The AICPA, the American professional body for certified public accountants, published a draft of revised Trust Services Criteria on 28 October 2026. These criteria form the basis of every SOC 2 report. The draft reorganises the criteria and adds points of focus on artificial intelligence. Comments may be submitted until 15 January 2027. If adopted, the criteria will apply to audits whose period begins on or after 31 December 2027.
What SOC 2 is
A SOC 2 report is the result of an examination by an independent auditor. It confirms how a service provider safeguards the security and availability of its systems as well as the confidentiality and integrity of the data it processes. Type 1 assesses the design of controls at a specific date; Type 2 additionally assesses their effectiveness over a period.
SOC 2 originates in the USA but has long been in demand in Europe too. Software vendors and cloud services selling to American companies in particular are asked for it in tenders and vendor assessments. There is no certificate in the sense of ISO standards, but rather a report that the customer receives under confidentiality.
What is set to change
The current criteria date from 2017, and the explanatory points of focus were revised in 2022. The new draft retains the five familiar categories: security, availability, processing integrity, confidentiality and privacy. Within these categories, however, it makes substantial changes. According to the AICPA, overlapping criteria are merged, some criteria removed, others added for clarification, and existing wording rewritten so that its purpose is easier to recognise. The aim is to make SOC 2 reports clearer and more useful for readers.
Anyone who currently holds a SOC 2 report should therefore expect the mapping of their controls to the criteria to change. This mainly affects documentation, not necessarily the measures themselves.
New points of focus on AI
New points of focus cover artificial intelligence and other emerging technologies. The draft includes, among others:
- governance and accountability for AI systems within the organisation,
- ongoing monitoring of models,
- protection against manipulated inputs,
- protection against poisoned training data,
- traceability of AI-generated outputs,
- handling of training data,
- the risks of automated decisions.
Points of focus are not additional mandatory criteria. They help organisations and auditors assess whether a criterion is met. However, anyone using AI in their product or internal processes will need to explain these topics in the audit in future.
Timeline
| Step | Date |
|---|---|
| Publication of the draft | 28 October 2026 |
| End of comment period | 15 January 2027 |
| Applicability after adoption | Audits from 31 December 2027 |
Under the draft, early application of the new criteria is permitted. Until adoption, the 2017 criteria with the 2022 points of focus remain authoritative. Whether content or dates will change after the comment period remains open.
Relation to ISO 42001 and the EU AI Act
The topics of the new AI points of focus largely match what ISO 42001 requires for an artificial intelligence management system: responsibilities, risk assessment, data handling and operational monitoring. Anyone building an AI management system under ISO 42001 or preparing for the obligations of the EU AI Act thereby creates evidence that is also suitable for the SOC 2 audit. Conversely, a SOC 2 report replaces neither ISO 42001 certification nor compliance with legal obligations.
What this means for you
Nothing changes for ongoing SOC 2 audits for now. However, if you are planning your audit period for 2028, you should already take the new criteria into account:
- Read the draft and compare it with your current mapping of controls to criteria.
- Record where you use AI, both in your product and in internal processes, and who is responsible for it.
- Define how you monitor models and manage training data, and document it.
- Talk to your auditor early about whether early application makes sense.
- Use the comment period if individual points are unclear for your business model.
Sightadel takes you through SOC 2 control by control in a guided assessment, records tasks in action plans and stores evidence in the evidence archive, to which your auditor can have read access. Find out more on the SOC 2 page and the ISO 42001 page. You can try the platform free for 14 days.
As of: 5 November 2026 · Not legal advice. The standard or law in its current version is authoritative.
