AI Agents Are Getting Audited: What the New AICPA Assurance Means for Any Business Using AI on Customer Data

On October 19, the American Institute of Certified Public Accountants (AICPA) and the Artificial Intelligence Underwriting Company (AIUC) announced a joint assurance offering for artificial intelligence (AI) systems and agents. For the first time, there is a formal, independent way to check not only how a company protects data, but how its AI behaves once it is put to work.

It applies to any business that deploys AI on customer data, but it matters most where that data is sensitive and the AI can take actions: finance and accounting, healthcare, insurance and legal work, and the software vendors that sell AI tools into those fields. There, AI now categorizes transactions, summarizes patient and claims notes, and drafts client emails, and the people on the other side are starting to ask a reasonable question: how do you know the AI handling my information does what the vendor says it does? Until now, there hasn't been a standard answer.

‍

What the AICPA and AIUC announced

The offering combines two existing pieces into one engagement. A company goes through a System and Organization Controls (SOC) 2 examination and an AIUC-1 certification, and a single certified public accountant (CPA) firm leads both and issues one combined report. The Journal of Accountancy describes it as the first comprehensive, independent review of business risk tied to AI systems and agents.

It isn't fully launched yet. Several CPA firms, including PwC, are piloting it with clients now, and the AICPA and AIUC expect a full launch in early 2027. Both parts renew every year, and the AI portion is retested every quarter.

The demand for this kind of report already exists. According to the AICPA, more than 40,000 organizations obtained a SOC 2 attestation or AIUC-1 certification last year. Many businesses already ask software vendors for a SOC 2 report before they sign a contract. This extends the same habit to AI.

‍

SOC 2 checks data security; AIUC-1 checks how the AI behaves

SOC 2 is the familiar half. It is the AICPA's report on a company's controls over security, availability, processing integrity, confidentiality and privacy, and a licensed CPA examines whether those controls are designed well and work as intended. In short, it tells you a vendor takes care of your data.

AIUC-1 is the newer half, and it answers a different question: does the AI behave? The standard was developed with more than 250 chief information security officers and security leaders. It covers six areas (data and privacy, security, safety, reliability, accountability and society) and maps to frameworks many larger organizations already follow, including ISO/IEC 42001, the AI management standard from the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), and the European Union (EU) AI Act.

The real difference is how it is tested. Rather than only reviewing written policies, AIUC-1 runs live tests against the AI agent itself, across hundreds of risk and attack scenarios.

‍

The four AI risks the testing checks for

The risks it probes sound technical, but they are easy to picture in everyday work.

The first is hallucination: the AI states something that isn't true or isn't in the data. An accounting assistant might cite a tax rule that doesn't exist, or a support chatbot might promise a refund policy the company never had. The second is data leakage, where information from one customer turns up in an answer for another, or leaves the system altogether. For any business that keeps many clients' records in the same tools, from a bookkeeping practice to a marketing agency managing dozens of ad accounts, this is the one to raise with vendors first.

The other two involve someone deliberately trying to misuse the AI. A manipulative request is an attempt to talk the agent into acting outside its permissions, like getting a support bot to issue a refund or an operations agent to approve a payment. Prompt injection is subtler: instructions hidden inside something the AI reads, such as an invoice file that quietly tells an accounts payable agent to change a vendor's bank details, or a web page that tells a research assistant to send data elsewhere.

None of these risks are new, but they matter more as AI tools move from answering questions to taking actions. An assistant that drafts a refund email is one thing. An agent that issues the refund is another.

‍

AI builders will get certified; most businesses will ask for the report

The companies most likely to pursue the certification are the ones building AI agents: software vendors in accounting, customer relationship management (CRM), customer support, marketing, healthcare and almost every other category. Their customers will ask for proof, and a recognized report is easier to share than a long security questionnaire.

Most other businesses won't get certified themselves. They will meet it from the other side, as buyers, requesting the report from their vendors, reading it and keeping it on file, much as many already do with SOC 2 reports. It matters most in industries that already review their vendors closely. An accounting or bookkeeping firm will want it for the tools that categorize transactions and touch client books. A healthcare or insurance team will want it for tools that summarize patient or claims information, and a law firm for AI that reviews client documents. Outside regulated fields it still has a use: a marketing agency running AI on clients' ad accounts and CRM records, or a sales or support team using the AI built into its CRM or help desk, can use the report to vet those vendors. Businesses that use AI only for low-stakes internal work, like drafting marketing copy with no customer data involved, have much less reason to ask for it.

