Summary

AI is showing up in production services faster than most SOC 2 reports can reflect. This white paper looks at when AI-related changes warrant a fresh look at SOC 2 scope, controls, and evidence, and which questions to raise with your auditor and AI vendors before the next examination period.

Inside, you’ll learn:

  • When AI use affects the in-scope service, and when it does not
  • What to document for each material AI use case
  • How AI maps to existing SOC 2 controls, including risk assessment, access, monitoring, change management, and vendor oversight
  • Why a provider’s model update can change your service even when your application has not
  • What due diligence questions apply to third-party AI providers
  • What evidence may support an AI-related examination, and why it depends on how AI is used
  • Where SOC 2 stops, and how ISO/IEC 42001 can complement it for broader AI governance

It’s written for organizations whose AI use is evolving, to support earlier conversations about scope and examination planning, rather than surprises during fieldwork.