SOC 2 · Last updated 28 September 2026 · 8 min read

SOC 2 for AI companies: what a model provider changes

An AI product sits for the same SOC 2 as any other software. The model provider moves which criteria get tested hard, and what proves them.

SOC 2 for AI companies is the same examination any software company takes. The AICPA criteria have no section on models.¹ What shifts is the weight on a handful of existing criteria once customer data leaves your stack for a model provider.

That provider becomes a subservice organization, your vendor file becomes the most read part of your evidence, and your data processing agreement ends up in front of buyers who read it line by line. None of it needs an AI specialist.

Start with scope, because it settles the rest

An auditor tests the controls in your system description against the criteria in your scope.² For a first report that scope is Security. It is the category a buyer means when they ask if you have SOC 2, and it is the only category we scope. The reasoning is laid out in the scoping tool.

Security does not test your model. Output quality, bias, hallucination rates and eval coverage are real concerns, but they are not security criteria, so no auditor will sample them. Security asks narrower questions: who can reach the data, where it goes when it leaves, how a change gets approved, and whether anyone noticed when something broke.

Governance of the AI itself has its own standard. ISO/IEC 42001 was published in December 2023 and describes a management system for artificial intelligence. An accredited certification body certifies it. A SOC 2 will not stand in for that certificate, and the certificate will not stand in for a SOC 2 when a buyer asks for one.

Six criteria a model provider puts under pressure

Every inference call that carries customer data crosses your system boundary. That single fact wakes up six common criteria.¹ Here is why each one matters and what to have on file before fieldwork.

Criterion	Why the provider matters here	Evidence to have ready
CC3.2 risk identification	A new exit route for customer data, which needs an owner on the risk register	A risk assessment dated inside the period that names the provider and the data it gets
CC6.1 logical access	The API key is a production secret like any other	The secrets manager entry and a record of its last rotation
CC6.7 restricted transmission	Data leaves the boundary on every call, so this is the center of the question	The data flow in the system description, encryption in transit, and the rule for what may enter a prompt
CC7.1 and CC7.2 monitoring	Prompt logs are a log source and also a second copy of customer data	The retention setting on prompt logs and a query that returns your oldest claimed record
CC8.1 change management	A provider can ship a new model version without touching your repo	A pinned version in config plus the ticket and approval for each upgrade
CC9.2 vendor risk	The provider is a subservice organization that has to be disclosed	The vendor assessment, the signed agreement, and the provider report with a dated read note

Look at the right column. None of it is exotic, because each row is a familiar control holding a new object, and it gets tested the familiar way: a population, a sample, a date and an artifact you can open. For the criteria in plain English, our Trust Services Criteria guide walks through all five categories.

Treat the provider as a subservice organization

A subservice organization is a vendor your own service commitments rely on.³ Ask two questions. Does your product stop doing what you promised when the provider is down, and would a mishandled prompt on their side break a promise you made to a customer? A yes to either question means the provider qualifies.

You can include it or carve it out. Inclusion means the provider joins your examination with its own assertion and its own testing, and a ten person startup will not get that from a frontier lab. So you carve out: name the provider, exclude its controls from the description, and state in writing what you assume it does.

Those assumptions are written as complementary subservice organization controls. Word them so a reader can see exactly what you rely on. Our page on wording CUECs and CSOCs shows a sentence that transfers a duty next to one that only fills space.

Three answers your vendor file needs

A model provider assessment turns on what happens to the text you send, not on the provider’s architecture. Record three answers, each tied to a document you can open.

Training on your inputs: Use the signed agreement or the data processing addendum it points to. A marketing page or a support reply is not evidence. Write the section number into the vendor file. If prompts carry customer data and the agreement says nothing about training, treat the gap as a finding and resolve it.
Retention at the provider: How long prompts are kept, in which region, and who on their side can read them. If you cannot state that period, you cannot give it to your own customer when they ask.
Their subprocessors: The provider has vendors too, and the one that counts is wherever inference physically runs. Region matters if you promised a customer data residency, so get the list and the notice terms for any change to it.

Keep all of it in the file. An auditor tests a dated assessment, the signed agreement, the provider report and a note naming who read it, and a link to a trust page is none of those. This is the same request that already appears on the auditor’s PBC list, and it reads the same for a model vendor as for a payroll vendor.

Pin the model version like any other dependency

Here is the one operational wrinkle that feels new. Your provider retires a version or pushes a point release, outputs shift, and nothing went through your change process on the way in. Behavior in production now has no approved change behind it, and that is what an auditor looks for when they pull your change population.

The fix is dull. Pin the version in configuration so an upgrade only happens when you choose it. Treat an upgrade like a schema migration, with a ticket, a reviewer and an approval before it reaches production. Then say so in your change management policy, because a policy that only covers your own deploys does not describe your real system. Our policy count page shows where that wording lives.

Decoding the AI section of a security review

Security reviews now carry a block of AI questions, and they are mostly about a vendor you do not control. Your report answers some of them and cannot answer the rest, so here is what each question is really after and the document that settles it.

What they ask	What they want to know	What you send
Which third party models do you use?	If there is an undisclosed data path	The vendor register and the system description that names the carved-out provider
Is our data used for training?	The training clause, both theirs and yours	The section number in the signed agreement, plus your own policy on fine tuning
How long are prompts kept?	If your retention promise holds at the provider	The provider’s stated period and your own prompt log retention setting
Can we turn AI features off?	If the data path is optional	The product setting, plus a CUEC if the customer has to flip it
What keeps sensitive fields out of prompts?	A control, not a promise	The redaction or allow list in code and a test showing it runs
Does your SOC 2 cover the AI features?	Scope and timing	The system description and the report period, read side by side

Answer the last question carefully

A report covers the system it describes, for the period it covers. A feature that shipped after the period closed is not in it, however good the feature is. Say that plainly on the form. A reviewer can check an overstatement against the report you sent them in about a minute.

What this costs, and what you can do yourself

None of the work above is AI specific, so it should not carry an AI surcharge. For context, here is what the outside routes cost according to the people who sell or track them.

Comp AI states that a vCISO or compliance consultant might charge $150 to $400 an hour, which can total $20,000 to $50,000 for a full SOC 2 prep engagement. Source, checked 2026-07-30.
Vendr reports a median annual contract value of $20,000 for Vanta, based on purchases completed through its marketplace. Source, checked 2026-07-30.

Much of this page is work a founder can do in an afternoon: pull the training clause, pin the model version, set prompt log retention, and add the provider to the risk register. Those cost time, not money. The part that needs paid help is the examination itself, and that has to be a licensed CPA firm. cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Our software is $199 a month, cancel any time, or $2,189 a year, pay for eleven months, get twelve. Audits go through our preferred pricing program, and we negotiate the fee on your behalf, and you see the price in your account before you book. A Type 2 is quoted after the 3-month observation window. Using a model provider changes none of those numbers. It only changes what goes in your vendor file.

Your next step

Find out where you stand before you spend anything. The free readiness assessment takes about 15 minutes and asks about vendors, access and change control, including the model provider. You get a score and a gap list you can work through yourself. When you are ready to compare plans, see pricing for the monthly and yearly options side by side.

Questions

Does an AI company need a different kind of SOC 2?

No. There is a single SOC 2 examination and the AICPA criteria behind it contain nothing specific to machine learning. An AI company is tested on the same security criteria as a payroll tool. The difference is in the facts: a model provider receives customer data, so vendor risk, data transmission and change management carry more weight.

Should the model provider be carved out of my SOC 2?

For a small company, yes. When your product depends on the provider to deliver what you promised customers, the provider is a subservice organization. Carving it out means you name it in the system description, leave its controls out of scope, and list the controls you rely on it to operate.

Will the SOC 2 report show whether my model provider trains on customer data?

Not on its own. The report covers your controls. The training answer lives in your vendor file: the clause in the signed agreement or data processing addendum, with its section number recorded in your vendor assessment so you can quote it to a reviewer.

Is switching to a new model version a change for SOC 2 purposes?

Yes, once it affects production. Your change management control covers every change to the production system, including one a provider ships. Pin the version in configuration and send each deliberate upgrade through the same ticket, review and approval path your code changes follow.

How does ISO 42001 relate to SOC 2?

They are separate. SOC 2 Security looks at access, data movement, change control and monitoring. ISO/IEC 42001, published in December 2023, is a management system standard for artificial intelligence, certified by an accredited certification body rather than examined by a CPA firm. Plan it as its own project.

Sources

TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers. Checked 1 August 2026.
Statements on Standards for Attestation Engagements AICPA. The attestation standards a SOC 2 examination is performed under. Checked 1 August 2026.
SOC 2 Report AICPA. What a SOC 2 report is and who may issue one. Checked 1 August 2026.

Get audit-ready without a compliance team

The readiness assessment is free, with no payment and no card. When you are ready, the software is $199 a month, cancel any time, and audits go through our preferred pricing program. You can be audit-ready starting at about a week.

Start with a free readiness assessment

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.