← All posts
·6 min read·The DecisionChain Team
SOC 2 for AI Systems: The New Questions in Trust Reports
SOC 2 wasn't written for machine learning. Auditors are adapting anyway. Here is what is showing up in reports now.
SOC 2 audits the operating effectiveness of controls against the Trust Services Criteria. AI systems introduce new questions inside the same framework.
Where AI shows up in a SOC 2
- Change management now includes model retraining, evaluation, and rollback.
- Confidentiality covers training data and prompts, not just customer records.
- Processing integrity extends to model outputs — did the system produce what it was supposed to, and can you show it?
What buyers ask beyond the report
Enterprise procurement teams increasingly attach AI-specific questionnaires to SOC 2 requests: how you log decisions, how you detect drift, how you handle model incidents. Prepare answers before the questionnaire arrives.