SOC 2 for AI companies is the same examination every service organization takes: the AICPA has not created AI-specific criteria, but how you use AI changes your scope, your system description and the vendors you depend on. Enterprise buyers still ask for the report, so the work is explaining your AI systems inside the framework that exists.
Does SOC 2 have AI-specific criteria?
No. The AICPA has not published AI-specific Trust Services Criteria. In September 2026 it issued Technical Questions and Answers Section 9561, which addresses the effect of a service organization’s use of AI on SOC 1 examinations (AT-C section 320) and SOC 2 examinations (AT-C section 205).
According to a Schneider Downs summary of the TQA, AI does not create a separate SOC examination model, and relevance depends on whether your use of AI affects the services, systems, risks and controls already in scope. In plain terms, you are tested against the same criteria, and you must be able to show how AI fits inside them.
How does AI use change SOC 2 scope?
AI changes scope by adding systems, data flows and risks that the system description and controls must cover. The question an auditor asks is not “do you use AI?” but “is this AI use part of the system you are describing?”
| Question | Why it matters for the report |
|---|---|
| Where is AI used in the service? | Anything inside the system boundary needs controls and a description. |
| Does AI touch customer data? | It affects Security and, if selected, Confidentiality and Privacy. |
| Does AI change how outputs are produced? | It can affect Processing Integrity, if that category is in scope. |
| Which third parties supply models or APIs? | They are candidates for subservice organization treatment. |
| Do employees use AI tools with company data? | Unmanaged tools can fall outside the documented controls. |
The same Schneider Downs summary says service organizations should inventory AI use, decide whether each use falls within the system boundary and confirm the system description remains accurate and complete. See our SOC 2 audit guide for how scope and the system description fit together.
How are third-party AI providers treated?
A model or API provider you rely on is generally evaluated under the existing subservice organization framework. That means choosing between the carve-out method, which excludes the provider’s controls from testing, and the inclusive method, which describes and tests them.
- Carve-out: the report states which provider controls you expect to be in place, and customers read the provider’s own assurance.
- Inclusive: the provider’s relevant controls are described and tested as part of your report, which usually needs the provider’s cooperation.
- Complementary subservice organization controls: controls you assume the provider operates, which the report should list.
Our SSAE 18 guide explains both methods, and how to read a SOC 2 report shows how buyers check which vendors were carved out.
Which controls do AI companies commonly add?
The criteria do not prescribe AI controls, so these are examples from common practice that map to existing criteria. Which ones apply depends on how your product uses AI and which categories are in your report.
| Area | Example control | Typical evidence |
|---|---|---|
| Access | Restrict who can reach models, prompts, training data and logs | Role definitions, access reviews |
| Data handling | Document what customer data is sent to models, retained or used for training | Data-flow diagram, retention settings |
| Change management | Review and approve model, prompt and configuration changes before release | Change tickets, approvals |
| Monitoring | Log and alert on model access and unusual usage | Alert records, log samples |
| Vendors | Assess and review third-party AI providers | Vendor reviews, provider reports |
| Incident response | Include AI-specific incidents in the response plan | Plan, tabletop records |
Our list of SOC 2 control examples shows how these tie to the Common Criteria.
How do the NIST AI RMF and ISO 42001 relate to SOC 2?
They are separate, voluntary frameworks that cover AI governance, while SOC 2 is an attestation about your controls. NIST released the AI Risk Management Framework 1.0 on January 26, 2023, describes it as intended for voluntary use, and released a generative AI profile on July 26, 2024.
ISO/IEC 42001 is an international standard published in December 2023 that specifies requirements for an artificial intelligence management system and applies to organizations of any size. Many AI companies use SOC 2 for security assurance and one of these frameworks for governance. For the standards comparison, read ISO 42001 vs SOC 2.
Next Assurance helps AI companies define scope and system descriptions that buyers can read. See our SOC 2 audit service.
Frequently asked questions about SOC 2 for AI companies
Do AI companies need SOC 2?
No law requires it, but enterprise buyers commonly ask AI vendors for a SOC 2 report during security review, so lacking one can slow a deal. Whether you need it depends on your customers. Ask your largest prospects what assurance they require before you scope an examination.
Is there a SOC 2 for AI?
Not as a separate report. The AICPA has not created AI-specific criteria, and its September 2026 TQA Section 9561 addresses how AI use affects existing SOC 1 and SOC 2 examinations. An AI company takes a standard SOC 2 and describes its AI use inside the scope it defines.
Are AI model providers subservice organizations?
Generally, a third-party model or API provider you rely on is evaluated like any subservice organization. You choose the carve-out method, which excludes its controls from testing, or the inclusive method, which includes them. Your auditor helps decide based on how critical the provider is and what assurance it offers.
Does SOC 2 cover model training data?
Only if it is inside your system boundary and tied to the categories you select. Customer data used in training is relevant to Security and, if included, Confidentiality and Privacy. Document what data enters models, who can access it and how long it is retained, then make sure the system description says so.
Should we get ISO 42001 or SOC 2 first?
For most U.S. enterprise sales, buyers ask for SOC 2 first because it addresses security and availability of the service. ISO/IEC 42001 addresses AI governance and may matter more for international or regulated customers. Let your prospects’ questionnaires and contracts decide, since either can be requested by name.
How long does a first SOC 2 take for an AI startup?
It depends on your readiness and the report type, not on being an AI company. A Type I tests design at one date, while a Type II tests operation over a period you choose. Plan time for scoping, remediation and, for Type II, the observation period before fieldwork begins.
Sources
Facts checked against the sources below on October 7, 2026. The substance of AICPA TQA 9561 comes from a secondary summary because the AICPA document requires an account; control examples reflect common practice.
- AICPA & CIMA – TQA Section 9561: SOC Examinations, Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations: addresses AI use under AT-C 320 and AT-C 205.
- Schneider Downs – AI in SOC Examinations: What the AICPA’s New TQA Section 9561 Means: summary of the TQA (secondary source).
- NIST – AI Risk Management Framework: version 1.0 released January 26, 2023; voluntary use; generative AI profile July 26, 2024.
- ISO – ISO/IEC 42001 Artificial intelligence management system: edition 1, December 2023.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria a SOC 2 examination evaluates.
