FAQ: What should we check when a vendor shares an AIUC-1 certificate?

Check which organization and AI system are covered, the applicable standard version, the assessment dates, and the certificate's current status. Ask for enough supporting information to understand the evaluation and any relevant limitations. AIUC's published overview describes annual renewal and ongoing technical testing at least quarterly; verify what applies to the vendor's actual certification. Then compare the assessed use with the way your organization plans to use the product. A current certificate can inform vendor review, but it does not remove your responsibility to configure access, handle data appropriately, and monitor the service in your environment.

Related: SOC 2 audit and compliance hub.

Further reading: AIUC-1 certificate overview.

Additional FAQs

How should we review an AI vendor beyond its SOC 2 report?

Read the report's actual scope, then evaluate the AI service you plan to use. Ask about the data path, model providers, retention controls, training use, important configuration choices, and changes

How do we keep recurring SOC 2 tasks from being missed?

Create a calendar from the actual controls, not from a generic monthly checklist. Include the owner, backup, due date, evidence required, and escalation contact for each recurring activity. Add event-driven

What are the costs of SOC 2?

SOC 2 cost depends on the system scope, report type, reporting period, and work needed before the examination. Budget separately for the CPA firm’s fee, any readiness advice, optional software,

What makes a record useful as SOC 2 audit evidence?

A useful record shows what happened, when it happened, which system or activity it covers, and who performed or reviewed the work. Keep enough context to connect it to the

How do we know when spreadsheets are no longer enough?

Look for repeated failures in coordination, not just team size. Warning signs include broken evidence links, unclear ownership, conflicting versions, missed reviews, and excessive time reconciling records. Measure where the

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide