ISO 42001 vs SOC 2: Which Does Your AI Company Need?

ISO 42001 vs SOC 2: Which AI Compliance Certification Do You Actually Need?

Last updated: 23 October 2026

Key takeaways

SOC 2 is not a certification but an attestation report from a licensed CPA firm under AICPA standards. ISO/IEC 42001 leads to a certificate from an accredited certification body.
SOC 2 answers whether a provider can be trusted with data and systems. ISO/IEC 42001 answers whether a company manages its AI responsibly.
SOC 2 has no criteria on training data, model bias, explainability or the impact of AI on people.
Neither of them gives a presumption of conformity under the EU AI Act.
A company that sells an AI product to large companies will probably need both, sooner or later.

Sooner or later, every company that builds or sells AI gets the same email from a large client or an investor: “Are you ISO 42001 certified? Do you have SOC 2?” The founders then ask us which one they need, often hoping the answer is “just one”. The honest answer depends on who is asking and why. These two documents look similar from a distance, but they answer very different questions.

First, a small correction: SOC 2 is not a certification

It is a common mistake, and it even appears in the title of this article, because that is how most people search for it. SOC 2 is an attestation report issued by a licensed CPA firm, an independent auditor, under the standards of the American Institute of Certified Public Accountants (AICPA). There is no certificate on the wall. Instead, you receive a report that describes your controls and gives the auditor’s opinion on them.

There are two types. A Type 1 report checks whether your controls are well designed on a single date. A Type 2 report also tests whether they actually worked over a period, usually three to twelve months. Large clients almost always want Type 2, because it shows how you operate in practice, not only on paper.

What SOC 2 actually checks

SOC 2 is built around five Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Only security is mandatory; the other four are chosen depending on what you promise your clients. In simple terms, SOC 2 answers one question: can I trust this provider with my data and my systems?

This is exactly why SOC 2 is not an AI standard. It was designed for any service organisation that handles client data, such as a cloud provider, a payroll platform or a SaaS tool. It has no criteria on training data, model bias, explainability or the impact of AI on people. An AI company can have a perfect SOC 2 report and still have no idea how its model makes decisions.

What ISO 42001 checks

ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system. It sets requirements for how an organisation that develops, provides or uses AI should establish, run and keep improving its governance of AI. Its Annex A contains 38 controls in nine areas, from AI policy and impact assessment to data quality, the AI system life cycle and relationships with third-party suppliers.

Unlike SOC 2, ISO 42001 does lead to a certificate. It is issued by an accredited certification body, and since 2025 these bodies have their own standard, ISO/IEC 42006, which sets the rules for how AI management systems must be audited. Like other ISO management system certificates, it is usually valid for three years, with surveillance audits in between. In simple terms, ISO 42001 answers a different question: does this company manage its AI responsibly?

Read more: ISO/IEC 42001 Certification Process: What It Actually Involves, Step by Step

Side by side

	SOC 2	ISO/IEC 42001
What you get	An attestation report	A certificate
Who issues it	A licensed CPA firm under AICPA standards	An accredited certification body
What it covers	Controls over security and, optionally, availability, processing integrity, confidentiality and privacy	How the organisation governs AI across the whole life cycle
AI-specific?	No	Yes
Who usually asks for it	Enterprise clients, especially in the US	Clients, partners and regulators interested in responsible AI, internationally
Legal effect under the EU AI Act	None	No presumption of conformity

Neither of them makes you compliant with the EU AI Act

This is the most important point, and the one we see misunderstood most often. Under the AI Act, only harmonised European standards published in the EU’s Official Journal give a “presumption of conformity”, meaning that following them is treated as meeting the law’s requirements. ISO 42001 is not one of them. Even its European version, adopted in March 2026, does not give this presumption. The harmonised standards for the AI Act are still being written, and the one on quality management is a separate European standard, not ISO 42001. SOC 2 has no legal effect in the EU at all.

That does not make ISO 42001 useless for the AI Act. Many of its controls, such as risk assessment, data governance and supplier management, overlap with what the Act requires. It is a good foundation. But a certificate on its own is not proof of compliance, and it should not be presented as one.

So which one do you need?

You sell software or cloud services to enterprise clients, especially in the US. Start with SOC 2 Type 2. It is often a condition for signing a contract, whether or not you use AI.
You build or deploy AI, and your clients, partners or regulators care how you govern it. ISO 42001 is the more relevant choice, particularly if you work internationally or prepare for the EU AI Act.
You sell an AI product to large companies. You will probably need both, sooner or later: SOC 2 to show that client data is safe, and ISO 42001 to show that your AI is under control.

If you already have ISO/IEC 27001 for information security, adding ISO 42001 is usually easier, because both standards share the same management system structure.

Not sure what your client or investor is really asking for? Send us their request, and we will tell you whether it calls for SOC 2, ISO 42001 or both.

What we recommend

Ask your clients and partners what exactly they require. Many requests for “AI certification” turn out to be a standard security questionnaire.
Choose the document that answers your market’s question: data security (SOC 2) or AI governance (ISO 42001).
Do not present either of them as proof of compliance with the EU AI Act.
If you plan both, build one set of policies and controls and use it for both audits.

FAQ

Is SOC 2 a certification?

No. SOC 2 is an attestation report issued by a licensed CPA firm under the standards of the American Institute of Certified Public Accountants (AICPA). There is no certificate: you receive a report that describes your controls and gives the auditor’s opinion on them.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report checks whether your controls are well designed on a single date. A Type 2 report also tests whether they actually worked over a period, usually three to twelve months. Large clients almost always want Type 2.

Is SOC 2 an AI standard?

No. SOC 2 was designed for any service organisation that handles client data. It has no criteria on training data, model bias, explainability or the impact of AI on people.

What is ISO/IEC 42001?

Does ISO 42001 make you compliant with the EU AI Act?

No. Under the AI Act, only harmonised European standards published in the EU’s Official Journal give a presumption of conformity, and ISO 42001 is not one of them, even in its European version. Many of its controls overlap with the Act, so it is a good foundation, but not proof of compliance.

Which one do I need, ISO 42001 or SOC 2?

If you sell software or cloud services to enterprise clients, especially in the US, start with SOC 2 Type 2. If you build or deploy AI and your clients, partners or regulators care how you govern it, ISO 42001 is the more relevant choice. If you sell an AI product to large companies, you will probably need both, sooner or later.

Is ISO 42001 easier to get if you already have ISO 27001?

Usually yes, because both standards share the same management system structure.

The bottom line

SOC 2 tells your clients that their data is safe with you. ISO 42001 tells them that your AI is managed responsibly. Neither one replaces legal compliance, but both can open doors to clients who would not talk to you without them. If you are not sure which one your business needs, or how they fit with the EU AI Act and local rules, AMLzone can help you choose the right path and prepare for it.

Asked for SOC 2 or ISO 42001 by a client?

We help you choose the right path and prepare for it.

Book a consultation AI Regulation EU

Sources

1. ISO, ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system. https://www.iso.org/standard/42001

2. Standards Council of Canada, “Transition to ISO/IEC 42006:2025”, August 2025. https://scc-ccn.ca/accreditation/bulletins/transition-isoiec-420062025-bodies-providing-audit-and-certification

3. Regulation (EU) 2024/1689 (AI Act), Art. 40. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

27.10.2026