SOC 2 Meets AIUC-1: A New Path to Proving AI Can Be Trusted

AI is advancing quickly, and every company deploying it now faces the same questions around how they can prove their AI can be trusted. 

Customers, boards, and regulators now want evidence that your systems are secure, responsible, and well governed. 

For decades, the American Institute of CPAs (AICPA) has helped set the standards for trust in business and technology with its widely recognized frameworks, including SOC 2. Now the AICPA is joining forces with AIUC to extend independent assurance into AI by combining SOC 2 with AIUC-1.  

Why Independent Assurance Matters Now 

The timing particularly matters because many AI risks now overlap with traditional cybersecurity risks.  

A recent incident involving Hugging Face, a major platform for AI models, illustrated how security failures and AI-specific problems can arrive together. As AI becomes part of nearly every product and process, companies need a credible way to demonstrate that their systems are handled responsibly. 

This is where independent assurance comes in.  

AIUC brings a purpose-built approach to evaluating AI risks, including security, safety, and reliability. The AICPA contributes its long experience in building trusted assurance standards. Together, they aim to bring clarity, consistency, and confidence to how AI systems are evaluated, which is something the market has needed for a while. 

Schellman has spent years helping organizations build trust through third-party assessments and we've seen firsthand how assurance can speed up adoption, reduce friction in sales and partnerships, and open up competitive advantages and growth opportunities.  

We see this SOC 2 + AIUC-1 partnership as a chance to help organizations move beyond promises and show that their AI systems can be trusted. The goal is not simply another framework or another audit, but building the trust infrastructure that allows AI to scale responsibly. 

What This Partnership Between SOC 2 + AIUC-1 Means for Your Business 

For companies already working through SOC 2, there is a practical takeaway. Each SOC 2 renewal is a natural point to ask whether your AI systems are ready for the same scrutiny. Starting that conversation now, before a customer, board member, or regulator asks, puts your organization ahead. 

AI assurance is becoming part of how businesses earn trust. The organizations that prepare early will be better positioned to answer the questions their customers are already asking.

If you're ready to start the conversation about pursuing SOC 2 + AIUC-1 ahead of your next renewal, contact us today to learn more.