How to Extend Your SOC 2 for AI
How to add AI controls to your SOC 2, and what to do next when buyers want more, from agent controls to AIUC-1 or ISO 42001.
How you approach AI is becoming a make-or-break part of security reviews.
In the last year we've seen the percentage of security questionnaires that ask about AI rise from 5% to close to 50% among customers we complete questionnaires for.
It can be tempting to assume that the answer to satisfying procurement teams' questions about AI is a new certification. But that's not the right fix for every business. And what I'm seeing is that buyers want a credible position on AI risk and evidence you're acting on it.
Most businesses I speak to have an existing SOC 2. From there, I think about extending your SOC 2 for AI in three levels:
- An AI governance baseline added to your existing SOC 2
- Agent-specific controls, such as Vanta's Agentic Trust Controls
- Independently tested assurance through AIUC-1 or ISO 42001
In most cases, you should start out with the first level and go further only as far as your buyers need. Here's how we think about each level at Workstreet, what it proves to a buyer, and how to pick the right combination for your company.
What Buyers Want to Know About AI Risk
SOC 2 is a gate to the enterprise, but it's not an all-access pass. Once you have a SOC 2 report, the enterprise market will start to open up. But now, buyers want to understand how your company is thinking about and acting on AI risk:
- Which tools you use
- Which models you build on
- How models touch customer data
- What data your models are trained on
- The role agents and humans play in your product or service
A SOC 2 Type 2 report can't answer those questions on its own. That's why AI questions are showing up more often in security questionnaires and procurement. That doesn't mean you necessarily have to race to complete a new attestation, though. What I'm seeing more often is that buyers are looking for a stated position.
Having an opinion is better than not having one. Even if it's “we've decided not to pursue an attestation from a third-party auditor because we don't think the market has converged on the right approach yet.”
Alongside your opinion, buyers still want to see the steps you're taking to reduce AI risk. An independent AI attestation is the strongest version of that evidence but it's not always where you should start.
The Three Levels of Extending SOC 2 for AI
Here are the three levels we look at when extending SOC 2 to cover AI:
Level 1: Add AI Governance Controls to Your SOC 2
Level 1 is an AI governance baseline we've developed for our clients at Workstreet. It's a set of controls that can be mapped to SOC 2 criteria to give clients a starting point for AI compliance.
Those six controls show a buyer that your company has documented AI policies and procedures, with risk reviewed on a schedule.
The controls also line up with where SOC 2 is (likely) heading. On October 26, 2026, the American Institute of Certified Public Accountants (AICPA) released proposed 2027 revisions to the SOC 2 Trust Services Criteria for public comment.
The AICPA says comments are due January 15, 2027, and the revisions would apply to engagements beginning on or after December 31, 2027, with early adoption permitted. Early reviews count AI-related points of focus across 17 criteria. Notably, the draft adds no AI-specific criterion, only points of focus.
What We're Adding to the Baseline Next
We're in the process of extending our AI governance baseline to cover where AI runs, what it can reach, and what happens when it changes or goes wrong. Here are some of the controls we're currently adding:
- An AI inventory with named owners: A register of every approved AI tool and use case, recording what it's for, who owns it, which provider and model sit behind it, what data it touches and which systems it connects to.
- AI provider review inside vendor management: Each AI provider gets reviewed before approval and again when its terms or settings change.
- Least privilege for AI tools, connectors and actions: AI tools get approved accounts, and connectors get only the access they need. That includes the actions an agent or integration is allowed to take, as well as the data it can read.
- A release gate for AI you build or configure: Before an AI feature ships or changes materially, the team documents its intended use and acceptance criteria, and checks representative failure and data-leakage cases. They also confirm what human oversight it needs and how to switch it off or roll it back.
- A quarterly review by the people who own each use case: They look at what changed (new tools, provider or model updates), what went wrong (failures, complaints, exceptions) and which fixes are still open, then record decisions with owners and due dates.
Level 2: Layer On Agent Controls With Vanta's Agentic Trust Controls
If you build AI agents, or let agents act on your systems, Level 2 adds agent-specific controls for what those agents can access and do.
Almost every company is using AI. But AI that answers questions and AI that takes actions carry different risks. If an agent takes in information, makes a judgment and then acts on it, each of those stages needs guardrails, in the same way we put guardrails around human workers.
Vanta's Agentic Trust Controls (ATC) is a published set of controls built specifically for agents. It covers 65 controls across 12 domains, delivered as two baselines:
- User baseline (22 controls): for companies that deploy agents built by others.
- Developer baseline (43 controls): for companies that build agentic systems.
The domains include agent identity and authority, tool use and action execution, human oversight under autonomy, runtime behavioral monitoring, and adversarial robustness and testing. Because it covers testing and runtime monitoring, ATC goes well beyond governing how your team uses AI internally. Runtime enforcement is still a gap for most companies, and that's where agent controls matter most.
ATC started as an open-source project with over 350 contributors in its first month. The controls are published at trustcontrols.ai, and Vanta has since built them into its platform.
ATC sits alongside your SOC 2. In Vanta's words, it “layers agent-specific controls onto frameworks you already hold,” and you get third-party evidence for it by declaring the controls in scope for your next ISO 27001 or ISO 42001 audit. Today that means the User baseline sits within ISO 27001 and the Developer baseline within ISO 42001. With SOC 2 alone, ATC is self-attested.
There's no ATC certificate of its own. ATC shows you've designed controls for your agents. I think of it as a ready-made set of AI criteria to hold yourself to, and it sets a clear bar for your agent controls without the cost of a full attestation.
Level 3: Get Independent Assurance With AIUC-1 or ISO 42001
Level 3 is for buyers who need a third party to verify your AI management and controls. Right now, that generally means pursuing ISO 42001 or AIUC-1. AIUC-1 tests a specific AI system on a recurring schedule. ISO 42001 certifies the management system around all of your AI. A certificate doesn't patch anything. Where ISO 42001 and AIUC-1 help is forcing ownership, detection expectations and evidence before an incident.
Our ISO 42001 vs AIUC-1 comparison goes deeper on the differences.
What Is ISO 42001?
ISO 42001 is the international standard for AI management systems (AIMS). It's the AI framework we see most often in questionnaires, and if you're building AI into your product, it's often the next step after SOC 2. AI-native companies like Clay have adopted it. If you've built in the Level 1 controls, you'll have a head start, because your AI policy, risk assessment and roles map to its clauses.
What Is AIUC-1?
AIUC-1 is a standard from the Artificial Intelligence Underwriting Company (AIUC). It covers six areas: data and privacy, security, safety, reliability, accountability, and society.
AIUC-1 is built around agentic security testing. AIUC runs quarterly technical evaluations against your agent, and an accredited auditor reviews your controls.
AIUC-1 is also getting easier to pair with SOC 2. Under the AICPA and AIUC offering announced on October 19, 2026, CPA firms can deliver both in a single engagement and report. It's in pilot with several firms now, with a full launch expected in early 2027.
When Is Independent AI Assurance Worth It?
Independent AI assurance (Level 3) makes sense when:
- Buyers or contracts require third-party proof of your AI.
- Your agents take consequential actions or make high-impact decisions.
- AI is the core of your product.
How to Pick the Right Approach for Your Company
Two questions decide which levels of AI assurance you need: what your AI does, and what proof your buyers demand.
Don't over-buy. For many buyers today, a SOC 2 with Level 1 or a clearly stated position on AI answers most of the AI questions. Climb when a buyer, a contract or the risk of your own agents calls for it.
Know Your Position Before a Buyer Asks
If you take one thing away from this, make it this: having an opinion on AI risk and compliance matters. For buyers, it shows how you're thinking about AI. For your team, it clarifies what action you need to take and when.
Once you've decided on your position and which controls (if any) you'll put in place, write it down. Cover what you've put in place, what you've decided not to do yet, and what would change your mind. Then share it with your team and add it to your trust center and questionnaire answer bank. If the controls are real, the answers follow, and everyone gives buyers the same one.
Revisit your position at least once a quarter, and again whenever you add AI to your product, your team starts using AI in new ways, or the standards evolve, such as when the 2027 Trust Services Criteria are finalized.
If you'd like help adding AI controls to your SOC 2 or working out which level fits your buyers, talk to our team.
