Your auditor will not hand you an AI control checklist, because the framework does not contain one. What you get instead is a set of questions assembled from the criteria that already exist, aimed at four things: which AI tools are in use, who approved them, what happens to the data, and whether the people using them can say what the rule is. The first three are answered with documents you can produce in a quarter. The fourth is answered by your staff, out loud, during fieldwork.
No AI criterion exists, which is why the questions vary
SOC 2 is an attestation against the AICPA’s Trust Services Criteria: five categories covering security, availability, processing integrity, confidentiality and privacy. Security is the common criteria set, CC1 through CC9, mandatory in every report; the other four are scoped in according to what you have promised customers. The criteria have not changed since 2017, and the points of focus underneath them were revised in 2022.
Nothing in that structure mentions artificial intelligence. The Cloud Security Alliance put the consequence plainly in an August 2026 research note, The SOC 2 AI Gap: the AICPA has published no AI-specific criteria, no AI-specific points of focus and no authoritative addendum, while SOC 2 has become the trust signal enterprise buyers demand from AI vendors anyway. Auditors fill the vacuum themselves, assembling evidence requests around model lineage, inference logging, drift monitoring and subprocessor risk, then mapping each back to the unchanged criteria.
Carry the CSA’s conclusion into your own planning: two companies can each hold a clean Type II report having tested entirely different control sets, because no common AI baseline exists for auditors to test against. Whether a sixth Trust Services category for AI governance should exist is an open debate in the profession, not a decision, so your auditor’s AI questions depend partly on your auditor. Ask your audit firm for its evidence list before fieldwork rather than during it. If you want a published baseline in the meantime, the CSA’s AI Controls Matrix reached version 1.1 in 2026 with 247 control objectives across 18 domains, mapped to ISO/IEC 42001, the NIST AI Risk Management Framework and the EU AI Act. Nobody will require it of you; it is a useful worksheet.
The questions, and the criterion each one tests
Aprio’s risk advisory practice published the clearest public version of the map in September 2026, arguing that the criteria did not change but the examination did. Below is that map as the questions you will hear, with the evidence that closes each.
| What you will be asked | Criterion it tests | Evidence that closes it |
|---|---|---|
| Do you have an AI use policy, and who owns it? | CC1, CC2 | Approved policy with a named owner, a version date, and distribution records |
| Does AI appear in your risk assessment? | CC3, CC4 | An AI section in the enterprise risk assessment, reviewed in the period |
| Which AI tools and service accounts exist? | CC6 | A current inventory with named owners, reconciled against identity and expense data |
| How do AI accounts get provisioned and removed? | CC6 | AI accounts inside your normal joiner-mover-leaver and access-review cycle |
| How would you detect an unapproved tool? | CC7 | Detection for unsanctioned AI usage, with review records |
| How are changes to AI-assisted systems approved? | CC8 | Change tickets, plus a model registry for anything you build |
| Have you assessed the AI vendors as vendors? | CC9 | Risk assessments, signed agreements, data terms, the vendor’s report |
| Is the model provider a subservice organization? | CC9 | A documented determination, correctly presented in your system description |
| Were staff trained on this specifically? | CC1, CC2 | Completion records, the curriculum, and staff who can state the rule |
| What happens to data you send these tools? | Confidentiality, Privacy | Configured retention and training terms, and a data-flow description that matches reality |
Read the right-hand column twice. Eight of those ten rows are artifacts: a document, a list, a ticket queue, a signed agreement. A project plan and a quarter will assemble all eight. The ninth and tenth are different in kind, and that is where attested companies lose time.
The finding you are most likely to get
The likeliest finding is not a badly governed AI deployment. It is a tool nobody inventoried.
Linford & Company set out in March 2026 why unapproved AI tools are not a single finding. Staff reaching an external service with corporate credentials outside provisioning review is a CC6 logical access problem. Data leaving through a channel your monitoring does not watch is CC7.1 system operations. A vendor with no risk assessment and no data processing agreement is CC9.1 risk mitigation. One browser extension, three criteria.
Aprio frames the test the way an auditor experiences it: staff adopt tools faster than security can vet them, so an auditor asking how you know what AI is running in your environment is testing whether your list is current. Not whether a list exists in a wiki.
Build it before fieldwork from three sources that disagree usefully: AI-adjacent charges on expense reports and corporate cards, including the personal subscriptions that never touched procurement; the application list from your identity provider and endpoint tooling; and a direct question to each team lead, framed as amnesty rather than investigation. Expect the union to exceed what you provisioned.
Then close the gap at the account layer rather than the policy layer: one administered tenant per approved tool, personal logins blocked at identity, accounts issued on day one. Our comparison of administered AI accounts and consumer sign-ins makes the full case; the short version is that a consumer login gives you no data-handling terms, no retention control and no audit log, which means it gives your auditor nothing to test.
Your model provider becomes a vendor file
Once you sanction a tool, its provider enters your vendor management program on the same terms as any processor. Three questions decide how much work that is.
Is this a subservice organization? If the provider performs part of the service your own report covers — a model doing work your customers are paying you for — it may meet the definition, which changes how it appears in your system description. If staff merely use an assistant for internal drafting, it is a vendor. Write the determination down either way, because the answer you give verbally in fieldwork gets asked for on paper.
What are the data terms, as configured? Not as marketed. Business tiers of the major assistants do not train on your inputs by default and some offer zero-retention arrangements for qualifying use, but the setting that matters is the one in your tenant. Print the configuration page. Retention and administration differences between two widely deployed business assistants are covered in our administration and data comparison.
What attestations do they hold, and over what? Scope is the whole game, and most pages ranking for this question omit it. OpenAI’s Type II coverage, per its trust portal, runs to the API platform and the business ChatGPT tiers, and the consumer tiers sit outside it. The company also lists ISO/IEC 27001, 27017, 27018 and 27701. Anthropic’s trust center lists SOC 2 Type I and Type II, ISO 27001:2022, ISO/IEC 42001:2023 for AI management systems, and a business associate agreement on eligible plans. Ask about ISO/IEC 42001 specifically: it is the standard written for AI governance, and it reaches ground SOC 2 was never designed to cover.
An attestation that excludes the tier your team is using is not coverage. That one check resolves more vendor-file arguments than any questionnaire.
Read the report, not the badge
Request the report rather than the logo, then read four things.
Scope. Which products, systems and locations the examination covered, and which it did not.
Observation period. Type I evaluates control design at a point in time. Type II evaluates operating effectiveness across a period, typically six to twelve months, which is what enterprise buyers usually mean. A period that ended fourteen months ago is stale.
Exceptions. The auditor’s testing results, including anything qualified. A clean opinion with noted exceptions is common and often fine. Not having read them is not.
Complementary User Entity Controls. The section almost nobody opens, and the one that creates work for you. CUECs are the controls you must operate for the vendor’s controls to function as designed, listed inside the system description. Typical entries: access provisioning and removal on your side, enforced multifactor authentication on portal accounts, prompt incident reporting to the provider. Skip them and the vendor’s opinion still stands, because the auditor tested the vendor. What changes is your position: you have accepted risk nobody evaluated, and in a regulated setting that can be a material control deficiency.
So the honest answer to “are we covered because the vendor holds a SOC 2” is: partly, and the report names the part that is yours. Holding a vendor’s report is not reviewing it. Map each CUEC to an owner and keep evidence it operates.
The part of fieldwork no purchase closes
Two rows in the question table are not artifacts.
Fieldwork is not only a document review. Auditors interview staff, and when they do they are testing whether the policy is in operation rather than merely in existence. The question is mild: what are you allowed to put into these tools, and what do you do when you are not sure. Four people answering four different ways is a finding whatever your policy says, because the policy is then evidence of intent rather than of control.
This is the gap between a written AI use policy and the behavior it assumes, and closing it is the subject of our guide to policy, training and the distance between them. The mechanism is unglamorous. The rule has to be short enough to recall with a document open and a deadline running, there has to be a fast route to asking, and people have to have made the judgment call once before, on their own material, with someone in the room able to say “that one, no, and here is the version that is fine.”
Generic awareness modules do not produce that. Neither does inspection tooling, which handles patterned data well and unpatterned confidential material poorly, as our assessment of what AI data-loss prevention catches sets out. The residual — an unsigned agreement pasted in for a summary, next quarter’s unreleased numbers, a free-text support transcript — is judgment, made by a person, in seconds. Treating that as an AI enablement problem rather than a tooling problem is the argument of our case that buying licenses is not the same as building capability. The examination is where the difference becomes visible to someone outside your company.
What this costs and the order to do it in
Most of the cost is internal attention, not procurement. The inventory, the policy, the risk-assessment section and the vendor files are weeks of someone’s time, probably whoever already carries compliance as a second job. Account consolidation onto administered tenants raises per-seat spend and lowers nearly every other exposure on the list, which makes it the highest-yield item. Detection for unsanctioned usage may be configuration work in tooling you own; if it is a purchase, scope it after the inventory shows where the exposure sits. Policy drafting is a defined piece of work with a defined price, broken down in our guide to what an AI use policy costs to write and roll out.
On training, the market splits cleanly. Self-paced compliance modules run tens of dollars per learner and generate completion records, satisfying the documentary half. Facilitated hands-on sessions sit in a $2,000–15,000 market range per engagement and are what produces staff who answer the interview question consistently. Buy the first for the artifact and the second for the control; companies that buy only the first discover the distinction during fieldwork.
Sequence it: inventory, administered accounts, the written rule with a named channel and a response commitment, vendor files and CUEC ownership, detection, then training booked far enough ahead that behavior has had a quarter to settle.
If you want a second read on where your AI evidence is thin before your next examination, book a free AI-readiness call. We run hands-on LLM fluency sessions against a team’s own documents and daily work, and we will say plainly when an inventory and a one-page rule would do more for your report than another platform.
Frequently asked questions
Does SOC 2 have AI-specific requirements?
No. The AICPA has published no AI-specific Trust Services Criteria, no AI-specific points of focus and no authoritative addendum. Auditors extend the existing criteria instead, mapping AI risk onto governance, risk assessment, access, operations, change management and vendor criteria. A sixth category is an active debate, not a settled change.
What will my auditor ask about the AI tools we use?
Four groups: what AI is in use and who owns it, how those accounts are provisioned and reviewed, what happens to data sent to the provider, and whether staff were trained and can describe the rule. Each maps to a criterion you are already tested against.
Is using ChatGPT or Claude at work a SOC 2 violation?
Not in itself. Findings come from unreviewed tools, with no vendor assessment, used through personal accounts outside your access reviews. Sanctioned tools on administered accounts, inside your normal vendor and access processes, are ordinary in-scope vendor usage.
What is the most common AI-related SOC 2 finding?
Unapproved tools nobody inventoried. It implicates three criteria at once: logical access, because external services are reached with corporate credentials outside provisioning review; system operations, because the traffic escapes monitoring; and risk mitigation, because the vendor has no assessment or data processing agreement.
Is our model provider a subservice organization?
It depends on whether the provider performs part of the service your report covers. A model doing work your customers pay for may meet the definition, which changes how it is presented in your system description. An assistant staff use for internal drafting is a vendor. Document the determination either way.
Does a vendor’s SOC 2 report cover us?
Only partly, and the report says so. The system description lists Complementary User Entity Controls, the controls you must operate for the vendor’s controls to work as designed. Not implementing them leaves the vendor’s opinion intact and leaves you holding risk no auditor evaluated, which in regulated settings can be a material deficiency.
Do we need ISO 42001 as well?
Not for SOC 2. ISO/IEC 42001:2023 is the AI management system standard and covers governance ground SOC 2 was not designed for, which is why several model providers hold both. Ask vendors about it; consider it for your own program if customers ask.
Is AI security training required for SOC 2?
Awareness training is already expected under the governance criteria, and auditors increasingly want AI covered in it. Completion records satisfy the documentary side; the interview side needs staff who can state the rule, which generic modules rarely produce.
How far ahead of our audit should we start?
A quarter for the artifacts: inventory, policy, risk-assessment section, vendor files, CUEC ownership. Longer for the behavioral part, which needs a period of operation behind it.
Will compliance automation tooling handle this for us?
It handles evidence collection and control mapping well, which is real time saved. It cannot inventory tools nobody declared, and it cannot make staff answer the interview question the same way. Those two stay management work.
Key takeaways
- There is no AI criterion in SOC 2 and no authoritative AICPA guidance, so your auditor’s AI evidence list is partly their own. Ask for it before fieldwork.
- Ten questions cover the ground, mapped to CC1 through CC9 plus confidentiality and privacy. Eight close with artifacts; two close with behavior.
- The likeliest finding is tools nobody inventoried, and it implicates logical access, system operations and vendor risk mitigation together.
- Read the vendor’s report rather than the badge: scope, observation period, exceptions, and the Complementary User Entity Controls that assign work to you.
- Fieldwork includes interviewing staff. Completion records answer the paperwork; only practiced judgment on real documents answers the person asking.
Dirk Jan van Veen, PhD
