AICPA seeks feedback on proposed SOC 2 criteria update
AICPA proposes 2027 SOC 2 changes, with AI controls in the middle of the discussion
The AICPA is asking for public comments on proposed revisions to the SOC 2 Trust Services Criteria, with comments due by January 15, 2027. If approved, the revised criteria would apply to SOC 2 engagements beginning on or after December 31, 2027, although early adoption would be allowed.
That sounds distant. For a small business, it probably is. This is not a reason to buy new software this week or rebuild every policy you have. It is a reason to pay attention if larger customers already ask for your SOC 2 report, or if you expect those requests as your company grows.
What the proposed SOC 2 update would change
SOC 2 examines controls related to security, availability, processing integrity, confidentiality, and privacy. The AICPA’s SOC 2 Working Group says the proposed update is intended to make reports clearer and easier for users to understand.
The draft would combine overlapping concepts, remove criteria considered unnecessary, add requirements where more attention is needed, and standardize wording across the framework. The five familiar trust services categories remain, but the way controls are organized and described could change.
That matters because SOC 2 programs are built around evidence. A company may have a control matrix tied to current criteria, such as CC6.1. If the criteria are reorganized, the company and its CPA firm may need to remap controls, policies, tests, and collected evidence. The work is not necessarily harder. It can be different.
Why artificial intelligence appears in a SOC 2 proposal
The proposed points of focus address AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training-data management, and risks from automated decision-making.
Those terms may sound aimed at companies building large language models. They are not limited to that group. A software provider using an AI service to summarize customer records, classify claims, answer support questions, or make recommendations may face similar questions during a future examination.
Who approved the AI use case? What information can the tool receive? Who reviews its output? What happens when the system produces an incorrect answer? Can a user manipulate a prompt to make the system reveal data or take an unauthorized action?
These are sensible questions. They are also questions many small companies have never written down.
What this means for a 30-person company
If your company does not provide services to larger organizations and nobody asks for SOC 2, this proposal changes very little today. Do not spend a limited IT budget chasing a certification that your customers do not value.
If you are a 30-person software, accounting, healthcare, logistics, or professional services company that handles customer data, the situation is different. A major customer may not ask for the revised criteria immediately, but the request can influence sales, renewals, and vendor reviews well before the formal examination date.
The AI portion also exposes a common weakness. Employees often adopt useful AI tools before management decides what data may be entered, which accounts are approved, or how results must be checked. A future SOC 2 examination could make those informal practices harder to defend.
The proposed rules are not approved yet. Treat them as a warning about direction, not as a final checklist. The AICPA published exposure drafts for both the proposed 2027 SOC 2 Trust Services Criteria and the Description Criteria, and the language may still change.
What we would do before spending money
We would start with an inventory, not a new compliance platform. List every AI-enabled service that touches company or customer information. Include tools used by sales, support, finance, operations, and developers. Shadow use counts.
Then we would document four basic decisions for each tool. What data may enter it? Who may use it? Which outputs require human review? What happens to the data after processing?
Next, we would compare those answers with existing access controls, vendor reviews, incident procedures, backup practices, and employee training. If the company already has a SOC 2 program, we would ask the CPA firm which current controls may need remapping once the final criteria arrive.
We would not begin early adoption just because the option exists. Early adoption can create extra work while the market is still adjusting. A company with a customer deadline may have a good reason. Everyone else should first confirm that SOC 2 supports a real sales or contractual need.
Review your current customer requirements and AI tool list this quarter. If a SOC 2 request is likely within the next two years, IT911Now can help document the gaps before they become an expensive audit problem.