AI agents are about to get audited. Here's what that means for Australian businesses
On 19 October, the American Institute of CPAs (AICPA) announced a new joint certification for AI systems and agents with the Artificial Intelligence Underwriting Company (AIUC). It's being described as the first comprehensive, independent certification for AI agents. Several accounting firms are already running pilots, and a full launch is planned for early 2027.
What's being certified
The certification combines two things in one engagement, led by a CPA (a certified public accountant, the US equivalent of a chartered accountant):
- A SOC 2 report, the established audit of whether an organisation's security controls are well designed and actually work.
- AIUC-1 certification, which tests how AI agents behave in practice. That includes resisting prompt injection, not leaking data, not acting beyond their authority, and coping with manipulated inputs such as fake invoices.
The difference is live testing. As AIUC's co-founder put it, the standard tests "AI agent behavior, not just a review of policies and guardrails." Certification isn't one-off: it needs testing every quarter and renewal every year.
Why it matters here
It's an American scheme, but Australian businesses will feel it in three ways.
- Your customers and suppliers will start asking. SOC 2 reports are already a standard request when Australian companies assess software vendors. Expect "is your AI agent certified?" to join the questions, especially in finance, insurance and other regulated industries.
- The Privacy Act is changing in December. From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when computer programs, including AI, make or substantially help make decisions that significantly affect people. If you can't explain how your AI uses personal information, that becomes a compliance problem.
- Australia is relying on existing laws, not a new AI Act. The government's National AI Plan rules out a standalone AI law. Businesses are pointed instead to the National AI Centre's Guidance for AI Adoption and its six governance practices, plus existing privacy, consumer and industry rules. Independent certifications like this one are likely to become the way businesses show they're doing it properly.
Where your hardware fits
A certification checks how an AI agent behaves and how well the systems around it are controlled. Knowing exactly where your data goes makes both easier. Running models on hardware you own keeps prompts, documents and outputs inside your own network, and lets you log and test the agent on your own terms.
That doesn't make you compliant on its own; you still need policies, testing and oversight. But it removes a big unknown. Practical starting points:
- NVIDIA DGX Spark: a desk-sized system that runs models of up to around 200 billion parameters entirely in-house. Good for building and testing agents before they go near production.
- NVIDIA RTX PRO 4000 Blackwell or RTX PRO 6000 Max-Q: workstation GPUs for running and fine-tuning models on machines you already control.
- Synology RackStation RS1626xs+: on-premises storage for training data, logs and audit records.
Not sure where to start? Our checklist, What you need to run your own AI in-house, covers the basics. Or book a free consultation and we'll talk through your setup.
General information only, not legal or compliance advice. Speak to a qualified adviser about your obligations.
Source: "AICPA, assurance firm team up to certify AI agents", CFO Dive, republished by Yahoo Finance, 19 October 2026.
General guidance only. Figures are approximate and depend on your model, software and settings. Book a consultation before you buy.