SOC 2 applies to an AI company the same way it applies to any service provider: the Trust Services Criteria are technology-neutral, and the report covers the security of the service and the data in it. What changes is the scope. Model providers usually become subservice organizations, customer prompts and outputs are customer data, and buyers add questions about training on their data, retention at the model layer, and how model changes are controlled. SOC 2 does not assess how an AI system behaves, which is what ISO/IEC 42001 and the EU AI Act address, so AI companies selling to enterprises often end up with SOC 2 for security and ISO 42001 for AI governance. The AICPA's 2027 draft adds AI points of focus across the criteria.
An AI product goes through the same SOC 2 examination as any other SaaS product. The difference is in what the system contains: external model providers, data that flows into prompts and back out, and a component that can change behaviour without a code change. Scoping those clearly is most of the work.
Model providers as subservice organizations
If your product calls a hosted model, that provider performs part of your service and is a subservice organization. Most reports carve it out: the provider's controls are not tested, and the description lists the controls you assume it operates. Collect the provider's own assurance reports, record its terms on data retention and training, and review them as part of vendor management. The guide to subservice organizations covers carve-out and inclusive treatment.
Customer data in prompts and outputs
- Prompts, retrieved context, outputs and any embeddings built from customer content are customer data, and the system description should say where each is stored and for how long.
- Access to that data, including by your own staff for debugging or evaluation, falls under the same access controls as the rest of the system.
- Retention and deletion apply to logs of prompts and outputs as well as to the primary data.
- If customer data is ever used to train or fine-tune a model, that is a commitment to state plainly, and one buyers will ask about first.
Model and prompt changes are changes
Swapping a model version, changing a system prompt or updating a retrieval pipeline can change what the product does as much as a code release. Put them through change management: a record of the change, review, testing against your own evaluation set where you have one, approval and a way back. The 2027 exposure draft makes the same point in its points of focus for change management.
What buyers ask AI vendors
| Question | Where the answer lives |
|---|---|
| Is our data used to train models? | Your service commitments in the system description, and your contracts |
| Which model providers process our data, and where? | Subservice organizations and data locations in the description |
| How long are prompts and outputs kept? | Retention controls and the description of data |
| Who can see our prompts? | Access controls, with logging and periodic review |
| How are model changes controlled? | Change management controls |
| How is AI behaviour governed? | Outside SOC 2: an AI governance programme, often aligned to ISO 42001 |
SOC 2, ISO 42001 and the EU AI Act
SOC 2 answers whether the service and the data in it are secure. It does not assess bias, accuracy, transparency or the risks an AI system poses to the people it affects. ISO/IEC 42001 is a certifiable management-system standard for AI governance, and the EU AI Act sets legal obligations that depend on the system's risk class and your role as provider or deployer. The ISO 42001 framework page and the EU AI Act framework page cover both.
Getting ready for the 2027 criteria
The AICPA's 2027 exposure draft keeps the criteria technology-neutral but adds points of focus on AI and automation across almost every series, from access for automated agents to change management for models. The article on the 2027 criteria covers what is changing, and the guide to SOC 2 for AI agents covers agents with access to production systems.