SOC 2 for AI companies: what actually changes

Nobody is coming to test your model. An auditor does not evaluate output quality, bias or eval coverage, because none of those are security criteria. A SOC 2 examination tests the controls in your description against the criteria in your scope,² and the criteria are one published document for every kind of company. That work on model behavior is real. It belongs to a different standard, covered at the bottom of this page.

The AICPA has started answering the AI question directly. It now publishes technical questions and answers on how a service organization’s use of AI affects SOC 1 and SOC 2 examinations.³ It is free to read with an AICPA account, and it is the closest thing to an official answer.

The model provider is a subservice organization

This one fact decides how the rest of your report reads. A subservice organization is a vendor whose controls your own service commitments depend on.⁴ If your product cannot do what you promised when the provider is down, or a mishandled prompt at the provider would breach what you told a customer, the provider is one.

There are two ways to treat it, and the description criteria cover both.⁴ The inclusive method brings the provider’s controls into your examination, with its own assertion and testing. The carve-out method names the provider, leaves its controls out, and states the controls you rely on it to run. No ten-person company negotiates the first one with a frontier lab. Carve out.

The carve-out has a price: written assumptions. Every control you rely on the provider for becomes a complementary subservice organization control in your description. How to word CUECs and CSOCs covers sentences that transfer something versus sentences that decorate. The sample report walkthrough shows a carve-out list in place.

What each provider publishes about its own report

A carve-out only works if you can show the provider’s report exists and that someone read it. Each of the four large providers says where to get one:

OpenAI

States that it has undergone a SOC 2 Type 2 examination of controls relevant to Security, Availability, Confidentiality and Privacy for its API and ChatGPT business products, and points to its trust portal for detail on its controls.⁵

Anthropic

Its trust center lists a Type 2 SOC 2 report, a SOC 3 report, an August 2026 bridge letter, and ISO 27001 and ISO 42001 certificates.⁶

Amazon Bedrock

Listed by AWS as in scope for its SOC 1, 2 and 3 reports, excluding Bedrock Marketplace.⁷ The reports themselves download through AWS Artifact.⁸

Google Cloud

Customers request Google Cloud’s SOC 2 reports through Compliance Reports Manager.⁹ Check that the model service you call is listed in the report’s scope.

Whichever you use, the vendor file needs the same four things: a dated assessment, the executed agreement, the provider’s current report, and a note naming who read it. A link to a trust page is none of those. Neither is a screenshot. A vendor management policy sets how often that review happens, and the request already sits on the evidence request list.

Prompts, outputs and training data are customer data

If a customer’s information goes into a prompt, the prompt is customer data. So is the output when it repeats or derives from that input. So is every log of either. Treat them exactly like the database rows they came from.

Under Security, that means access to prompt logs is restricted like production data, the call to the provider is encrypted in transit, and retention is a setting you can state. If you fine-tune on customer data, that is a use your agreement with the customer has to allow, in writing.

If your contracts promise confidentiality, the Confidentiality category is the one that tests it: identifying confidential information and disposing of it on schedule.¹ The scoping tool tells you whether a contract puts Confidentiality in scope. If it does, add it in the Polara GRC assessment or from your account settings until the engagement letter is signed or the audit is requested, and it goes into your report, your engagement letter and the examination.

Where a model provider lands in the criteria

The moment customer data leaves your infrastructure for somebody else’s inference endpoint, six criteria that were quiet get loud.¹

Not one of those is an AI control. Each is an ordinary control with a new object inside it, tested the usual way: population, sample, date, artifact. Pin model versions and route a deliberate version move through the same ticket and approval as a schema migration. Then the change population you hand over actually contains what changed.

The AI section of the security questionnaire

A published question set exists for this. The Cloud Security Alliance released its AI Controls Matrix in July 2025: 243 control objectives across 18 domains, mapped to ISO 42001, ISO 27001 and the NIST AI Risk Management Framework, with a questionnaire, the AI-CAIQ, for evaluating vendors.¹⁰ It is long. The six below are our plain-English selection: the questions a SOC 2 report and a vendor file can close.

ISO 42001, AIUC-1, and what we offer

ISO/IEC 42001 sets requirements for an AI management system, and was published in December 2023.¹¹ An accredited certification body issues that certificate. A SOC 2 will not produce it, and it will not produce a SOC 2. Two engagements, two timetables.

AIUC-1 tests something else again: the agent itself. The Artificial Intelligence Underwriting Company (AIUC) certifies one AI agent at a time, after running technical evaluations against it and having an auditor it has accredited review the controls.¹² The certificate covers that product, not the company.

On October 19, 2026 the AICPA and AIUC announced one engagement that produces both a SOC 2 report and an AIUC-1 certification.¹³ The overlap is real but partial. AIUC maps 45 of its 50 active requirements to at least one SOC 2 criterion, which means shared evidence, not coverage.¹⁴ The AIUC-1 guides explain how certification works and how it compares with SOC 2.

ISO 42001 readiness is live inside Constellation. Polara GRC prepares your AI management system for the audit, and a certification body accredited for ISO/IEC 42001 decides certification. We do not certify anyone. Calling a model provider does not change what a SOC 2 costs either: it changes your vendor file. If your product is an API that other developers build on, the guide for API companies covers the Availability decision and change evidence from pull requests.