Dive Brief:
- A key AI tool used internally across KPMG has been independently tested and certified for security, reliability and governance controls, the firm said in a recent announcement.
- The certification, announced last week, was issued under the AIUC-1 standard for testing AI agents developed by the Artificial Intelligence Underwriting Company — a first for a Big Four accounting firm. It covers a KPMG-developed agent called aIQ Capture, which conducts voice-based interviews with professionals across the firm to gather their expertise and synthesize it into insights that can be used in client delivery and other applications.
- “The certification is evidence of rigor, but it doesn’t actually eliminate or provide immunity from risks,” said Aisha Tahirkheli, a KPMG principal who oversees the responsible and ethical design, development and use of AI across the firm’s U.S. operations. “Maintaining confidence will require continued monitoring, testing and human accountability.”
Dive Insight:
The move comes amid growing concerns over the risks posed by increasingly autonomous systems.
Anthropic disclosed in July that it uncovered incidents in which some of its models escaped from a testing environment and gained unauthorized access to the systems of outside organizations.
That news came on the heels of OpenAI’s disclosure that some AI models it developed were behind an “unprecedented cyber incident” affecting Hugging Face, an open-source AI platform for developing and sharing models.
As AI becomes increasingly embedded in critical business workflows, CFOs need confidence that agents are not only delivering the intended value but also operating within clear boundaries, according to Tahirkheli.
“CFOs have a broad view of AI investments,” she said, adding they are particularly well positioned to assess value and risk.
Alex Levine, a director analyst in Gartner’s finance practice, has said that CFOs should use their first finance AI agent to establish governance controls and oversight before focusing on its return on investment.
“The greatest risks and the greatest value lie in establishing oversight, not in chasing quick financial gains,” Levine said in an Aug. 20 Q&A published by Gartner. “By prioritizing governance, CFOs can surface and address gaps in oversight, traceability, and review processes before scaling to use cases with higher stakes.”
KPMG said its aIQ Capture platform underwent more than 900 technical tests including hallucinations, high-risk domain interactions, content safety, prompt injection attacks and other scenarios intended to challenge the agent’s reliability and resilience.
No critical or major vulnerabilities were identified, Tahirkheli said.
KPMG is the first Big Four firm to receive the AIUC-1 certification for an agentic AI capability, according to a press release. Other companies, including AI coding companies Lovable and Cursor, have also received AIUC-1 certification, it noted.
KPMG’s new certification follows one in November 2025 under ISO 42001, an international standard for AI governance systems.
Tahirkheli advised organizations to take a risk-based approach when deciding which agentic systems to certify.
“Not every agent needs an independent cerification,” she said. “The level of testing and certification should be proportionate to its purpose, its authority, its access and the potential impact.”
