AIUC-1 vs SOC 2: what each tests and where they overlap

The question got practical on October 19, 2026. The American Institute of CPAs (AICPA) and AIUC announced one CPA-led engagement that produces both a SOC 2 report and an AIUC-1 certification.⁴ So the useful comparison is about evidence: what you build once, what you build twice, and what only one of them asks for. If your product calls a model provider, SOC 2 for AI companies covers what changes on the SOC 2 side.

Side by side

Start with the basics: the two differ on who issues them, what they examine, how they are tested and how long they last. Each difference changes what you hand over, and to whom.

Read the testing and renewal rows together. A SOC 2 looks back at a period that has already closed. AIUC-1 keeps testing the agent itself, at least every 3 months, for as long as the certificate is live. That ongoing testing is the deepest difference between them, and it makes AIUC-1 a running commitment rather than a project you finish once a year.

Where the evidence overlaps

AIUC publishes a crosswalk from each AIUC-1 requirement to the SOC 2 points it relates to.³ Grouped by AIUC-1 domain and TSC family, it looks like this. Each cell counts the requirements in that domain mapped to at least one point in that family. A requirement mapped to two families counts in both, so a row can add up to more than the domain holds.

Read it row by row. Accountability reaches almost every family, because governance, monitoring, incidents and vendor review are where the common criteria live. Security clusters in CC6 and CC5, the access and control activity families. Data and privacy lands mostly in Privacy and Confidentiality. Safety and Reliability lean on Processing integrity, since an agent’s answer is, in SOC 2 terms, a processing output.

Now look at the right edge. Security is the only category every SOC 2 must include.⁸ Yet Processing integrity collects 14 requirements, Privacy 9 and Confidentiality 5. If your report covers Security alone, the evidence behind those mappings was never examined. It may not exist yet.

What a mapping does not mean

AIUC is explicit that AIUC-1 covers AI-specific controls SOC 2 does not.³ A mapping tells you where related evidence already lives. It does not tell you the requirement is met. Two examples show the gap.

B007, Enforce user access privileges to AI systems

Maps to CC5.2, CC6.1, CC6.2 and CC6.3: technology controls, logical access, adding and removing users, and role-based access. Your access reviews and offboarding records are the shared evidence. The AIUC-1 question is narrower. When the agent acts for a user, can it reach anything that user could not? A review of staff accounts does not answer that.

E001, AI failure plan for security breaches

Maps to CC4.2, CC7.3, CC7.4, CC7.5, P6.3, P6.5 and P6.6: reporting deficiencies, handling and recovering from incidents, and breach records and notice. Your incident response plan is the shared evidence. What AIUC-1 adds is the failure mode: the agent itself as the breach, through a leak or a misused credential. A plan that never names the agent does not cover it.

That is the pattern across the crosswalk. Reuse the evidence, then extend it to the agent. Budget for the extension as well as the reuse.

Requirements with no SOC 2 mapping

Five active requirements have no SOC 2 mapping at all.¹² For a SOC 2 holder these are the clean starts, where the crosswalk offers nothing to carry over. There is no evidence to reuse, so plan them as new work from the first week.

A005, Prevent cross-customer data exposure

One customer's data never reaches another customer's session, context or output. For an agent shared across customers, this is the isolation promise itself.

A008, Prevent leakage of credentials and secrets

The agent never reveals a key, token or password it can reach, whether in a reply, in a log or in code it writes.

A009, Third-party testing for data and privacy risk

An outside party tests the agent for data and privacy failures, every quarter.

E018, Third-party testing for accountability risk

The same outside testing, aimed at accountability risk, also every quarter.

F002, Prevent catastrophic misuse

The agent refuses requests that could lead to harm at a large scale.

Two of the five, A009 and E018, are third-party testing requirements. AIUC-1 has five of those, one in each of the first five domains, and every one is reviewed each quarter.¹² The Trust Services Criteria set no quarterly clock for outside testing of your product,⁸ so this work needs its own owner and its own calendar.

SOC 2 points AIUC-1 never touches

The overlap runs the other way too. Seven SOC 2 points have no AIUC-1 requirement mapped to them.³ In plain terms:

A1.1

Capacity: you measure the load on the system and plan for more before you need it.

A1.2

The backups, recovery infrastructure and environmental protections behind your uptime promises.

A1.3

Testing the recovery plan, so a restore is proven rather than assumed.

CC1.2

A board, or whoever plays that role, that is independent of management and oversees internal control.

CC1.4

Hiring, developing and keeping competent people, as a stated commitment.

CC3.3

Weighing the chance of fraud when you assess risk.

CC3.4

Spotting changes, inside the company or outside it, that could weaken your controls.

Three of the seven make up the whole Availability category, which is the empty column in the heatmap. The rest sit in governance and risk.⁸ So an AIUC-1 certificate says nothing about uptime, recovery or your board. Those are SOC 2 questions. Only a SOC 2 with Availability in scope answers the uptime and recovery ones.

Which to get first

Do you need AIUC-1 if you already have SOC 2? Only if somebody asks how your agent behaves. Let the request in front of you decide. A security questionnaire, a contract clause or a procurement form names what it wants, and the words settle it.

The deal names SOC 2

Start there. A Type 2 needs an observation period before the report can exist, so start the clock early: how long the observation period has to be.

A buyer asks how your agent behaves

That is the question AIUC-1 answers, one agent at a time. AIUC’s auditor guide plans about 10 weeks from kickoff to certificate, with kickoff about 8 weeks after signature.¹³

You already hold a SOC 2

Start from the crosswalk. Pull the evidence behind the 45 mapped requirements, extend it to the agent, and build the five unmapped ones from scratch. What drives the AIUC-1 price covers the rest of the bill.

You need both this year

One engagement can now produce both outputs: the joint SOC 2 and AIUC-1 engagement. First ask your SOC 2 firm whether it is on AIUC’s list of accredited auditors.

Whichever comes first, keep one evidence set. Built once and labeled for both, the same records serve two audits, and the 45 mappings tell you which records those are. The ISO 42001 comparison runs the same exercise against the AI management system standard.