What is SOC 2, and how does it apply to AI?
SOC 2 (System and Organization Controls 2) is a reporting framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines a service provider’s controls against the Trust Services Criteria: security, which every report covers, plus availability, processing integrity, confidentiality, and privacy as the provider chooses. A Type I report assesses the design of controls on a single date. A Type II report tests whether they operated effectively over a period, typically three to twelve months. Buyers of a managed AI service or AI-enabled software usually ask for the Type II report before signing.
SOC 2 has no AI-specific criteria, so AI enters through scope. When a service includes AI features, those features, their model provider, and the data passing between them belong in the audited system.
How SOC 2 works for AI systems
Several common criteria apply directly. Change management covers prompt edits and model version upgrades, which need the same tickets, testing, and approval as code. Logical access covers role-based access control for conversation logs and the credentials an agent uses to reach other systems. Monitoring covers misuse, such as prompt injection attempts or unusual data access. Vendor management covers the model API provider, often listed as a subservice organization. Many reports use the carve-out method, which excludes that provider’s controls from testing and states what it is expected to do. The report also lists complementary user entity controls, the safeguards the customer must run itself, such as reviewing AI outputs before acting on them.
SOC 2 in practice
A freight-audit company checks carrier invoices for shippers and adds a language model that flags accessorial charges, such as detention or liftgate fees, that do not match the contract. Customers require a current Type II report, so the next audit period must cover the feature. The company adds the model provider to its system description and vendor reviews. It routes prompt and model changes through change tickets like code and logs each flag with the model version and the reviewing analyst’s decision. During fieldwork, the auditor samples prompt changes alongside code releases.
What to watch for
- Read the system description to confirm that the AI features you are buying, and their model provider, are in scope.
- Check the test results for exceptions, because a report with a clean opinion can still record controls that failed.
- Review the complementary user entity controls, since some AI safeguards, such as output review, are assigned to you.
- SOC 2 does not measure model accuracy or bias, so test those separately; ISO/IEC 42001 certification shows whether the provider runs a formal AI management system.