FAQ: How can we spot AI being added to a product we already use?

Assign the product owner to watch release notes, security notices, updated terms and subprocessor information, and account settings for new AI features. Ask vendors and internal users whether AI has been added, whether it is enabled by default, and what information it can use. Update the inventory when a feature is found, including who enabled it and where it is used. These checks improve visibility but cannot guarantee discovery of every change. If the data use is unclear, seek clarification before expanding use.

Additional FAQs

Can an organization opt for both SOC2 and ISO 27001?

Yes. SOC 2 provides a CPA examination report about a defined service system and its applicable Trust Services Criteria. ISO/IEC 27001 certification concerns an information security management system within a

What should we check when a vendor shares an AIUC-1 certificate?

Check which organization and AI system are covered, the applicable standard version, the assessment dates, and the certificate's current status. Ask for enough supporting information to understand the evaluation and

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess

SOC 1 or HITRUST?

Choose based on the assurance your customers need. SOC 1 addresses controls relevant to customers’ internal control over financial reporting. HITRUST offers cybersecurity assessments and certifications with different scopes and

What should we reassess before enabling AI in an existing product?

Review what the feature changes from the product you already approved: data sent to additional providers, retention or training use, permissions, and whether it can act rather than only suggest.

How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide