SOC 2 for AI companies
Enterprise customers want SOC 2 before they will adopt your AI product. Procurement teams are asking new questions about training data, model APIs, and inference logging that did not exist two years ago.
AI companies are facing a new wave of enterprise procurement scrutiny. Customers want to know who can access training data, how model outputs are logged, what happens when the model processes customer data, and who your downstream AI API vendors are.
Most of these questions map cleanly to existing SOC 2 controls. Access management, audit logging, vendor risk, and data classification all apply to AI workloads with minor adjustments. The teams that handle this well treat their AI stack as a first-class part of their SOC 2 scope from the start, instead of bolting controls on after a customer security review surfaces gaps.
AI-specific SOC 2 controls
Training data access controls
CC6.1 applies to training datasets the same way it applies to production data. Track who can read or write training data, enforce least privilege, and review access quarterly.
Model API vendor risk
CC9.1 covers every external model API. Maintain security attestations for OpenAI, Anthropic, Google, and any other inference providers, with documented data flow diagrams.
Audit logging of AI inferences
CC7.2 requires recording what data was sent to which model, when, and by whom. These logs power incident investigation and customer trust requests when something goes wrong.
Data classification before AI calls
Define which customer data classifications are acceptable to send to external models. Enforce the policy in code with a pre-call check, not just in a wiki page.
Acceptable use policy for AI
A documented policy covering employee use of public AI tools is now expected. Cover what data can be pasted, which tools are sanctioned, and what is logged.
Output monitoring
Detect and log unexpected or harmful model outputs. Auditors increasingly ask how you would know if a model returned customer PII or hallucinated a credential.
What enterprise customers are asking AI vendors
- •Do you have a current SOC 2 Type II report we can review under NDA?
- •Can you share the security assessments you performed on your AI API vendors?
- •Is customer data ever used to train your models, and if so, under what consent?
- •How do you prevent and detect prompt injection attacks against your product?
- •What is your data retention policy for inputs and outputs of AI API calls?
Frequently asked
Do AI companies need SOC 2?
Yes. Enterprise customers increasingly require SOC 2 Type II before adopting AI tools that process their data. It is fast becoming a baseline procurement requirement.
Are AI APIs like OpenAI and Anthropic in scope for SOC 2 vendor assessments?
Yes, as CC9.1 vendors. Both OpenAI and Anthropic publish SOC 2 reports you can request and file in your vendor risk register.
Does using AI in our product increase our SOC 2 scope?
Yes. It adds vendor risk controls for each model API, data classification rules, audit logging of inference calls, an acceptable use policy, and output monitoring controls.
What is the biggest SOC 2 gap for AI startups?
Vendor risk management. Most AI startups use ten or more AI APIs and have not formally assessed any of them. CC9.1 evidence is usually the first thing auditors ask for.
See also: SOC 2 overview and SOC 2 for AI startups
Start your AI compliance journey