AIUC-1 accredited auditors: who can audit, and how firms qualify

So the auditor is one of three parties in an AIUC-1 engagement, next to your company and AIUC. The seat got more attention on October 19, 2026, when the American Institute of CPAs (AICPA) and AIUC announced one CPA-led engagement that produces a SOC 2 report and an AIUC-1 certification.³ Below: which firms can take that seat, how a firm earns it, what the job includes, and what to ask the SOC 2 firm you already use.

The firms on AIUC’s list

AIUC publishes the list itself, with a date and a status for each firm. Here it is as read on October 19, 2026, placed by the date each firm was listed.

• Schellman: accredited, listed November 1, 2025
• Coalfire: provisional, listed May 1, 2026
• BDO: provisional, listed July 15, 2026
• Grant Thornton: provisional, listed July 15, 2026
• Mastermind: provisional, listed July 20, 2026
• Sensiba: provisional, listed August 1, 2026
• A-LIGN: provisional, listed August 1, 2026

The list grew from one firm to seven in nine months, and every firm added after the first is provisional. It will keep changing. Check AIUC’s accreditation page on the day you choose a firm, not this one.

How a firm gets accredited

Only AIUC accredits AIUC-1 auditors.¹ That is a different credential from the CPA license a firm needs to issue a SOC 2 report.⁴ A firm can hold one without the other, and AIUC’s credential comes through these steps.

Two signals move an applicant up AIUC’s queue: an audit track record, and AI capability such as ISO 42001 accreditation.¹ The second matters if your firm already audits the AI management system standard, and how ISO 42001 and AIUC-1 differ explains why the two sit side by side. AIUC also runs some AIUC-1 audits itself, for example when a new agent capability needs the standard adapted.¹

For you, the steps reduce to two checks. Is the firm on the list? At which status?

What the auditor does, and does not do

The auditor’s work runs through the whole engagement, but it is not the whole engagement. AIUC’s auditor guide lays the phases out like this, counted in weeks from kickoff.⁵

At scoping the auditor signs off on the Statement of Applicability, the document that fixes which requirements apply to your agent.⁶ In fieldwork it reaches a verdict on each requirement, holds a closing meeting and writes the final report on AIUC’s template.⁵

What it does not do today is run the technical evaluations. AIUC runs them, and the auditor validates the methodology and the pass bar.² AIUC says auditor-led evals are in development. For now, the scenarios your agent faces come from AIUC.

The certificate is not the auditor’s to issue either. Only AIUC issues it.⁷ When a firm offers to take you through certification, the audit and the report are its work, and the certificate is AIUC’s.

Can your SOC 2 firm do it?

Maybe. AIUC’s own pages are the place to start. Its SOC 2 crosswalk page says the two can be earned together, in one engagement, with your existing SOC 2 auditor.⁸ Its accreditation page says only AIUC accredits AIUC-1 auditors.¹ Read together, the real question is whether your firm is on the list.

The AICPA’s announcement said several CPA firms already deliver the joint engagement. It names none of them.³ The SOC 2 half still has to come from a licensed CPA firm,⁴ and who can perform a SOC 2 audit covers that rule in full.

If your firm is not on the list, the two can still run side by side. Your SOC 2 firm keeps the SOC 2, and a listed firm audits the AIUC-1 controls. You lose the single engagement, not the certificate. Keep one evidence set for both anyway: the SOC 2 overlap shows where the two share it.

Ask these before you sign. The wording is ours, built from AIUC’s published process.

• Are you on AIUC’s list, and is your listing full or provisional?
• If provisional, would our engagement be your witness audit, and does that change our timeline?
• Who runs the technical evaluations, and who on your team reviews the results with us?
• Will SOC 2 and AIUC-1 share one evidence request, or will we answer two?
• Which work does AIUC bill directly, and which do you?
• Which version of the standard will you lock at kickoff?⁶
• Will the same team run the annual re-audit, or do we choose again?⁹

None of these answers rules a firm out. Each one moves your calendar or your evidence plan, so get them in writing before kickoff. For the money side, what drives the AIUC-1 price covers the factors AIUC publishes.