FAQ: What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the output leads to an action or decision. Note the approved configuration and where review or monitoring records are kept. Ask business teams about everyday use rather than limiting the inventory to engineering projects. Keep the list current as products and settings change. A simple inventory gives the team somewhere to begin when deciding what is allowed, what needs closer review, and what belongs in an audit discussion.

Related: SOC 2 audit and compliance hub.

Further reading: NIST AI Risk Management Framework.

Additional FAQs

What are the SOC 2 criteria?

The five SOC 2 criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Can we manage SOC 2 with spreadsheets and shared folders?

Yes, if the workflow is reliable and the records support the controls. Start with a control register, an evidence index, a calendar, and a restricted folder structure. Assign owners and

We have a small company, how do we segregate Board of Directors from Management, and then, also the Internal Audit function?

Depending on the size of your Company, you could look to another small business owner in a similar situation or trusted advisor to sit on each others board’s and create

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

As of the latest SSAE 18 and SOC 2 updates, vendor management and review of any relevant compliance / audit reports (SOC 1, SOC 2, HITRUST, ISO 27001/2, PCI, etc.)

What is AIUC-1, and how does it relate to SOC 2?

AIUC-1 is an AI-focused standard maintained by the Artificial Intelligence Underwriting Company. Its published scope addresses data and privacy, security, safety, reliability, accountability, and societal risks. It is separate from

Does a SOC 2 report certify that an AI product is safe or accurate?

No. A SOC 2 report addresses the described system and controls against the applicable criteria within the engagement's scope. It is not a blanket certification of an AI product's safety,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide