happens if a user tries to trick it into revealing that data?

What if it receives malicious instructions in a file it has read?

Can someone persuade it to exceed the permissions it was granted?

This is where AIUC-1 differs: it does not rely solely on reviewing policies and controls, but also includes practical technical testing of agent behavior across scenarios involving data leakage, hallucinations, manipulative requests, and prompt injection attacks. AIUC says typical tests may cover thousands of scenarios.

This is like the difference between reviewing a factory’s safety instructions and actually operating the machinery to test whether its safeguards work when something goes wrong.

Why has this become more important with agents?

Traditional software generally follows predefined rules.

An AI agent, by contrast, can respond to new instructions, use different tools, and take a series of steps to achieve a goal.

That flexibility is what makes it useful.

But it also makes its behavior harder to predict.

If an agent has login credentials and can connect to other systems or execute commands, a mistake is no longer just a wrong answer; it could become a real operational or security incident.

That is why the AICPA describes the issue as ensuring the safety of the agent as well as the systems it interacts with.

Does certification mean AI won’t make mistakes?

No.

That’s an important point.

Reviews and tests cannot guarantee that a system will never fail.

Their purpose is to give external parties more reliable evidence that a company has appropriate controls in place and that certain risks have been tested in a structured, independent way.

Because AI models and attacks change rapidly, a single review cannot last forever.

The joint program therefore requires SOC 2 and AIUC-1 to be renewed annually, in addition to repeating AIUC-1 technical tests every three months.

From auditing numbers to auditing algorithms

Perhaps the most important aspect of this step is what it says about the future of the auditing profession itself.

Auditors have traditionally built trust around financial statements, systems, and internal controls.

But if more decisions and tasks within companies are carried out by AI systems, building trust may also require verifying how these systems behave.

And that is where the idea of auditing expands:

Not only: Is the number correct?

But also:

Is the system that produced the decision properly controlled?
Is the data protected?
Does the agent stay within its permissions?
And what does it do when someone tries to trick it?

The more we give AI the ability to act rather than merely assist, the more important it becomes to have an independent party ask the question the auditing profession has asked for years:

Can we rely on this system?