No. As of 22 October 2026, the AICPA has not changed the SOC 2 criteria for AI. The criteria are still the 2017 Trust Services Criteria with the points of focus revised in 2022, and we found no AI-specific SOC 2 criteria on the AICPA site as of 22 October 2026. What has changed is the auditor. Firms now ask AI-using companies for an inventory of AI tools and agents, for proof of what data reaches third-party models, for access and change controls on prompts and models, and for logs and vendor reviews, then test the answers under the existing criteria. A Cloud Security Alliance note dated 30 August 2026 calls the result a patchwork in which two AI companies can each hold a clean SOC 2 Type II report after testing different control sets.
The question is not only for AI vendors.
Any company inside a SOC 2 scope whose staff use ChatGPT, Copilot, a coding assistant or an agent that calls internal APIs is an AI-using service organization in the auditor's eyes, and the questions below arrive whether or not AI appears in the system description.
Last verified: 22 October 2026, against the AICPA's pages for the 2017 Trust Services Criteria (with revised points of focus, 2022), TQA Section 9561 and its 13 and 19 October 2026 releases; the Journal of Accountancy's May 2026 report on the reviewer alert; the Cloud Security Alliance note of 30 August 2026; the IEC webstore entry for ISO/IEC 42001:2023; and the European Commission's AI Act page. The full text of TQA 9561 sits behind an AICPA account and was not read. The TSC PDF was not downloaded, so criterion numbers below are our mapping from working knowledge of the 2017 TSC, not AICPA guidance.
Has the AICPA changed SOC 2 for AI?
Not the criteria. The AICPA's resource page for the 2017 Trust Services Criteria (With Revised Points of Focus, 2022) describes control criteria established by its Assurance Services Executive Committee for engagements over security, availability, processing integrity, confidentiality and privacy. The page does not mention artificial intelligence, and there is no "SOC 2 2026 revision" for AI.
Three AICPA items touch AI, and each is narrower than its headline.
- TQA Section 9561, posted 11 September 2026, is a set of technical questions and answers "intended to address the effect of a service organization's use of AI" on a SOC 1 examination under AT-C section 320 or "a SOC 2 examination performed in accordance with AT-C section 205". It is a Q&A, not new criteria; the full text sits behind a free AICPA account and we have not read it.
- A practice aid, "Artificial Intelligence (AI) Considerations for Financial Statement Auditors", released 13 October 2026. It is about the financial statement audit, not SOC 2.
- A joint SOC 2 plus AIUC-1 offering, announced by the AICPA and the Artificial Intelligence Underwriting Company on 19 October 2026. The release says "Several CPA firms are now delivering a joint SOC 2® plus AIUC-1 offering to clients", with a full launch "expected to take place in early 2027". This places a second standard beside SOC 2; it does not change what SOC 2 tests.
So the CSA's observation holds. Its research note, published 30 August 2026 by the CSA AI Safety Initiative, says the AICPA "has not published AI-specific Trust Services Criteria, AI-specific points of focus, or an authoritative AI addendum to the SOC 2 framework". The TQA appeared after that note and is a Q&A rather than criteria, so the statement still holds for the criteria themselves.
One more AICPA signal shapes your next audit. The Peer Review Board's May 2026 reviewer alert, as reported by the Journal of Accountancy on 14 May 2026, targets SOC 2 engagements that "have identical reports, risk assessments, sample sizes, and testing procedures", which peer review treats as "nonconforming". The board has been monitoring "high-volume providers using third-party platforms", with added procedures "Beginning June 1". Expect your auditor to tailor more and template less, and the tailoring to arrive as AI questions.
What are auditors asking anyway?
The CSA note reports that security-focused SOC 2 auditors "now request evidence categories that did not exist in a pre-AI engagement": training lineage, "per-inference logging that captures model version, a redacted prompt or prompt hash, tool calls, and outcome", LLM subprocessor documentation and drift-monitoring dashboards. Those are asks for model builders. For the far larger group that uses AI, the asks are plainer, and we hear seven again and again.
