SOC 2 for AI Companies: Type I vs Type II Explained
Last updated: 29 October 2026
Key takeaways
Key takeaways
- A SOC 2 Type I report covers whether controls are suitably designed as of a specific date. A Type II report also covers whether they operated effectively over a period.
- The AICPA does not prescribe a minimum Type II period, but for a period of less than two months the auditor may not obtain enough evidence. In practice, your clients set the minimum.
- For most clients, Type I is a promise that a Type II report is coming. Banks, insurers and other regulated clients usually expect Type II.
- None of the Trust Services Criteria is specific to AI. A clean SOC 2 report says nothing about bias, explainability or the quality of model outputs.
- If your product sends client data to an external model API, clients will look for that provider in your report as a subservice organisation.
For an AI company that sells to large clients, the SOC 2 question usually arrives at the worst possible moment: in the middle of a deal. The client’s security team asks for “your SOC 2 report”, and the founders discover that there are two types, and that the one they can get quickly is not always the one the client wants. A wrong choice here can delay a contract by months.
The difference between Type I and Type II
Both are examinations performed by a licensed CPA firm under the attestation standards of the American Institute of Certified Public Accountants (AICPA). A Type I report gives the auditor’s opinion on the description of your system and on whether your controls are suitably designed, as of a specific date. A Type II report covers the same ground and adds an opinion on whether the controls actually operated effectively over a period, together with a description of the auditor’s tests and their results.
Put simply, Type I is a photograph and Type II is a video. A photograph shows that the controls exist. Only a video shows that they work when nobody is preparing for an audit.
How long must the Type II period be?
There is no official minimum. The AICPA states that its SOC 2 guide does not prescribe one, and that the period is a business decision for management, based on what the report’s users need. It adds a warning, though: for a period of less than two months, the auditor may conclude that it cannot obtain enough evidence. In practice, the real minimum is set by your clients, so check their vendor requirements before you choose the period.
A Type II report also ages. The AICPA stresses that SOC examinations should be performed annually. A report whose period ended a year ago tells a client little about how you work today, and the gap between reports is usually covered by a letter from management, often called a bridge letter.
Which one does an AI company need?
- You need to close your first enterprise deal and have no history of operating controls. A Type I report is a reasonable first step: it shows that the controls are designed properly. But start the Type II period straight after it, otherwise you will face the same question again in a few months.
- You sell to banks, insurers or other regulated clients. Expect to need Type II. These clients must show their own regulators how they monitor vendors, and a design opinion on a single date rarely satisfies them.
The most common mistake is to treat Type I as the finish line. For most clients it is a promise that a Type II report is coming.
The report covers your system, not your model
SOC 2 is built on the AICPA’s Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always included; the others are chosen depending on what you promise your clients. None of these criteria is specific to AI. A clean SOC 2 report says that your infrastructure and processes are controlled. It says nothing about bias, explainability or the quality of your model’s outputs. In our view, processing integrity comes closest to what AI clients actually ask about, because it deals with whether processing is complete, accurate and authorised, but it is still not an AI standard.
The AICPA is aware of the gap. In September 2026, it published a technical Q&A on how a service organisation’s use of AI affects SOC 1 and SOC 2 examinations. In October 2026, it released exposure drafts of new Trust Services Criteria and Description Criteria, proposed for 2027. AI companies planning their next report should follow these drafts.
Your cloud and your model provider: subservice organisations
Most AI companies run on a cloud platform and call models from third-party providers. SOC 2 deals with this through subservice organisations. Their controls can either be included in your report (the inclusive method) or excluded (the carve-out method). The carve-out method is permitted, but your report must then identify the controls you expect the subservice organisation to have. The report also lists complementary user entity controls: the controls your clients must operate themselves, such as managing their own users’ access.
This is where AI companies are often caught out. If your product sends client data to an external model API, an experienced client will look for that provider in your report and ask what you rely on it to do. A report that does not mention the model provider at all raises more questions than it answers.
Be careful with “SOC 2 in two weeks”
In 2026, the AICPA openly warned about fast, template-based SOC 2 engagements. The chair of its SOC 2 working group said that “fast and easy” may come at the expense of quality and objectivity, and noted that tool providers that are not CPA firms cannot attest. In May 2026, the AICPA’s Peer Review Board told reviewers to treat reports with identical risk assessments, sample sizes and testing procedures as a sign of nonconforming work, and to check whether engagement timelines are reasonable. A report produced this way may be rejected by exactly the clients it was meant to impress.
What SOC 2 does not do
SOC 2 is a contractual and commercial tool, not legal compliance. It has no legal effect under the EU AI Act or the UAE data protection laws, and it does not show how you govern AI. For that, clients increasingly ask for ISO/IEC 42001 alongside it.
What we recommend
- Ask your key clients which type and which period they require before you engage an auditor.
- If you start with Type I, plan the Type II period immediately after it.
- Map your subservice organisations, including model providers, and decide whether to include or carve them out.
- Choose a licensed CPA firm and be sceptical of timelines that look too good to be true.
The bottom line
For an AI company, the choice between Type I and Type II is less about the audit and more about the client: Type I opens the conversation, Type II keeps the contract. Neither will answer questions about your model, but both will be read closely for how you handle your providers. AMLzone can help you decide which report you need, prepare for it and combine it with your AI governance framework.
Sources
1. AICPA & CIMA, SOC 2® Guide “Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy”, updated as of 15 October 2022. https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy
2. Journal of Accountancy (AICPA), “Service organization reporting”, July 2011. https://www.journalofaccountancy.com/issues/2011/jul/20103500/
3. AICPA, SOC 2® Examinations: Commonly Asked Questions, FAQ .05. https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/56175896-2011-04977-soc-2-commonly-asked-questions-final.pdf
4. Journal of Accountancy (AICPA), podcast “The risks of quick-turn SOC engagements and what CPAs should know”, April 2026. https://www.journalofaccountancy.com/podcast/2026/apr/the-risks-of-quick%E2%80%91turn-soc-engagements-and-what-cpas-should-know/
5. AICPA, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus – 2022). https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
6. AICPA, Technical Questions and Answers, Section 9561 “SOC Examinations: Effect of the Service Organization’s Use of AI on SOC 1 and SOC 2 Examinations”, September 2026. https://www.aicpa-cima.com/resources/download/tqa-section-9561-soc-examinations-effect-of-the-service-organizations-use-of-ai-on-soc1-and-soc2-examinations
7. AICPA, Exposure Drafts “Proposed 2027 SOC 2® Trust Services Criteria and Description Criteria”, 26 October 2026. https://www.aicpa-cima.com/resources/download/aicpa-exposure-drafts-proposed-2027-soc-2-trust-services-criteria-and-description-criteria
8. AICPA, SOC 2® Examinations: Commonly Asked Questions, FAQ .12; AICPA & CIMA, webcast “SOC 2® Report Walkthrough”. https://www.aicpa-cima.com/cpe-learning/webcast/soc-2-report-walkthrough
9. Journal of Accountancy (AICPA), “Promises of ‘fast and easy’ threaten SOC credibility”, February 2026. https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/
10. Journal of Accountancy (AICPA), “AICPA guides peer reviewers to address SOC 2 risks”, May 2026. https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/
29.10.2026
