FAQ: When should AI use be discussed with our SOC 2 auditor?

Bring it up when AI is part of the service being examined, supports an in-scope process, handles relevant information, or affects how a control operates. Explain the use case, provider, data flow, permissions, review steps, and evidence available. Internal use can matter even when customers never see an AI feature. For example, AI-assisted support or engineering may affect information handling or changes to the service. Do not wait for a new AI-specific criterion to ask the question. The auditor can evaluate the relevance to the agreed scope and discuss how the system description and testing should address it.

Related: SOC 2 audit and compliance hub.

Further reading: AICPA SOC 2 reporting guide overview; AICPA SOC resources.

Additional FAQs

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the

Can our SOC 2 auditor also help us prepare?

Some preparation assistance may be possible, but independence needs to be evaluated for the actual services and relationships. Ask the CPA firm to explain the permitted scope of help and

What makes a record useful as SOC 2 audit evidence?

A useful record shows what happened, when it happened, which system or activity it covers, and who performed or reviewed the work. Keep enough context to connect it to the

How should we review an AI vendor beyond its SOC 2 report?

Read the report's actual scope, then evaluate the AI service you plan to use. Ask about the data path, model providers, retention controls, training use, important configuration choices, and changes

Can we manage SOC 2 with spreadsheets and shared folders?

Yes, if the workflow is reliable and the records support the controls. Start with a control register, an evidence index, a calendar, and a restricted folder structure. Assign owners and

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide