AIUC-1 (AI agent security, safety and reliability standard) and the AICPA joint offering

What it is

AIUC calls AIUC-1 the standard for AI agent security, safety and reliability. The launch post says the standard covers data & privacy, security, safety, reliability, accountability and society, that certifying companies must implement 50+ technical, operational and legal safeguards, and that AIUC-1 operationalizes principles found across high-level frameworks like NIST’s AI RMF, EU AI Act, and MITRE’s ATLAS.

The standard’s site describes four steps (scoping, evals, audit and certification) and says evals involve thousands of real‑world scenarios testing against jailbreaks, prompt injection, data leakage, hallucinations, and unsafe tool calls, with an audit conducted by an accredited auditor such as Schellman and Coalfire.

Who certifies

AIUC says Only the Artificial Intelligence Underwriting Company can issue the official AIUC-1 certificate. and Only the Artificial Intelligence Underwriting Company can accredit AIUC-1 auditors. Accredited auditors prepare an audit report with a recommendation; AIUC’s auditor guidance says Your recommendation is what AIUC certifies on, and that AIUC reviews it, signs the certification statement, and issues the certificate on the target certification date. For what a joint SOC 2 plus AIUC-1 report contains, see SOC 2 + AIUC-1: what the joint AICPA report adds. AIUC’s certificate overview says the certificate must be renewed annually to remain current, with ongoing technical testing conducted at least quarterly.

AIUC-1 is a private certification program. It is not an ISO, IEC or government standard, and no official page we cite says it is a means of compliance with the EU AI Act.

The AICPA joint offering

On 19 October 2026 the AICPA announced, with AIUC, a joint assurance certification delivered as a single report delivered by one CPA-led engagement that combines a SOC 2 report and an AIUC-1 certification. The AICPA says AIUC-1 controls map to frameworks including MITRE ATLAS, ISO 42001 and the EU AI Act, and that a full launch of the joint certification is expected to take place in early 2027.

Separately, the AICPA published TQA Section 9561 (11 September 2026) on the effect of a service organization’s use of AI on SOC 1 and SOC 2 examinations.

For safety-critical buyers

Editorial judgment: AIUC-1 tests agent behavior and security; it does not replace DO-178C, IEC 61508 or ISO 26262 assurance, and no AIUC page we cite claims it does. Treat an AIUC-1 certificate as evidence about an agent’s security and reliability controls, not about functional safety.