FAQ: Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations. Those improvements can make the current service easier to manage while the proposal is being considered. The AICPA's proposed changes include AI-related considerations, but the final wording and timing still need to be confirmed. Keep a separate draft-to-current mapping if it helps planning; do not describe proposed points as mandatory controls today.

Related: SOC 2 audit and compliance hub; SOC 2 trust services categories.

Further reading: AICPA proposed 2027 criteria announcement; NIST AI Risk Management Framework.

Additional FAQs

How can we share audit evidence without exposing unnecessary sensitive data?

Agree on a secure sharing method and limit access to the people who need the evidence. Before uploading, check for credentials, customer content, personal information, and unrelated records. Ask the

How should we control the accounts used by audit automation?

Give each integration only the access needed for its task, and assign a business owner. Prefer identifiable service accounts or supported application identities over a shared employee login. Record the

What should we track if we manage third-party risk manually?

Keep a shared register that lets a colleague see why a service was accepted and what still needs attention. Include: Link supporting records rather than copying everything into the spreadsheet.

What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored.

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

What makes a record useful as SOC 2 audit evidence?

A useful record shows what happened, when it happened, which system or activity it covers, and who performed or reviewed the work. Keep enough context to connect it to the

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide