What is the AI component of a system?
The AI component of a system is the part of a service organization’s system that uses artificial intelligence to deliver the service. The phrase appears in SOC 1 and SOC 2 engagements, where an independent auditor reports on the controls of a company that performs services for other businesses. SOC 1 addresses controls relevant to customers’ internal control over financial reporting, and SOC 2 addresses security and, where included, availability, processing integrity, confidentiality, and privacy.
Management’s system description lists the infrastructure, software, people, procedures, and data behind the service. When a model classifies transactions, extracts invoice data, or triages support tickets, it belongs in that description along with its prompts and configuration, the data it relies on, where it runs, and the people who review its output.
AI component of a system in practice
A managed service provider whose clients rely on its SOC 2 report adds a language model that triages tickets and proposes fixes. The auditor looks for the model in the system description, for change management over model and prompt updates, for restricted access to its configuration, and for a technician’s approval before any change reaches a client’s environment. If the model runs on an outside provider’s service, that provider may be a subservice organization whose controls the report must either include or carve out. Kirk Tech Solutions typically runs each client on a dedicated single-tenant deployment with its own audit log, which gives the auditor a clear boundary around the AI component.