Free executive brief · 3 pages
Already have SOC 2 and now use AI?
8 questions to answer before your next SOC 2 report.
Use this practical executive brief to identify whether recent AI adoption may have changed your risk, control, evidence or assurance picture.
Read the 3-Page BriefScope the change
Identify which AI use is material to the in-scope service.
Test control coverage
Separate controls to reuse, modify, add or validate.
Check the evidence
Ask whether operation can be proved without reconstruction.
Inside the brief
Determine whether the SOC 2 assurance picture still fits the service.
AI may not require a new control library. The first task is to determine what current controls cover, what needs modification, what needs validation and where a genuinely new control may be required.
What important AI is now part of—or affecting—your SOC 2 environment?
Has your SOC 2 risk assessment explicitly considered that AI?
Which existing controls already cover the risks created by AI?
Can you prove that your AI-related controls actually operated?