Q2 Becomes First Digital Banking Provider with AIUC-1 Certified AI Capabilities

Q2 Holdings (NYSE: QTWO) announced that Q2 Assistant achieved AIUC-1 certification following independent testing of its AI security, safety and reliability controls.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Independent testing gives banks and credit unions third-party evidence that Q2 Assistant meets rigorous security, safety and reliability standards

AUSTIN, Texas--(BUSINESS WIRE)-- Q2 Holdings, Inc. (NYSE: QTWO), a leading provider of digital transformation solutions for financial services, today announced that Q2 Assistant has achieved AIUC-1 certification, an independent security, safety, and reliability standard for AI agents, making Q2 the first digital banking provider to achieve AIUC-1 certification, according to AIUC. The certification reflects adversarial technical testing and a third-party audit of the controls behind Q2 Assistant, including data isolation, permissions enforcement, interaction logging, and compliance controls.

As financial institutions scale AI, only 18% of banking executives say they are confident their AI controls would pass an independent audit. AIUC-1 helps provide that assurance in partnership with Grant Thornton in the U.S., the fifth-largest provider of professional services, tax and advisory services, through a combination of independent controls for auditing and adversarial technical testing.

The AIUC-1 standard spans six domains: data and privacy, security, safety, reliability, accountability, and societal impact. It also maps to established frameworks including ISO 42001, the NIST AI Risk Management Framework, the EU AI Act, MITRE ATLAS, and the OWASP Top 10 for LLM and agentic applications. Q2 Assistant was evaluated against real-world AI risks such as prompt injection, jailbreaks, unauthorized actions, data leakage, hallucination, and unsafe tool calls.

“Banks and credit unions hold every vendor to a high standard, and AI deserves the same scrutiny,” said Q2 Chief Risk Officer Blair Williams. “We built Q2 Assistant with governance in mind from the start, and we wanted independent validation that the controls behind it are operating as intended. The AIUC-1 report gives our customers credible, third-party evidence they can bring to their risk committees, boards, and regulators as they evaluate where and how to adopt AI responsibly.”

Q2 Assistant is the unified AI assistant experience embedded across Q2’s product portfolio, giving financial institution teams a single place to ask questions, find information, receive guidance, and complete tasks inside the banking workflows they already use. Through specialized, product-specific agents, Q2 Assistant can support and execute tasks within individual Q2 solutions while operating within the roles, permissions and controls established by each financial institution.

“At VeraBank, we are excited about the opportunities AI presents and believe responsible innovation starts with trust,” said VeraBank Senior Vice President & Digital Experience Officer Jeremy Cartwright. “Independent assurance helps confirm that appropriate AI controls are in place and working as intended, giving our stakeholders greater confidence as we responsibly expand our use of AI.”

“Financial institutions are being asked to adopt AI faster than their risk teams can evaluate it,” said AIUC Co-Founder Rajiv Dattani. “AIUC-1 gives them a common bar to hold vendors to, and Q2 is the first in digital banking to meet it. Just as important, certification isn’t a one-time event: Q2 Assistant will keep being re-tested as threats and capabilities change.”

“For financial institutions, trust is fundamental to adopting AI at scale,” said Nicole Julius, national managing partner of Enterprise Assurance Services at Grant Thornton LLP. “As AI becomes more deeply embedded in critical business operations, third-party assurance helps organizations know the controls behind these technologies can stand up to rigorous scrutiny. Q2’s AIUC-1 certification demonstrates how to build trust while continuing to innovate with confidence.”

The certification builds on Q2’s approach to embedding AI directly into banking workflows while maintaining the governance required by regulated financial institutions. Grounded in Q2’s Responsible AI Pledge, Q2 is committed to helping ensure financial technology remains secure, transparent, and built for the high trust standards of banking. To maintain certification, Q2 Assistant will continue to undergo quarterly adversarial testing under AIUC-1, so controls are re-tested as threats evolve and as new agents are brought into scope.

Hear directly from Q2, AIUC, and Grant Thornton on why Q2 pursued the certification and what any bank or credit union should ask before putting AI into its operations on Q2’s Purposeful Banker podcast.

For more information about Q2’s approach to AI innovation for financial services, please visit https://www.q2.com/ai-for-everyone.

About Q2 Holdings, Inc.

Q2 is a leading provider of digital transformation solutions for financial services, serving banks, credit unions, alternative finance companies, and fintechs in the U.S. and internationally. Q2 enables its financial institution and fintech customers to provide comprehensive, data-driven digital engagement solutions for consumers, small businesses and corporate clients. Headquartered in Austin, Texas, Q2 has offices worldwide and is publicly traded on the NYSE and NYSE Texas under the stock symbol QTWO. To learn more, please visit Q2.com. Follow us on LinkedIn and X to stay up to date.

About AIUC

The Artificial Intelligence Underwriting Company builds confidence infrastructure for AI adoption through certification, auditing, and insurance for AI agents. Founded by experts from Anthropic and developed with Orrick, the Cloud Security Alliance, and MITRE, AIUC-1 is the first security, safety, and reliability standard for AI agents. The AIUC-1 Consortium includes 300+ CISOs and security leaders from Fortune 1000 companies. For more information, visit aiuc-1.com.

About Grant Thornton in the U.S.

Grant Thornton delivers professional services in the U.S. through two specialized entities and their affiliates: Grant Thornton LLP, a licensed, certified public accounting (CPA) firm that provides audit and assurance services — and Grant Thornton Advisors LLC (not a licensed CPA firm), which exclusively provides non-attest offerings, including tax and advisory services.

Grant Thornton LLP, Grant Thornton Advisors LLC and their respective subsidiaries operate as an alternative practice structure (APS). The APS conforms with applicable laws, regulations and professional standards, including those from the American Institute of Certified Public Accountants.

“Grant Thornton” refers to the brand under which the member firms in the Grant Thornton International Ltd (GTIL) network provide services to their clients and/or refers to one or more member firms. Grant Thornton LLP and Grant Thornton Advisors LLC serve as the U.S. member firms of the GTIL network. GTIL and its member firms are not a worldwide partnership and all member firms are separate legal entities. Member firms deliver all services; GTIL does not provide services to clients.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261105776727/en/

Media Contacts
Cameron Lorenz
cameron.lorenz@q2.com

Source: Q2 Holdings, Inc.

Key Terms

prompt injection technical

A prompt injection is a deliberate attempt to trick an AI system by inserting misleading or malicious instructions into the text it reads, causing the system to behave in unintended ways or reveal sensitive information. Like slipping a fake note into a stack of instructions, it matters to investors because it can lead to data breaches, regulatory breaches, faulty decisions, reputational damage, and unexpected costs for companies that rely on AI-driven tools.

jailbreaks technical

Jailbreaks are unauthorized modifications that remove built‑in restrictions on a device or software, enabling installation of apps or access levels the maker did not approve. For investors, jailbreaks matter because they can change consumer behavior, threaten security and brand trust, alter revenue from app stores and services, and invite regulatory or legal reactions—like unlocking a locked door that both expands use and raises safety and liability concerns.

data leakage technical

Data leakage is the accidental or unauthorized release of confidential, non-public information—such as financial results, trade secrets, or patient records—outside the organization that owns it. For investors it matters because leaked information can move a stock price before official disclosure, create legal and regulatory risk, and damage trust in management, much like an exam answer sheet shared early changes how others act on the information.