SOC 2 Type II for AI Vendors: What the Report Actually Covers — and What It Does Not

See also (wiki): wiki/vendor-security-questionnaires.md, wiki/ai-vendor-contracts.md

Executive Summary

• SOC 2 Type II remains the de facto trust document for AI vendor procurement, but the AICPA has not added AI-specific criteria to its Trust Services Criteria. The framework still audits controls around data, not model behavior.
• Every major AI vendor now holds SOC 2 Type II — OpenAI (Jan–Jun 2025, Security/Availability/Confidentiality/Privacy), Anthropic (Claude APIs, ZDR endpoints, audit logging), Microsoft (Azure including Azure OpenAI), Google Cloud (Vertex AI), Salesforce (Einstein/Agentforce). Scope varies; consumer-tier products are generally excluded.
• The SOC 2 report answers “is the data secure?” It does not answer “is the model accurate, fair, grounded, or safe?” Those questions require ISO/IEC 42001 or a SOC 2+ examination that adds Annex A’s 38 AI-specific controls.
• Auditors in 2026 are flagging nine recurring gaps inside AI SOC 2 engagements — from model versions that aren’t in change management, to shadow AI usage bypassing vendor review, to undisclosed subprocessor chains routing data through downstream model providers.
• The practical implication for procurement: a SOC 2 Type II report is necessary but insufficient due diligence for any AI deployment touching regulated data. Read Section 4, check the scope, and ask for the ISO 42001 certificate.

What SOC 2 Type II Covers for an AI System

SOC 2 applies the same five Trust Services Criteria to an AI vendor that it applies to any cloud provider: Security, Availability, Processing Integrity, Confidentiality, Privacy. Most AI vendor reports cover four of these — Security, Availability, Confidentiality, Privacy — and omit Processing Integrity, the criterion most relevant to output correctness.

Within the Common Criteria, auditors in 2025–2026 are tightening expectations on five control families for AI systems:

Vendors that elect Processing Integrity add controls for output validation — RAG grounding, hallucination sampling, human review for high-stakes outputs, monitoring of accuracy drift.

What SOC 2 Does Not Cover

Per Linford & Co’s April 2026 guidance: “Auditors cannot provide reasonable assurance on the output of AI but can provide reasonable assurance on the controls around the AI.” A SOC 2 Type II report is silent on:

• Algorithmic fairness and bias. Auditors examine whether testing occurred, not whether results were fair.
• Hallucination rates. Auditors examine sampling procedures, not absolute accuracy.
• Training data provenance. Confidentiality and PII handling are covered; copyright, consent, and licensing of training corpora are not.
• Model safety and alignment. Entirely outside scope.
• Ethical use. Outside scope.

The AICPA’s Trust Services Criteria was last formally revised in November 2022, before the generative AI wave. The AICPA has issued nonauthoritative guidance acknowledging AI, but no AI-specific criteria have been codified into TSC 2017 (2022 rev.) or the SOC 2 Description Criteria.

Vendor SOC 2 Status as of April 2026

Consumer-tier products (ChatGPT Plus, Claude Pro individual, Gemini consumer) are generally out of scope. A vendor holding SOC 2 Type II on its enterprise tier says nothing about its consumer product — a distinction that matters when employees paste client data into a personal account.

Credibility note: these scoping summaries come from vendor trust portals and Big 4/national SOC 2 firms (Schellman, Baker Tilly, LBMC, Linford). Vendor trust portals are authoritative for their own scope but self-published. Always request the actual Type II report under NDA rather than relying on the portal summary.

The SOC 2+ with ISO 42001 Pattern

The emerging auditor-recommended path for AI-first vendors is a combined examination: SOC 2 Type II plus ISO/IEC 42001. Schellman, Baker Tilly, A-LIGN, and Coalfire now offer this as a single engagement.

