FAQ: How can we spot AI being added to a product we already use?

Have the product owner check for AI changes in:

Release notes and security notices.
Updated terms and subprocessor information.
Account settings and newly available features.

Ask the vendor and internal users whether AI has been added, whether it is enabled by default, and what information it can use. Update your inventory with where the feature is used and who enabled it.

These checks improve visibility but cannot guarantee you will find every change. If data use is unclear, seek clarification before expanding use.

Additional FAQs

Can we manage SOC 2 with spreadsheets and shared folders?

Yes, if the workflow is reliable and the records support the controls. Start with a control register, an evidence index, a calendar, and a restricted folder structure. Assign owners and

What should we check when a vendor shares an AIUC-1 certificate?

Check which organization and AI system are covered, the applicable standard version, the assessment dates, and the certificate's current status. Ask for enough supporting information to understand the evaluation and

What are the SOC 2 criteria?

The five SOC 2 categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Not every SOC 2 report covers all five categories. Read the report to see which categories and

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

What controls matter when an AI agent can take actions?

Start by limiting the actions the agent is allowed to take and the systems it can reach. Use an identifiable account, narrow permissions, and approval steps for sensitive or difficult-to-reverse

What should we settle before asking for SOC 2 audit quotes?

Start with a short scope brief. Name the service customers use, the legal entity providing it, the systems supporting it, and the report customers expect. Include your target delivery date,

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide