SOC 2 Does Not Cover Your Vendor's AI Yet
The criteria a CPA firm examines against today are the 2017 Trust Services Criteria, and nothing in them was drafted with a model in mind. On October 26, 2026 the AICPA put a revision out for comment that adds points of focus on AI governance, model monitoring and data poisoning. Comments close January 15, 2027, and the earliest a report in your hands reflects any of it is 2028.
A vendor sends you a SOC 2 report because you asked whether their platform is safe to put your customer records through. If that platform now runs an AI model somewhere in the middle of it, there is a question the report was never built to answer, and the AICPA has just proposed to fix that. The fix is a draft, the comment window is open, and the earliest it could reach a report you receive is 2028.
That gap between "proposed" and "in your hands" is the whole of what a buyer needs to understand here, so it is worth being precise about both ends of it.
What the criteria in force actually cover
The version a CPA firm examines against today has a name with dates in it: "2017 Trust Services Criteria (With Revised Points of Focus – 2022)", issued by the AICPA's Assurance Services Executive Committee. Nothing in that title is about machine learning, and nothing in the five categories was drafted with a model in mind. We cover what a SOC 2 report is, what Type I and Type II mean, and what the scope section does and does not promise in SOC 2 explained for buyers; this article assumes that and goes to what is changing.
Be careful about the inference, though. A current report is not silent about a vendor's AI because the criteria forbid it. It is silent because the criteria were written to be technology-neutral and the scope of any given examination is set by the service organization, not by the criteria. A vendor can already bring AI systems into the scope of a SOC 2 examination. Most descriptions do not say either way, which is exactly why reading the scope section beats reading the badge.
What the AICPA has proposed
On October 26, 2026 the AICPA published exposure drafts. The resource page states it plainly: "The AICPA Assurance Services Executive Committee (ASEC) has issued exposure drafts of proposed revisions to the Trust Services Criteria (TSC) and Description Criteria (DC) used in SOC 2 examinations." The document on offer is titled "Proposed 2027 SOC 2 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy", with a redlined version alongside it.
Read that title twice if you are worried about a wholesale change. The five categories are still there, in the same order, in the name of the proposal itself. The AICPA describes the shape of the work as housekeeping plus additions: the "updates include targeted restructuring of the criteria, including consolidating duplicative concepts, removing criteria where appropriate, adding new criteria where greater clarity or emphasis is needed, and revising existing criteria language to provide concise and uniform understanding of the intention of each criterion."
The part that is about AI
The AI content arrives as points of focus rather than as a separate category. "At the same time, the exposure draft incorporates expanded considerations for emerging technologies, including AI." The list the AICPA gives is specific enough to be useful to a buyer:
"For example, new points of focus address issues such as AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and the risks associated with automated decision-making."
The stated purpose is assessment rather than certification: "These additions are designed to help organizations and auditors evaluate whether controls effectively address the growing risks introduced by advanced technologies." The AICPA's vice president of assurance and advisory innovation, Amy Pawlicki, frames the motive as catching up: "The way organizations manage and process information and identify risk has changed substantially over the past decade," she said.
Points of focus are not criteria. In the structure the AICPA uses, a point of focus is an example of what an organization might do to meet a criterion; an examination is against the criteria. So the honest reading is that the proposal would give an auditor and a vendor a shared vocabulary for AI risk inside an existing framework, not a new AI audit.
The dates, which are the practical part
Two dates matter and they are far apart.
Comments first: "The AICPA’s SOC 2 Working Group is seeking public comment on the exposure draft through Jan. 15, 2027." That window is open as this is published, which means nothing in the draft is settled.
Then adoption, and this is the sentence to keep: "If approved next year, the proposed 2027 SOC 2 Trust Services Criteria would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted."
Follow that through to a report on your desk. A Type II examination covers a period rather than a moment, so an engagement that begins after December 31, 2027 runs to a window that closes later still, and the report is written after that. Add those three steps to the date in the proposal and the arithmetic lands in 2028 at the earliest, and later for anyone whose engagement starts further into the year. "Early adoption permitted" is the only route to seeing one sooner, and it is a choice your vendor makes, not a date you can rely on.
Nothing. A report issued in 2026 was examined against the 2017 criteria, and that remains true however the exposure draft turns out. A vendor who tells you their SOC 2 "covers AI" is making a claim about the scope their own description set, not about the criteria.
What to ask, now rather than in 2028
The useful questions do not depend on the proposal passing, which is what makes them worth asking today.
Is any AI system inside the scope of your current examination? This is answerable from the description section of the report you already have. If the system description does not mention the model, the inference pipeline or the vendor behind it, the examination did not look at them.
Do you plan to early adopt the 2027 criteria? A vendor who has an answer to this has read the exposure draft, which itself tells you something. A vendor who has not heard of it is telling you something too.
Which third-party AI providers are in your system description? If your vendor calls a model API from somewhere else, that provider is a subservice organization, and how the report treats it — carved out or included — changes what was examined. That distinction exists under the current criteria and does not need the proposal to matter.
Will you share the full report, not the badge? The standing answer in this business, and the reason the scope section is worth more than the logo.
What we have not done here
We have not read the exposure draft PDFs. Everything above comes from the AICPA's own resource page and news announcement, read on November 3, 2026, and the quotes are from those two pages. The proposal may change between now and any approval, and it may not be approved. A separate description criteria document is named in the title of the resource page; the files listed on that page when we read it were the trust services criteria and its redlined version.
Nor are we going to tell you what the new criteria will require. They are a draft, the comment period runs until January 15, 2027, and an article that summarizes a draft as though it were a standard is the kind of thing a buyer later quotes back to a vendor and gets corrected on.
The Bot Desk publishes information, not legal advice. We are not a law firm and nothing here creates an attorney-client relationship. Audit scope, contractual audit rights and regulatory obligations turn on facts specific to your business, and you should consult a qualified attorney licensed in your state before relying on any of this for a decision.