← All posts
·5 min read·The DecisionChain Team
Building SOC 2 Evidence Packs for AI Controls
Evidence packs decide whether a SOC 2 auditor moves quickly or asks fifty follow-ups. Here is how to assemble one for AI.
An evidence pack is the auditor-ready bundle for a single control. Great packs are boring, small, and self-contained.
What goes in
- A one-paragraph description of the control.
- The system(s) that enforce it.
- A time-bounded sample: log slice, ticket export, or query result.
- A signed manifest so the sample cannot be quietly replaced later.
For AI-specific controls
For model change management: the deployment log, linked evaluation results, and the approval record. For decision logging: a random sample of decisions with their chain hashes and a verifier run against them. For incident response: the log slice, the impact assessment, and the customer communication.
A tamper-evident decision log makes half of these packs generate themselves.