ISO 42001 contributes 38 AI-specific controls in Annex A addressing:

• AI system impact assessments
• Data for AI systems (provenance, quality, bias testing)
• Responsible use policies
• Lifecycle management (development, deployment, retirement)
• Third-party AI supply chain

In a SOC 2+ report, ISO 42001 controls sit in Section 4 alongside the standard SOC 2 criteria. This is what a buyer evaluating an AI vendor for regulated workloads should ask for. OpenAI, Anthropic, and the major cloud providers all hold or are pursuing ISO 42001 as of April 2026.

Nine Gaps Auditors Are Flagging in 2026 AI SOC 2 Engagements

1. Model deployments bypassing change management (CC8.1)
2. No unique model version IDs traceable to training data and configuration
3. No documented bias/accuracy testing pre-deployment
4. Shadow AI usage — no DLP, no approved tool list, no OAuth audit
5. Prompt data retention policies undefined or contradicted by vendor defaults
6. Subprocessor list omits downstream AI model providers
7. No hallucination monitoring or output validation sampling
8. Training data lineage undocumented
9. RAG grounding controls absent for high-stakes outputs

Key Data Points

What This Means for Your Organization

Treat a SOC 2 Type II report as the floor of AI vendor due diligence, not the ceiling. The report tells you the vendor’s infrastructure is secure and their change management is disciplined. It does not tell you whether the model will hallucinate a client’s name into a contract clause, whether the training data included your competitor’s proprietary documents, or whether outputs will reproduce biased decisions at scale. Those are different questions — and SOC 2 was not designed to answer them.

Before a deployment touching regulated data (PHI, PII, material non-public information, privileged legal work), three documents should be on the table: the current SOC 2 Type II report (not the portal summary — the actual report under NDA, so you can read Section 4 and Section 5), the ISO 42001 certificate or gap analysis, and the DPA with its current subprocessor list. If the vendor cannot produce all three, the deployment is premature regardless of the tool’s capability.

If a specific vendor evaluation or contract review is on your near-term calendar and you want a second read on scope, gaps, or the ISO 42001 add-on — I’d welcome the conversation. brandon@brandonsneider.com.

Sources

• AICPA Trust Services Criteria (via EY summary, Nov 2022) — https://www.ey.com/en_us/technical/accountinglink/to-the-point-aicpa-revises-guidance-on-applying-its-trust-services-criteria-and-soc-2-description-criteria. Credibility: HIGH (authoritative framework).
• Schellman, “How to Incorporate AI Controls into Your SOC 2 Examination” (2025) — https://www.schellman.com/blog/soc-examinations/how-to-incorporate-ai-into-your-soc-2-examination. Credibility: HIGH (licensed SOC 2 auditor).
• Baker Tilly, “Evolving SOC 2 reports for AI controls” (2025–2026) — https://www.bakertilly.com/insights/ai-controls-for-soc-2-reports. Credibility: HIGH (top-10 accounting firm).
• LBMC, “Generative AI Risk Management with SOC 2” (2025) — https://www.lbmc.com/blog/generative-ai-soc-2/. Credibility: MEDIUM-HIGH (national SOC 2 firm).
• Linford & Co, “Shadow AI and SOC 2: How It Creates Audit Gaps” (2026) — https://linfordco.com/blog/shadow-ai-soc-2/. Credibility: MEDIUM-HIGH (boutique SOC 2 firm).
• OpenAI Trust Portal — https://trust.openai.com/ (accessed Apr 13, 2026). Credibility: HIGH for vendor self-attestation, but vendor-published.
• Anthropic Trust Center — https://trust.anthropic.com/resources (accessed Apr 13, 2026). Credibility: HIGH for vendor self-attestation, vendor-published.
• Microsoft Service Trust Portal — https://servicetrust.microsoft.com/ (accessed Apr 13, 2026). Credibility: HIGH, vendor-published.
• ISO/IEC 42001:2023 — AI management system standard, 38 Annex A controls. Credibility: HIGH (international standard).

Brandon Sneider | brandon@brandonsneider.com April 2026