SOC 2 Explained: Trust Services Criteria and the Proposed 2027 AI Changes

SOC 2 is the other certification a finance, healthcare or legal buyer asks suppliers for, and it works on a completely different basis from ISO 27001. There is no certificate and no certification body. A SOC 2 report is an attestation: a CPA examines the controls at a service organisation against a defined set of criteria and issues a report with an opinion. The buyer reads the report rather than checking a register.

It is also about to change substantially, and the proposal landed this week.

The five trust services categories

A SOC 2 examination evaluates controls relevant to one or more of five categories: security, availability, processing integrity, confidentiality and privacy. The criteria are established by the AICPA’s Assurance Services Executive Committee, and the set currently in force is the 2017 Trust Services Criteria with revised points of focus issued in 2022.

Most reports in circulation address security alone, or security plus one or two others. That matters when reading a supplier’s report: a SOC 2 covering only security says nothing about availability or privacy, and the scope is a choice the service organisation made, not a standard.

Two report types, and the difference is the whole point

Reports come in two forms. A Type 1 addresses the design of controls as at a point in time — whether the controls, as described, are suitably designed. A Type 2 addresses operating effectiveness across a period, testing whether the controls actually worked over months rather than existing on paper on a single day.

A Type 2 is the one with assurance value. A buyer accepting a Type 1 as evidence of operational control has accepted a design document. Any procurement process that asks for SOC 2 without specifying the type, the categories and the period covered has not really asked for anything.

What the AICPA is proposing to change

On 28 October 2026 the AICPA issued exposure drafts proposing updated SOC 2 Trust Services Criteria and Description Criteria, describing the proposal as a significant modernisation of the framework CPAs use to evaluate controls over information systems.

The timetable, if approved:

• Public comment runs through 15 January 2027
• The 2027 criteria would apply to engagements beginning on or after 31 December 2027
• Early adoption is permitted

Structurally, the proposal would merge overlapping concepts, remove some criteria, add new ones where more clarity is needed, and revise existing wording for consistency. The AICPA’s stated aim, in the words of its vice president of assurance and advisory innovation, Pawlicki, is that the revisions “improve the usability of SOC 2 reports”.

The AI provisions are the substantive change

The part that matters most to anyone planning training or governance is the new points of focus on artificial intelligence. The proposal would introduce coverage of:

• AI governance
• Model monitoring
• Prompt manipulation
• Data poisoning
• Transparency of AI-generated outputs
• Training data management
• Risks from automated decision-making

The AICPA’s rationale is that the criteria need to stay relevant as artificial intelligence, automation and other emerging technologies alter third-party risk considerations.

Read that list against a typical finance or healthcare organisation’s current control environment and the gap is obvious. Prompt manipulation and data poisoning are not concepts most internal audit functions have tested, and transparency of AI-generated outputs is not a control most firms have documented. This is the second major framework this year to put AI assurance on a formal footing — the EU’s draft GMP Annex 22 does the same for medicinal product manufacture — and the direction is consistent: AI use is becoming an auditable control domain rather than a technology choice.

SOC 2 and ISO 27001 are not alternatives

Firms routinely treat the two as competing options. They overlap substantially in control content — the AICPA itself publishes a mapping of the 2017 Trust Services Criteria to ISO 27001 — but they answer different questions and suit different buyers.

ISO 27001 certifies a management system against an international standard, through a certification body accredited under International Accreditation Forum rules. It is a recurring certificate with a defined scope, and it travels well internationally. See our guide to what ISO 27001 requires of your people for the clause-level detail.

SOC 2 produces a detailed report, including the service organisation’s own system description, the auditor’s tests and the results. It is read rather than displayed, usually under NDA, and it is the North American market’s default expectation.

Organisations selling into both markets commonly need both, which is why the mapping exists. The practical sequencing question is which the firm’s largest buyers ask for first.

Why regulated buyers care

For finance, healthcare and legal organisations the demand usually comes from outsourcing. If a service organisation processes client data, handles transactions or hosts systems, the regulated firm remains accountable for the outcome and needs evidence the control environment works. A Type 2 report covering a relevant period is the cheapest credible evidence available, which is why it has become a standard condition of supply.

It follows that reading these reports competently is a professional skill, not a procurement formality. Knowing which categories are in scope, whether exceptions were noted, how the period relates to your contract term, and what the complementary user entity controls require you to do, is the difference between holding assurance and holding a PDF. Board-level ownership of that question is covered in our guide to board cyber governance and audit committee oversight, and our CPD course library covers the audit and control disciplines underneath it.

Frequently asked questions

Is SOC 2 a certification?

No. It is an attestation examination performed by a CPA against the Trust Services Criteria, resulting in a report containing an opinion. There is no certificate and no certification body, which is the structural difference from ISO 27001.

Which trust services categories should a report cover?

That depends on the service. Security is common to almost all reports; availability, processing integrity, confidentiality and privacy are included according to what the service organisation does and what its customers need assurance over. Always check which categories a given report actually addresses.

Type 1 or Type 2?

Type 2 for assurance about operation. A Type 1 addresses the design of controls at a point in time; a Type 2 tests operating effectiveness over a period. A Type 1 is sometimes a reasonable first step for a new service, but it is not evidence that controls worked.

When do the new criteria take effect?

If approved as proposed, the 2027 criteria would apply to engagements beginning on or after 31 December 2027, with early adoption permitted. Comment on the exposure drafts is open through 15 January 2027.

Will the AI criteria apply to firms that do not build AI?

The proposed points of focus address matters such as AI governance, automated decision-making and transparency of AI-generated outputs, which can arise from using third-party AI tools rather than developing models. Any service organisation whose controls involve automated decisions should expect the question.