SOC 2 + AI Governance Attestation
A SOC 2 examination that tests your AI-system controls as additional criteria using objective control statements, either the CSA AI Controls Matrix where your system is eligible or management-defined control statements that reference the NIST AI Risk Management Framework, for AI products facing enterprise procurement.
- Criteria
- CSA AI Controls Matrix, or management-defined control statements referencing NIST AI RMF
- Report
- SOC 2 Type I or II with AI governance section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + AI governance?
AI-native SaaS
Your product is a model or an agent, and every enterprise deal now comes with an AI questionnaire on top of the security one.
Products adding LLM features
You shipped AI features into an existing platform and customers want to know how you govern training data, prompts and outputs.
Vendors to regulated buyers
Banks, insurers and health systems have model risk and AI policies that require evidence of oversight from their vendors.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section testing your AI-system controls against objective control statements: the CSA AI Controls Matrix where your system is eligible, or control statements management defines with reference to the NIST AI RMF functions Govern, Map, Measure and Manage
- Test results for AI-specific controls such as model inventory, training data provenance, human oversight, output monitoring and AI incident handling
- A summary written for AI vendor questionnaires
What it is not
Not an ISO/IEC 42001 certificate, which only an accredited certification body can issue. Not a model audit, a bias audit or a safety evaluation of what your model outputs. It is an independent CPA attestation over the governance controls around how you build, deploy and monitor AI, tested against objective control statements.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm which AI systems are in scope, whether the CSA AI Controls Matrix applies, and what your buyers’ AI questionnaires ask.
- 2
Control statements
You select the CSA AI Controls Matrix or define objective control statements referencing NIST AI RMF, and map your controls to them. We evaluate the statements and the mapping; both are management’s.
- 3
Examination
AI governance controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the AI governance section.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Enterprise AI questionnaires piling up?
Schedule a free 30-minute preliminary scope discussion and bring one. We will show you how much of it a SOC 2 + AI governance report answers.