Executive context
SOC 2 readiness does not end when the first report is issued.
A SOC 2 program is built around a defined service, systems, processes, vendors and controls. The environment may subsequently change.
- Customer-facing AI or AI agents are introduced.
- AI APIs and important providers enter the service stack.
- AI-assisted engineering becomes widespread.
- Automated AI workflows take consequential actions.
- AI begins operating or monitoring important controls.
The question is not whether AI automatically requires new controls. The question is whether your existing controls still address the risks created by how AI is now used—and whether you can prove it.
Control disposition
Start with the controls you already have.
Use one of five deliberate conclusions for each material AI-related risk. This avoids both underreacting and building a disconnected AI control set.
REUSE
The existing control already addresses the material AI risk.
MODIFY
The control exists, but its scope or operation should change.
NEW
A material risk is not adequately addressed by the current environment.
VALIDATE
The control may be sufficient, but current operating evidence must be confirmed.
N/A
The risk does not apply to the service or AI use case being reviewed.
The eight questions
Test whether the assurance picture still fits the service.
What important AI is now part of - or affecting - your SOC 2 environment?
You cannot assess coverage for AI you have not identified. Start with material use in the service, engineering, operations and third-party stack.
Strong signal
Important AI use cases are known, owned and mapped to relevant systems and processes.
Watch for
Teams adopting AI outside normal technology, change or governance processes.
Has your SOC 2 risk assessment explicitly considered that AI?
Material changes in how the service operates may change the risk picture. The review should connect each relevant AI risk to an accountable owner and operating control.
Strong signal
AI risks have been assessed and linked to accountable owners and existing controls.
Watch for
The current risk assessment predates significant production or customer-facing AI adoption.
Does your current SOC 2 documentation still describe how the service actually operates?
Current documentation should reflect material AI components, providers, dependencies and automated workflows that affect the in-scope service.
Strong signal
The system description and supporting documentation reflect material AI use relevant to the service.
Watch for
Customer-facing or production AI introduced after the current SOC 2 documentation was prepared.
Which existing controls already cover the risks created by AI?
Do not assume you need a separate AI control library. Identity and access, change management, vendor risk, incident response, monitoring, approvals and security testing may already address much of the risk.
Strong signal
AI risks are deliberately mapped to existing controls before new controls are proposed.
Watch for
Creating separate AI policies without connecting them to the controls that actually operate.
Which controls need to change because AI changed the risk?
A control may exist but need broader scope, a different approval, stronger technical enforcement, additional monitoring or updated evidence.
Strong signal
The organization can distinguish controls that can be reused from controls that should be modified.
Watch for
Treating an existing control as sufficient without checking whether it covers the changed workflow, data or authority.
Can you prove that your AI-related controls actually operated?
Policy describes what should happen. Operation is what actually happens. Evidence is what proves it happened - approvals, access records, change tickets, execution logs, alerts, vendor reviews and testing results.
Strong signal
Evidence is current, attributable, organized and retrievable without a last-minute reconstruction exercise.
Watch for
Controls that exist mainly in policy or rely on screenshots assembled just before an audit.
Have your important AI providers been reassessed?
Model providers, AI APIs, embedded AI vendors and AI infrastructure can introduce material data, security, availability, contract and downstream-service dependencies.
Strong signal
Material AI providers are included in normal third-party governance and reassessed when their role changes.
Watch for
An AI vendor being treated like just another SaaS subscription when it materially affects the service.
Could you explain and prove your AI governance story tomorrow?
An enterprise customer, board member, risk leader or assurance team may ask what AI you use, who owns it, what it can access and do, which controls apply, how high-impact actions are approved, how activity is monitored and what evidence exists.
Strong signal
Governance, technical control and evidence tell the same clear, consistent story.
Watch for
Different teams giving different answers or relying on a policy that does not match technical operation.
Executive self-check
What should you do next?
Use this as a directional leadership check, not a formal score. Choose the statement that best reflects the consistency of your answers.
MOSTLY YES
Your existing program may already provide a strong foundation.
Next: Validate that current scope, documentation and evidence remain aligned with material AI use.
SOME YES / SOME NO
You may have an assurance gap.
Next: Determine what can be reused, what should be modified, and where evidence needs strengthening.
MOSTLY NO / NOT SURE
AI adoption may have moved faster than the assurance program.
Next: Perform a structured gap assessment before the next reporting cycle.
Optional team copy
Want a copy for your team?
Download the 3-page executive PDF or have a copy sent to your inbox.
The browser guide is already yours to read. Details are requested only for PDF and email delivery.
Where do you need help?
Choose the next step that fits your situation.
Preparing for SOC 2?
SOC 2 Deal Readiness Assessment
Assess controls, evidence, business pressure and readiness.
Assess SOC 2 ReadinessNeed broader AI governance insight?
AI Governance Readiness Assessment
Assess ownership, risk, agent controls, oversight, monitoring and evidence.
Assess AI GovernanceAlready have SOC 2 and AI changed your environment?
SOC 2 AI Change Readiness Gap Assessment
Determine what current controls already cover, what should be modified, what needs validation and where additional controls or evidence may be required.
Review SOC 2 + AI ReadinessSOC 2 + AI Readiness Brief is educational and directional. It is not a SOC 2 examination, audit opinion, certification or legal assessment.