You added AI to your product
Customer-facing AI, copilots, AI agents, recommendation engines or other AI now influence the service your customers use.
Paid diagnosticSpecialized Trust Gap Diagnostic
Already have SOC 2? Make sure AI hasn’t changed the assurance picture.
If your product, engineering workflows, operations or vendors now use AI, your existing SOC 2 program may need another look. We assess what changed, determine what your current controls already cover, and identify what should be updated or validated before your next reporting cycle.
Assess AI Governance ReadinessScoped paid engagement · Investment confirmed after the readiness discussion
This is for you if
This assessment is designed for teams that already have SOC 2—but whose environment has changed.
Engineering or operations now rely on AI
AI-generated code, AI-assisted operations, automated support or security automation may affect how existing controls operate.
You added important AI providers
Model, API or embedded AI providers now support the service but were not part of the previous SOC 2 environment.
Your next SOC 2 cycle is approaching
You want to identify material changes before your service auditor, customer or procurement team raises them.
Customers are asking AI questions
Your current SOC 2 report does not fully answer new questions about AI governance, oversight or operating evidence.
Why this matters
Your SOC 2 program may be mature. Your environment may have changed.
A strong SOC 2 program gives you an important assurance foundation. But when the service changes, the assumptions behind the risk assessment, controls, system documentation and evidence may also need to be revisited.
01 · Before
Established SOC 2 program
The program reflects the product, systems, vendors and operating processes that existed when scope and controls were designed.
02 · Change
AI enters the environment
AI is introduced into the product, development lifecycle, operations, decision-making or third-party stack.
03 · Question
Does the assurance picture still fit?
Do the existing risks, controls, system description and evidence still cover how the service works today?
04 · Gap assessment
Make the right disposition
Determine what can stay, what needs updating, what needs validation and what genuinely needs to be added.
What we assess
Six workstreams connect the AI change to the current assurance baseline.
01
AI Relevance & Scope
Identify where AI materially affects the product, systems, vendors or processes relevant to the SOC 2 environment.
Client outcome
AI-to-SOC 2 scope map
02
Current SOC 2 Baseline
Review relevant current-state materials, including the report where appropriate, system description, control matrix, risk assessment, procedures, architecture and vendor information.
Client outcome
Current assurance baseline
03
Risk & Control Gap Analysis
Compare material AI risks with the controls already operating in the SOC 2 program.
Client outcome
Control disposition matrix
04
Evidence Readiness
Determine whether credible evidence shows that the relevant controls actually operate in the changed environment.
Client outcome
Evidence readiness matrix
05
AI Change & Third-Party Review
Assess whether material AI changes and important AI providers move through appropriate existing governance processes.
Client outcome
AI change and third-party findings
06
Remediation Roadmap
Prioritize what should be addressed, validated or evidenced before the next assurance cycle.
Client outcome
Prioritized remediation roadmap
Control disposition methodology
We do not assume AI means “add more controls.”
The goal is to make sure the right controls still cover the right risks—and that you can prove it. We determine what the current SOC 2 program already handles well and where AI has genuinely changed the risk or evidence requirement.
REUSE
The existing control already addresses the risk.
Example: Your identity and access process already applies appropriately to AI administrative access.
MODIFY
The control exists, but its scope or implementation should be updated.
Example: Vendor risk exists, but it does not yet address important AI-provider considerations.
NEW
A material AI risk is not adequately addressed by the current environment.
Example: A high-impact autonomous workflow needs a reliable way to pause or stop execution.
VALIDATE
The control may be sufficient, but operating evidence must be confirmed.
Example: Change management covers AI releases, but current operating evidence is incomplete.
N/A
The risk does not apply to this environment or use case.
The conclusion is recorded so teams do not add controls that do not solve a real risk.
What you leave with
You leave with decisions—not another generic checklist.
Each work product is tied to a decision, an owner and the next assurance cycle. The assessment does not issue an audit opinion or guarantee that an independent CPA firm will accept every conclusion.
- AI-to-SOC 2 scope assessment
- Current-state assurance gap analysis
- Control disposition matrix
- Evidence readiness assessment
- Prioritized findings
- 30/60/90-day remediation roadmap
- Executive readout
- Clear implementation path
- Auditor-ready handoff support where appropriate
Where it fits
A specialized configuration of the Trust Gap Diagnostic.
Free scorecards provide a directional signal. This paid assessment resolves the specific SOC 2 + AI question. Implementation and ongoing operations remain separate decisions.
01 · Free signal
SOC 2 or AI Governance Readiness Assessment
Clarify the pressure and likely gap.
02 · Paid diagnostic
SOC 2 AI Change Readiness
Determine what changed and make the control disposition.
03 · Implementation
Enterprise Trust Accelerator
Remediate priority controls and evidence gaps.
04 · Ongoing operations
Managed Trust Operations
Keep controls, changes and evidence current.
What this is
- A readiness and gap assessment
- An assessment of how AI changes the current SOC 2 environment
- A way to identify control and evidence changes before the next reporting cycle
- Preparation for independent assurance
- Implementation-oriented
What this is not
- A SOC 2 audit or CPA opinion
- A certification or guarantee of a clean report
- A generic AI-policy review
- A claim that the existing SOC 2 report is invalid
- An assumption that every AI use requires brand-new controls
When this may not be the right assessment
Use the path that matches the question you actually need answered.
You are preparing for your first SOC 2 report.
Start with the broader SOC 2 Deal Readiness path.
Take the SOC 2 Readiness AssessmentYou need a broader review of AI governance.
Use the AI Governance path for oversight, identity, monitoring, evidence and agentic controls beyond SOC 2 scope.
Explore AI Governance ReadinessYou only need an independent SOC 2 opinion.
EK Treasure performs readiness and implementation. Independent examination remains with the service auditor or CPA firm.
Discuss the appropriate handoffFrequently asked questions
The practical questions first.
Because the environment may have changed since the controls and system description were designed. The assessment determines whether material AI changes are already covered or whether anything should be updated before the next reporting cycle.
Start with the changed environment
Your SOC 2 program may already be strong. Let’s determine whether AI changed what it needs to cover.
We will clarify the change, the in-scope systems and the smallest useful assessment path before any engagement is scoped.