SOC 2 for AI companies: what a model provider changes

Start with scope, because it settles the rest

An auditor tests the controls in your system description against the criteria in your scope.² For a first report that scope is Security. It is the category a buyer means when they ask if you have SOC 2, and it is the only category we scope. The reasoning is laid out in the scoping tool.

Security does not test your model. Output quality, bias, hallucination rates and eval coverage are real concerns, but they are not security criteria, so no auditor will sample them. Security asks narrower questions: who can reach the data, where it goes when it leaves, how a change gets approved, and whether anyone noticed when something broke.

The AICPA now speaks to the AI question directly. It publishes technical questions and answers on how a service organization’s use of AI affects SOC 1 and SOC 2 examinations.³ Reading it needs a free AICPA account, and it is the nearest thing to an official answer.

Six criteria a model provider puts under pressure

Every inference call that carries customer data crosses your system boundary. That single fact wakes up six common criteria.¹ Here is why each one matters and what to have on file before fieldwork.

Look at the right column. None of it is exotic, because each row is a familiar control holding a new object, and it gets tested the familiar way: a population, a sample, a date and an artifact you can open. For the criteria in plain English, our Trust Services Criteria guide walks through all five categories.

Treat the provider as a subservice organization

A subservice organization is a vendor your own service commitments rely on.⁴ Ask two questions. Does your product stop doing what you promised when the provider is down, and would a mishandled prompt on their side break a promise you made to a customer? A yes to either question means the provider qualifies.

You can include it or carve it out, and the description criteria allow both.⁵ Inclusion means the provider joins your examination with its own assertion and its own testing, and a ten person startup will not get that from a frontier lab. So you carve out: name the provider, exclude its controls from the description, and state in writing what you assume it does.

Those assumptions are written as complementary subservice organization controls. Word them so a reader can see exactly what you rely on. Our page on wording CUECs and CSOCs shows a sentence that transfers a duty next to one that only fills space, and the sample report walkthrough shows a carve-out list where it sits in a finished report.

Where each provider says its report lives

A carve-out only holds up if you can show the provider’s report exists and that someone on your side read it. The four large providers each say where to find theirs:

OpenAI

Says it has completed a SOC 2 Type 2 examination covering Security, Availability, Confidentiality and Privacy for its API and ChatGPT business products, and sends readers to its trust portal for control detail.⁶

Anthropic

Its trust center lists a SOC 2 Type 2 report, a SOC 3 report, an August 2026 bridge letter, and ISO 27001 and ISO 42001 certificates.⁷

Amazon Bedrock

AWS lists it as in scope for its SOC 1, 2 and 3 reports, with Bedrock Marketplace excluded.⁸ The reports download through AWS Artifact.⁹

Google Cloud

Google Cloud’s SOC 2 reports are requested through Compliance Reports Manager.¹⁰ Confirm the model service you call appears in the report’s scope.

Three answers your vendor file needs

A model provider assessment turns on what happens to the text you send, not on the provider’s architecture. Record three answers, each tied to a document you can open.

Training on your inputs

Use the signed agreement or the data processing addendum it points to. A marketing page or a support reply is not evidence. Write the section number into the vendor file. If prompts carry customer data and the agreement says nothing about training, treat the gap as a finding and resolve it.

Retention at the provider

How long prompts are kept, in which region, and who on their side can read them. If you cannot state that period, you cannot give it to your own customer when they ask.

Their subprocessors

The provider has vendors too, and the one that counts is wherever inference physically runs. Region matters if you promised a customer data residency, so get the list and the notice terms for any change to it.

Keep all of it in the file. An auditor tests a dated assessment, the signed agreement, the provider report and a note naming who read it. A link to a trust page is none of those, and neither is a screenshot. A vendor management policy sets how often that review happens. The same request already appears on the auditor’s PBC list, and it reads the same for a model vendor as for a payroll vendor.

Prompts and outputs are customer data

When a customer’s information goes into a prompt, the prompt is customer data. So is an output that repeats or derives from it, and so is every log of either. Handle them like the database rows they came from.

Under Security, that means prompt logs get the same access limits as production data, the call to the provider is encrypted in transit, and retention is a setting you can name. If you fine-tune on customer data, your agreement with that customer has to allow it, in writing.

If your contracts promise confidentiality, the Confidentiality category is what tests it: identifying confidential information and disposing of it on schedule.¹ cybersoftware scopes Security only, and that is fixed rather than a setting. The scoping tool tells you whether a contract puts Confidentiality in scope. If it does, a firm that runs that scope directly is the better route.

Pin the model version like any other dependency

Here is the one operational wrinkle that feels new. Your provider retires a version or pushes a point release, outputs shift, and nothing went through your change process on the way in. Behavior in production now has no approved change behind it, and that is what an auditor looks for when they pull your change population.

The fix is dull. Pin the version in configuration so an upgrade only happens when you choose it. Treat an upgrade like a schema migration, with a ticket, a reviewer and an approval before it reaches production. Then say so in your change management policy, because a policy that only covers your own deploys does not describe your real system. Our policy count page shows where that wording lives.

Decoding the AI section of a security review

Security reviews now carry a block of AI questions, and there is a published set behind many of them. The Cloud Security Alliance released its AI Controls Matrix in July 2025: 243 control objectives across 18 domains, mapped to ISO 42001, ISO 27001 and the NIST AI Risk Management Framework, with a vendor questionnaire called the AI-CAIQ.¹¹ It is long. The six below are our plain selection, the questions a SOC 2 report and a vendor file can actually settle.

ISO 42001 is a separate project

Governance of the AI itself has its own standard. ISO/IEC 42001 was published in December 2023 and sets requirements for an AI management system.¹² An accredited certification body certifies it. A SOC 2 will not stand in for that certificate, and the certificate will not stand in for a SOC 2 when a buyer asks for one.

cybersoftware does not offer ISO 42001. We cover SOC 2 only, so if a buyer asks for 42001, hire for it separately. If your product is an API that other developers build on, the guide for API companies covers the Availability decision and change evidence from pull requests.

What this costs, and what you can do yourself

None of the work above is AI specific, so it should not carry an AI surcharge. For context, here is what the outside routes cost according to the people who sell or track them.

• Comp AI states that a vCISO or compliance consultant might charge $150 to $400 an hour, which can total $20,000 to $50,000 for a full SOC 2 prep engagement. Source, checked 2026-07-30.
• Vendr, a software buying service, reports that the median buyer pays $20,000 for Vanta, based on data from 373 purchases. Source, checked 2026-10-02.

Much of this page is work a founder can do in an afternoon: pull the training clause, pin the model version, set prompt log retention, and add the provider to the risk register. Those cost time, not money. The part that needs paid help is the examination itself, and that has to be a licensed CPA firm.

Your next step

Find out where you stand before you spend anything. The free readiness assessment takes about 15 minutes and asks about vendors, access and change control, including the model provider. You get a score and a gap list you can work through yourself. When you are ready, see pricing for both ways to start.