The mapping below is ours. The AICPA has issued no guidance assigning AI asks to criteria, so "tends to land under" means where we and the auditors we work with usually see the test placed. Your auditor may choose differently, and the system description decides what is in scope.
| What the auditor asks | Where it tends to land (our mapping) | Evidence that satisfies it | Evidence that gets rejected |
|---|---|---|---|
| An inventory of AI tools and agents in use, approved or not | CC3.2 and the asset inventory point of focus under CC6.1 | A dated inventory naming each tool and agent, its owner, the data it receives and its approval status, and how it was built (discovery output, SSO logs, expense records) | An approved-tools list no one has compared with actual use; a spreadsheet with no date and no owner |
| What data reaches third-party models | CC6.7, with CC5.3 for the policy; C1.1 if Confidentiality is in scope | The written rule on which data classes may go to which tools, the control that enforces it (redaction or blocking at the point of use), and sample events showing it firing during the period | "Staff are trained not to paste customer data"; a vendor's no-training claim with nothing showing your own configuration |
| Access controls on AI | CC6.1, CC6.2 and CC6.3 | SSO enforced on each enterprise AI tenant, users reconciled to HR leavers, defined roles for agents and service accounts, a termination sample | Personal accounts on consumer plans; an agent holding a shared API key with no named owner |
| Change management for prompts and models | CC8.1 | A change ticket per system prompt, model version or agent tool change, with approval, test evidence and rollback; a register of who changed what and when | Prompts edited in production by anyone with console access; a model switch known only from the vendor's changelog |
| Monitoring and logging of AI use | CC7.2, with CC7.1 for detection | Logs with user, tool, timestamp, action and outcome for AI and agent actions; alert rules; a record that someone reviews them | Vendor dashboards you cannot export; logs that record that a tool was used but not what was sent or done |
| Vendor management for model providers | CC9.2 | A vendor record per model provider: SOC 2 or ISO 27001 status, retention and training settings as configured, a signed data processing agreement, an annual review date | A screenshot of the vendor's trust page taken on the day of the audit; a subprocessor list nobody read |
| Incident response for AI incidents | CC7.3, CC7.4 and CC7.5 | AI scenarios in the incident plan (a prompt leak, an agent acting out of scope, a poisoned data source), at least one exercised, with the review | A generic incident plan that never mentions AI; a tabletop deck with no record of who attended or what was decided |
Two things stand out in the right-hand column. The rejected evidence is usually real; it just fails to show the control operating across the period. And the accepted evidence comes from three places: discovery that sees actual use, a log that records it, and registers someone keeps current.
Why can two companies pass with different controls?
Because SOC 2 does not prescribe controls. The service organization writes its system description, management asserts which controls meet which criteria, and the auditor tests those controls. Where the criteria are silent, the company's choices and the firm's overlay decide what is tested. The CSA note puts it directly: "two AI companies can each hold a clean SOC 2 Type II report while having tested entirely different control sets, because no common AI baseline exists for auditors to test against". A vendor, it adds, "can hold a clean, unqualified SOC 2 Type II report while having zero tested controls around model accuracy, training-data integrity, or drift detection".
Read the note with its interests in view. Its evidence base is practitioner materials rather than audit files, and it recommends the CSA's own AI Controls Matrix and STAR for AI program as the interim baseline, conceding that "independent validation of that mapping inside live SOC 2 engagements remains limited". Its advice to buyers stands regardless: "read the system description and management assertion to determine what was actually tested".
The same logic cuts the other way. If your description says nothing about AI, your clean report says nothing about AI, and a questionnaire that assumes otherwise is a risk you carry.
ISO/IEC 42001:2023 does address this. Published 18 December 2023, it "specifies the requirements and provides guidance for establishing, implementing, maintaining and continually improving an AI (artificial intelligence) management system within the context of an organization", per the IEC webstore entry, and applies to any organization "that provides or uses products or services that utilize AI systems". It has AI-specific controls; SOC 2 does not. The EU AI Act, Regulation (EU) 2024/1689, became applicable on 2 August 2026 with staged exceptions, according to the European Commission, and its record-keeping duties overlap heavily with the evidence above.
What to do now: a 90-day evidence plan
Ninety days turns each row of the table from "we do this" into "here is the evidence".
- Days 1 to 30, inventory and rule. Run discovery against real traffic rather than a survey; the Cloud Security Alliance and Token Security survey of April 2026 found that 82% of organizations discovered previously unknown AI agents in the past year. Record owner, data and approval state for each tool and agent. Write the AI acceptable-use rule so that it names data classes and tools; our AI acceptable-use policy template is useful here because it gives you the sections an auditor expects under CC5.3 rather than a statement of intent. Add AI to the risk register.
- Days 31 to 60, enforce and log. Put SSO in front of every enterprise AI tenant and retire personal accounts. Turn the data rule into a control that redacts or blocks at the point of use, and start an event log with user, tool, action and outcome; the field list in our AI agent audit log guide is the one auditors tend to accept under CC7.2. Open a change register for prompts, models and agent tools, and a vendor record per model provider.
- Days 61 to 90, exercise and package. Run one AI incident tabletop and write it up. Review the logs and record that you did. Reconcile AI users against HR leavers. Then map each piece of evidence to the criterion you expect it to be tested under and put that mapping in the system description draft, so the auditor tests what you intended.
Two of our guides help at the mapping step. The ISO 42001 Annex A evidence guide lists the document or log that proves each Annex A control, and most of those artifacts double as SOC 2 evidence for the rows above. The AI governance maturity self-assessment scores your program against 20 operational controls and finds the rows where you hold a policy but no operating evidence.
What software can carry, and what it cannot
Software cannot write your system description, decide which criteria are in scope, or persuade an auditor that a control operated. Those are management's assertions and the auditor's judgment, and no product makes a company compliant with SOC 2.
Software can produce the three evidence sources above. AccuroAI discovers 1,400+ AI tools and agents in use, which gives the inventory under CC3.2 a factual basis. It inspects prompts and uploads with 40+ data classifiers and redacts or blocks sensitive data in line before it reaches a model, the operating control under CC6.7 rather than a policy about one. It logs each event against a user and a tool, with evidence mapped to 8 frameworks, SOC 2 among them. See Workforce AI Governance for a workforce-wide deployment and our AI compliance hub for the wider framework picture.
Frequently asked questions
Does using ChatGPT Enterprise affect our SOC 2?
Yes, if staff use it to process data inside the system your report describes. It becomes a vendor under CC9.2 and a transmission path under CC6.7, so expect to show its contract, its retention and training settings as configured, SSO enforcement, and the rule and control for what may be sent. Its own SOC 2 report covers the provider's controls, not yours.
Is ISO 42001 a better fit than SOC 2 for AI?
For governing AI, yes; for customers who ask for SOC 2, no. ISO/IEC 42001 specifies requirements for an AI management system with AI-specific controls; SOC 2 reports on the controls you chose against general criteria. Many companies hold both.
Do we need AIUC-1 as well?
Not as an AICPA requirement. The joint SOC 2 plus AIUC-1 offering announced on 19 October 2026 is a market product, with a full launch expected in early 2027. Pursue it if your buyers ask for it.
Our auditor never asked about AI last year. Will they this year?
Probably. The May 2026 reviewer alert pushes firms away from identical engagements, and AI use is what differs most between clients.
This is not legal or audit advice. Criterion references are our mapping of common auditor requests onto the 2017 Trust Services Criteria and are not AICPA guidance; confirm scope and criteria with your service auditor.
Sources
- 2017 Trust Services Criteria (With Revised Points of Focus, 2022), AICPA
- TQA Section 9561, Effect of the Service Organization's Use of AI on SOC 1 and SOC 2 Examinations, AICPA, 11 September 2026 (public description only)
- AICPA Releases Guidance to Help Auditors Address the Use of AI in Financial Reporting and Auditing, 13 October 2026
- Auditors Meet Urgent Demand for AI Assurance with New Offering from AICPA and AIUC, 19 October 2026
- AICPA guides peer reviewers to address SOC 2 risks, Journal of Accountancy, 14 May 2026
- The SOC 2 AI Gap: Auditors Improvise Where AICPA Has Not Acted, Cloud Security Alliance AI Safety Initiative, 30 August 2026
- ISO/IEC 42001:2023, IEC webstore
- AI Act: regulatory framework for AI, European Commission