CPA firms with attestation practices have a third angle. They may be able to offer the combined engagement to their own clients once it moves from pilot to launch.

‍

Outside the United States: Canada, Europe and global standards

The AICPA offering is led from the United States (US), and the announcements so far say nothing about Canada or other countries. The full launch is described only as early 2027. The pieces it is built on already cross borders, though, and other governments are handling AI oversight in their own ways.

In Canada, SOC 2 reports are already common. Canadian firms issue them under the Canadian Standard on Assurance Engagements (CSAE) 3000, using a version of the AICPA guide adapted by the Chartered Professional Accountants of Canada (CPA Canada). There is no federal AI law yet. The proposed Artificial Intelligence and Data Act (AIDA) died in 2025, and the government is still consulting on what replaces it. In the meantime, privacy law sets the rules. The Personal Information Protection and Electronic Documents Act (PIPEDA) requires consent, safeguards and vendor contracts that limit how data is used, and Quebec requires businesses to tell people when a decision about them is made solely by automated processing.

In the EU, the AI Act sets binding rules, and a 2026 amendment pushed obligations for high-risk AI systems to December 2, 2027. Rules on labelling AI-generated content take effect sooner. Because AIUC-1 maps to the EU AI Act, a vendor with the new certification will have done much of the groundwork for European customers too.

In the United Kingdom (UK), the government published a roadmap in 2025 for building a market of trusted third-party AI assurance, and the Institute of Chartered Accountants in England and Wales (ICAEW) has covered it for its members.

The closest thing to a worldwide benchmark is ISO/IEC 42001, which certifies how an organization governs its AI. Providers including Amazon Web Services (AWS), Microsoft and Anthropic have announced certification. For businesses outside the US, that means the checks below still apply. Where a vendor has no SOC 2 or AIUC-1 report, an ISO/IEC 42001 certificate and clear local privacy commitments are the next best evidence.

‍

7 things to check before an AI tool touches customer data

There is no need to wait for 2027. Whether or not a vendor plans to certify, check for these seven things in its security documents, contract and settings:

A current SOC 2 Type II report whose scope includes the AI features you plan to use, not only the core product.
Independent testing of how the AI behaves, through AIUC-1 or something similar, covering wrong answers and data leaks.
A clear statement on whether your data is used to train or improve the vendor's models, and a way to opt out.
Which actions the AI can take on its own, such as editing records, issuing refunds or sending messages, and which need a person to approve them.
How one customer's or client's data is kept separate from another's inside the AI features.
An activity log of what the AI read and did, which you can export.
A committed timeline for notifying customers if the AI exposes data it shouldn't.

Save what you find with your vendor files. If a customer, client or regulator ever asks how you evaluated an AI tool, you'll have a record.

‍

How to prepare for 2027

A practical first step is knowing what you already have. Many businesses use AI without ever deciding to, through features built into software they already pay for, from accounting and CRM systems to help desks and ad platforms. Make a list of every tool that touches customer or client data, then sort it by what each one can do: read information, suggest changes, or act on records. The tools that act deserve the closest look, and they are the first to check against the list above.

From there, consider explaining in customer contracts, privacy notices or client communications which AI tools touch their data and how you review them. When the offering fully launches next year, revisit the list and ask your vendors whether they plan to certify.

How far to take this depends on the business. A small company using one AI feature inside its accounting or CRM software may only need the inventory and a quick check of one or two vendors. A company rolling out AI agents across customer-facing work should treat it as an ongoing review.

‍

Common questions

Is this a new requirement? No. It is a voluntary assurance offering, and no regulator requires it.

Does it only apply to accounting firms? No. The AICPA designed the offering for any company that builds or deploys AI agents. CPA firms perform the audit, but the businesses being audited, and the buyers relying on the report, can be in any industry. It matters most in data-sensitive, regulated fields such as finance, healthcare, insurance and legal, and for software vendors selling into them.

Doesn't a SOC 2 report already cover AI? A SOC 2 report can include AI features in its scope, but it reviews the controls around a system. It doesn't test how an AI agent behaves under attack, which is the gap AIUC-1 is designed to fill.

Should a small business get certified? Probably not, unless it builds AI tools for others. The offering is aimed at organizations that build or deploy AI agents, and pricing hasn't been published. Most small businesses will get more value from asking their vendors for the report.

‍

Sources

‍

Byte