FAQ: What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from the AICPA's SOC 2 examination framework. If customers ask for both, clarify the system and assurance question each is intended to cover. Some underlying records may be useful in both efforts, but the assessments and deliverables are not interchangeable. Before making a commitment, verify the current standard version, evaluation process, and customer acceptance rather than assuming an AIUC-1 certificate replaces a requested SOC 2 report.

Related: SOC 2 audit and compliance hub.

Further reading: Official AIUC-1 standard; AICPA SOC 2 reporting guide overview.

Additional FAQs

Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.

Can I fail a SOC 2 audit?

Yes, failure to meet the relevant Trust Service Criteria may result in a failed SOC 2 audit, requiring remediation. This is known as a Qualified Opinion when this happens.

What makes a record useful as SOC 2 audit evidence?

A useful record shows what happened, when it happened, which system or activity it covers, and who performed or reviewed the work. Keep enough context to connect it to the

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Depending on the size of your Company, you could look to another small business owner in a similar situation or trusted advisor to sit on each others board’s and create

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.)

What is a SOC 2?

The System and Organization Controls 2 Report, formally known as a Service Organization Controls Report as of the most recent update to the SSAE 18 audit standard. A SOC 2 report

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide