SOC 2 with AI-Specific Controls
SOC 2 examinations extend to AI by evaluating AI-specific risks — model governance, data handling, and monitoring — under the existing trust services criteria. There is no separate AI audit: AICPA guidance folds AI considerations into the standard SOC 2 examination, which enterprise buyers increasingly expect from AI vendors during due diligence.
Updated 2026-11-01 · 166 tracked updates
SOC 2 + AI extends the traditional SOC 2 trust services criteria to address AI-specific risks. It covers security, availability, processing integrity, confidentiality, and privacy as they apply to AI systems, including model governance, bias monitoring, and AI transparency.
Who Needs to Comply?
SaaS companies, AI vendors, and technology service providers that need to demonstrate trust and compliance to enterprise customers. Essential for B2B AI companies undergoing customer due diligence.
Key Dates & Timeline
AICPA's guidance on AI considerations in SOC examinations published 2024. SOC 2 with AI-specific controls gaining traction through 2024-2025. AICPA AI-related point of focus updates ongoing.
Upcoming Milestones
Article 5 prohibitions on realistic intimate synthetic content and CSAM-related AI practices apply
Digital Omnibus on AI amends the EU AI ActProviders of AI systems generating synthetic audio, image, video or text must comply with Article 50(2) marking steps if placed on market before 2 Aug 2026
Digital Omnibus on AI amends the EU AI ActCommission deadline to publish AI Act guidance on complementarity and proportionality for Annex I-sector AI systems
Digital Omnibus on AI amends the EU AI ActGeneral application date for Chapter III Sections 1-3 high-risk AI rules under the amended timetable
Digital Omnibus on AI amends the EU AI ActHigh-risk AI embedded in regulated products has extended transition period end
AI Act and European AI Office implementation and enforcementLatest SOC 2 + AI Updates
FCA review of the long-term impact of AI on retail financial services
The FCA is reviewing how AI may reshape retail financial services by 2030 and beyond and is seeking views on future technology, market, consumer, and regulatory implications rather than proposing new rules now.
FTC action against IntelliVision over AI facial-recognition bias claims
The FTC finalized an order against IntelliVision Technologies after allegations that it made false or unsubstantiated claims that its AI facial-recognition software was free of gender or racial bias.
FTC finalizes order against accessiBe over AI accessibility claims
The FTC finalized an order requiring accessiBe to pay $1 million after allegations that it misrepresented its AI web accessibility tool as making any website WCAG-compliant.
FTC final order against Workado requires substantiation for AI content detection claims
The FTC approved a final order barring Workado from advertising the accuracy or efficacy of its AI content detection products unless it has competent and reliable evidence supporting the claims.
FCA confirms no new AI-specific rules for financial services
The FCA says it is not planning AI-specific regulation and will rely on existing frameworks such as Consumer Duty and SM&CR, so firms should focus on fitting AI governance into current control regimes rather than waiting for a new rulebook.
SEC announces internal AI task force
The SEC announced an internal AI task force on 1 August 2025 to coordinate responsible AI adoption across the agency; the announcement does not introduce a new external compliance obligation.
FTC AI enforcement actions on deceptive claims and substantiation
These records cover separate FTC proceedings concerning AI claims, an AI companion chatbot inquiry, and the later setting aside of the Rytr order; they do not establish a common new compliance deadline.
AICPA SOC 2 resources reaffirm current Trust Services Criteria for AI-enabled services
AICPA’s SOC resources confirm the current Trust Services Criteria baseline and do not create AI-specific rules, but they reinforce that AI-enabled services must still satisfy existing security, privacy, and processing integrity controls in audits.
FTC AI enforcement posture remains active across deceptive claims and AI investments
The FTC’s AI hub and related matters, including Rytr, Workado, and DoNotPay, show that the agency continues to police deceptive AI claims and conduct, so AI product and marketing teams should assume ongoing enforcement scrutiny now.
ISO AI management-system and adjacent AI standards pipeline expands
ISO’s AI standards pages and draft items show an active pipeline around AI management systems, audit/certification, societal concerns, and privacy protection, so organizations pursuing ISO-based assurance should update their standards watchlist now.
Jurisdiction Coverage
Related Frameworks
Key Topics
Frequently Asked Questions
How does SOC 2 apply to AI systems?
SOC 2 examinations extend to AI by evaluating AI-specific risks — model governance, data handling, and monitoring — under the existing trust services criteria. There is no separate AI audit: AICPA guidance folds AI considerations into the standard SOC 2 examination, which enterprise buyers increasingly expect from AI vendors during due diligence.
What is SOC 2 + AI?
SOC 2 + AI refers to SOC 2 examinations that include additional criteria and controls specific to AI systems. It extends the five trust services criteria (security, availability, processing integrity, confidentiality, privacy) to cover AI-specific risks like model governance, bias, and transparency.
Do I need a separate SOC 2 audit for AI?
No. AI-specific controls are incorporated into your existing SOC 2 examination. Your auditor evaluates AI risks as part of the standard trust services criteria assessment, with additional focus areas for AI governance, model management, and ethical AI practices.
How does SOC 2 + AI relate to ISO 42001?
SOC 2 + AI focuses on third-party attestation of controls for service organizations, while ISO 42001 is a management system certification. SOC 2 + AI is typically customer-driven (enterprise buyers require it), while ISO 42001 is more proactive governance. Many organizations pursue both.
Keep exploring
This hub tracks published activity relevant to SOC 2 and AI; examination scoping is set by your auditor, and this page is not attestation advice.