FAQ: What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from the AICPA's SOC 2 examination framework. If customers ask for both, clarify the system and assurance question each is intended to cover. Some underlying records may be useful in both efforts, but the assessments and deliverables are not interchangeable. Before making a commitment, verify the current standard version, evaluation process, and customer acceptance rather than assuming an AIUC-1 certificate replaces a requested SOC 2 report.

Related: SOC 2 audit and compliance hub.

Further reading: Official AIUC-1 standard; AICPA SOC 2 reporting guide overview.

Additional FAQs

How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate

Can I fail a SOC 2 audit?

SOC 2 is not a simple pass-or-fail certification. The report may contain an unmodified, qualified, or adverse opinion, or a disclaimer of opinion. A control exception does not automatically mean

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already

Do we need a list of every supplier our vendor uses?

Usually, start with providers that could materially affect your service or data. For each relevant provider, ask: If names or reports cannot be shared, ask for alternative evidence and record

What should we reassess before enabling AI in an existing product?

Check what the AI feature changes from the product you already approved: Confirm the actual settings and relevant terms. Test the intended use with suitable non-sensitive examples, then record the

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide