FAQ: Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access, and subprocessors. Do not assume a paid account or an enterprise label answers every question. Prefer a limited or de-identified input when it meets the business need, and verify that removing obvious names has not left identifying details. Give employees an approved route for the task. If sensitive information was already entered into an unapproved service, use the incident process rather than quietly deleting the chat and assuming the issue is resolved.

Related: SOC 2 audit and compliance hub.

Further reading: NIST Generative AI Profile.

Additional FAQs

When should AI use be discussed with our SOC 2 auditor?

Bring it up when AI is part of the service being examined, supports an in-scope process, handles relevant information, or affects how a control operates. Explain the use case, provider,

Can one piece of evidence support more than one control?

Yes, where the record genuinely supports each control and the auditor can follow the connection. Keep one controlled copy and link it from the relevant control or request entries rather

Should we wait for the proposed SOC 2 updates before improving AI controls?

No. Begin with the AI uses and risks you already have. Identify owners, document data flows, review access, define appropriate human oversight, and retain records of important decisions and evaluations.

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

What if we change a major system during the SOC 2 period?

Tell the auditor early and keep a dated change record. Explain what changed, which controls were affected, when the new process began, and where evidence from both versions is stored.

How often is a SOC 2 audit required?

Agree the examination cadence and reporting periods with your auditor and the customers relying on the report. Consider contractual requirements, coverage gaps, and significant system changes. A Type 1 report

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide