SOC 2 AI refers to a SOC 2 examination of a system that includes artificial intelligence components. Management describes relevant models, training data, and third-party model APIs in the system description. The auditor evaluates that description against the environment and, in a Type 2 examination, across the review period.
When an independent CPA firm opens a SOC 2 engagement for a company whose product includes an AI model, the first document it scrutinizes is the system description. The SOC 2 system description is the auditor's map of what is in scope, what controls exist, and what can be tested. If an AI inference pipeline, a fine-tuned language model, or a third-party LLM API is missing from that map, the examination that follows is incomplete by definition.
The SOC 2 AI conversation in the industry has focused heavily on governance posture and policy checklists. The term SOC 2 for AI here refers to SOC 2 examination of a system that includes AI components.
Concern
A system description that omits AI models, training data, or third-party model APIs may not fairly present the system. The omission can affect the auditor's opinion and limit report users' understanding of system boundaries.
Overview
Management discloses AI components in the SOC 2 system description. The auditor compares those disclosures with the environment through inquiry, inspection, and observation. A Type 2 examination also considers changes during the period.
Solution
Organizations should define the AI system boundary precisely, classify LLM providers as subservice organizations or vendor dependencies, and document model-lifecycle controls that auditors can actually test. The auditor evaluates consistency between the description, in-scope controls, and selected Trust Services Criteria.
The System Description is the Object of the Examination
AICPA AT-C 320 defines the 'system' as the policies, procedures, people, infrastructure, software, and data that together deliver the service commitments and system requirements described in the report. The auditor evaluates the description against the Description Criteria and controls against the Trust Services Criteria. These are separate conclusions.
Fair presentation against the Description Criteria
The AICPA Description Criteria, DC Section 200, establish benchmarks for management's description. They address services, system components, boundaries, incidents, and changes. The SOC 2 system description must reflect the in-scope system.
The auditor checks whether the description accurately covers those elements. Every SOC 2 AI component within scope should fit into one of those five categories or be explicitly excluded with a rationale the auditor finds defensible.
What Type 1 and Type 2 change
A Type 1 examination evaluates fair presentation and control design at a specified date. A Type 2 examination evaluates fair presentation, control design, and operating effectiveness throughout the period. SOC 2 AI examinations therefore consider model versions, providers, and data flows over time.
AI Components the Auditor Expects Management to Disclose
An AI system definition helps identify a model, service, data resource, or procedure that forms part of the service system. The AI system definition also informs boundary testing. The SOC 2 system description explains material dependencies and relevant provider boundaries.
AI Component Disclosure Inventory
The auditor considers whether management's system description identifies AI components that form part of the in-scope system or affect its services, commitments, and system requirements. Depending on the implementation, relevant components may include:
- Models and model versions: Internal models, foundation models, and deployed versions.
- Training and fine-tuning data: Datasets that support model development or adaptation.
- Third-party model APIs: External providers and their role.
- Embeddings and vector stores: Data resources that support retrieval and model context.
- Prompts and system configuration: Relevant prompts, parameters, and configuration settings.
- Retrieval sources: Internal records, customer information, and external data sources.
- Human review procedures: Relevant approval, validation, and escalation activities.
- Provider data flows: Information transmitted to or received from external model services.
The items do not each require a separate control. In a SOC 2 AI examination, the auditor checks whether the description fairly presents relevant dependencies.
Where the Boundary Sits for Internal AI Use
Internal AI use matters when it affects the in-scope service, customer data, or control activities. The auditor considers data transfers and AI reliance.
Employee use of generative AI may involve vendor risk (CC9.2), information transmission (CC6.7), and internal policy communication (CC2.2).
An AI coding agent that modifies production code affects change management (CC8.1). The auditor examines authorization, review, testing, and deployment records. SOC 2 AI testing traces the change to an accountable approver. The SOC 2 AI review traces production changes.
How the Auditor Tests the Disclosure
The auditor may use methods including inquiry, inspection, and observation to evaluate management's disclosures. These procedures help establish whether the description reflects the actual system and its operation.
Audit Procedures for Evaluating AI Disclosures
Each procedure addresses a different aspect of the SOC 2 AI examination:
- The auditor may ask management and engineers about models, data, providers, and changes.
- The auditor may examine architecture diagrams, provider agreements, configurations, version histories, access records, and approvals.
- The auditor may observe model workflows and human approvals.
The auditor compares results with the SOC 2 system description. These SOC 2 AI procedures test whether provider disclosures match actual use. An omitted provider prompts investigation and evaluation of fair presentation.
Third-Party Model Providers As Subservice Organizations
An external model provider may qualify as a subservice organization when it performs services relevant to the system. Management may use the inclusive or carve-out method.
The inclusive method includes relevant aspects of the provider's system and controls. The carve-out method identifies the provider's services and related controls expected of it. The auditor checks whether the SOC 2 AI description reflects the arrangement.
The auditor examines provider agreements, SOC reports, and complementary controls. A provider's report covers its own scope, not the service organization's AI feature or configuration. For SOC 2 AI, the auditor checks whether the report covers the service used and whether complementary controls apply.
Alignment and Change During the Review Period
The SOC 2 system description must agree with in-scope controls, service commitments, and selected Trust Services Criteria.
Description, Controls, And Selected Criteria Must Agree
The auditor evaluates omitted components and controls that lack corresponding description disclosures.
Under the 2017 Trust Services Criteria, CC6.7 addresses information transmission, CC8.1 addresses system changes, and CC9.2 addresses vendor risk. C1.1 applies when confidentiality is in scope.
PI1.2 to PI1.4 may apply when commitments cover input, processing, or output accuracy, completeness, validity, or timeliness. AI use alone does not bring these criteria into scope. The AI system definition informs the auditor's understanding and helps identify boundaries; commitments determine applicable control objectives.
On October 28, 2026, the AICPA proposed Trust Services Criteria revisions with additional AI-related points of focus. Comments close January 15, 2027. Current engagements continue to use applicable current criteria.
Model And Provider Changes During A Type 2 Period
A model replacement, new provider, revised prompt, or new data flow can change the system during the period. A final-state description may not explain earlier configurations.
The auditor compares dated change records with the description. For a June provider replacement, the auditor checks coverage before and after using approvals and logs.
When a change affects boundaries, commitments, or controls, the auditor evaluates its effect on fair presentation. A material misstatement may require a modified opinion. SOC 2 AI testing considers relevant changes throughout the period.
Evidence the Auditor Examines for SOC 2 AI Components
-
Third-party model API
Evidence examined: Vendor risk assessment, data processing agreement, SOC report, subservice method
Related criteria: CC9.2
-
Data sent to providers
Evidence examined: Data-flow diagrams, transmission settings, retention terms
Related criteria: CC6.7, C1.1
-
Model and prompt versions
Evidence examined: Version history, approvals, release records
Related criteria: CC8.1
-
Training data
Evidence examined: Dataset inventory, access records
Related criteria: CC6.1
-
Employee AI use
Evidence examined: AI use policy, approved tools, acknowledgments
Related criteria: CC2.2, CC9.2
-
Output accuracy
Evidence examined: Validation records, exception logs
Related criteria: PI1.2 to PI1.4
-
AI incidents
Evidence examined: Incident tickets, investigation records
Related criteria: CC7.3, CC7.4
The table gives examples, not a universal mapping. Agreements show contractual terms; configuration records show provider use.
Conclusion
Omitting an AI component can obscure system boundaries, provider dependencies, and control responsibilities, affecting fair presentation.
In Type 2, the description must reflect relevant changes throughout the period. SOC 2 AI remains an examination under criteria, not a separate report category.
CertPro, an independent licensed CPA firm, examines management's description, system evidence, and applicable controls before expressing an opinion to users.
Preparing for a SOC 2 Examination?
CertPro is a licensed, independent CPA firm. Schedule a meeting with our auditors to confirm the system scope, evidence requirements, and examination period for your SOC 2 engagement.
