FAQ: What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from the AICPA's SOC 2 examination framework. If customers ask for both, clarify the system and assurance question each is intended to cover. Some underlying records may be useful in both efforts, but the assessments and deliverables are not interchangeable. Before making a commitment, verify the current standard version, evaluation process, and customer acceptance rather than assuming an AIUC-1 certificate replaces a requested SOC 2 report.

Related: SOC 2 audit and compliance hub.

Further reading: Official AIUC-1 standard; AICPA SOC 2 reporting guide overview.

Additional FAQs

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess

Can we scope SOC 2 to one product rather than the whole company?

Often, yes, provided the scope accurately describes the service and the systems supporting it. Start with the customer-facing product, then trace its data, infrastructure, people, and supporting processes. Shared identity

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, is an AICPA standard that clarified and recodified the attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified

What should we ask a compliance software vendor to demonstrate?

Use your own workflow as the demo script. Ask the vendor to collect an example record, show its source and date, assign an owner, record a review, handle an exception,

What does meaningful human review of AI output look like?

Give the reviewer a clear task, enough information, and authority to reject or correct the result. Define what to check, which cases require escalation, and what record to retain. For

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide