Proposed SOC 2 Trust Services Criteria Updates: What You Need to Know
The AICPA has proposed the first major overhaul of the SOC 2 Trust Services Criteria since 2017. Read on to learn key dates for the proposed updates, what could change, and what your team should do today.
Key facts
The draft: dated October 27, 2026 by the AICPA ASEC SOC 2 Working Group and announced October 28. Exposure draft only.
Comments due: January 15, 2027
Proposed effective date: engagements beginning on or after December 31, 2027, if issued as final. Early implementation would be permitted. That depends on final approval, which the AICPA has said could come in 2027.
Who it affects: SOC 2 and SOC 3 engagements.
Key takeaways
- AI is addressed through points of focus, not new criteria. There is no standalone AI criterion and no new category. Instead, AI-specific guidance appears under 17 criteria.
- Points of focus on unsanctioned AI tools and AI agent access (CC5.1 and CC5.3) may be relevant to any SOC 2, whether AI is part of your product or not.
- If AI is used in your system or product, expect more Processing Integrity conversations. New points of focus address AI in system inputs, processing, and outputs.
- Many points are conditional. Some apply only in certain situations, such as when an entity has the ability to train an AI model, so scoping judgment will matter.
Proposed changes: consolidated criteria, new numbering
The draft’s goal is to reduce complexity by combining similar criteria, remove unnecessary criteria, add new criteria for clarity, and revise language.
The common criteria, which make up the full Security category, would shrink from 33 criteria across nine criteria (CC1–CC9) to 20 criteria across eight (CC1–CC8). While some criteria have been removed, the changes mostly mean criteria have been consolidated within remaining criteria or absorbed into the points of focus. Organizations should still expect those controls to remain relevant in their audits.
Here’s a look at the proposed changes:
| 2017 series (current) | Proposed 2027 draft |
| CC1–CC4 (Control Environment, Communication and Information, Risk Assessment, Monitoring Activities) | Carry over with the same numbers and fewer criteria in each. CC2 is renamed Information and Communication. |
| CC5 Control Activities | Eliminated as a series. Policy deployment becomes a point of focus under CC2.1. The “CC5” label is reused for Logical and Physical Asset Protection. |
| CC6 Logical and Physical Access | Becomes the new CC5, Logical and Physical Asset Protection. |
| CC7 System Operations | Becomes the new CC6. |
| CC8 Change Management | Becomes the new CC7, split into three criteria. |
| CC9 Risk Mitigation | Eliminated as a series. Vendor risk becomes the new CC8. Business disruption has no standalone criterion. |
At the criterion level:
| 2017 criteria (current) | Treatment in the proposed 2027 draft |
| CC9 Risk Mitigation (series) | Series eliminated. CC9.2 (vendor and business partner risk) becomes CC8.1. |
| CC9.1 Business disruption | No standalone common criterion. Resilience content now sits mainly in the Availability category (A1.3, A1.4), with incident-recovery plan testing under CC6.2. |
| CC5.1–5.3 Control Activities | No standalone series. Policy deployment now appears as a point of focus under CC2.1. The CC5 label is reused for asset protection. |
| CC1.2, CC1.3, CC1.5 Board oversight, structure and authority, accountability | No standalone criteria. Folded into points of focus under CC1.1 and CC1.2 (for example, Objective Oversight and Establishes Roles and Responsibilities). |
| CC2.1–2.3 Information quality, internal and external communication | Condensed into CC2.1 and CC2.2, with internal and external communication combined. |
| CC3.3, CC3.4 Fraud risk, assessing changes | No standalone criteria. Now points of focus (Fraud Risk Considerations in CC3.2; framework recalibration in CC3.3). |
| CC4.1–4.2 Evaluations, communicating deficiencies | Merged into a single criterion, CC4.1. |
| CC6.1–6.8 Logical and physical access | Regrouped into CC5.1–5.5. Encryption is elevated to its own criterion (CC5.5). |
| CC7.1–7.5 System operations | Condensed into CC6.1–6.2. Vulnerability and configuration monitoring moves to CC5.6. |
| CC8.1 Change management | Expanded rather than removed: split into three criteria (CC7.1–7.3) by infrastructure, acquired software, and internally developed software. |
Is AI addressed in the proposed changes?
There is no standalone AI criterion, but it does appear throughout the proposed changes and would show up across the TSC if finalized.
AI appears in the introduction, the background paragraphs, and as points of focus under 17 criteria, with the heaviest concentration in CC5, CC6, CC7, and processing integrity.
Points of focus are the AICPA’s guidance beneath each criterion. The criterion says what a control environment should achieve, and the points of focus list characteristics that help management and the auditor judge whether controls are suitably designed and operating effectively. They are not controls and they are not requirements. Here’s a look at the proposed AI language throughout the TSC:
| Location | Page | What it addresses |
| Introduction (second objective) | 3 | Modernizing the criteria for emerging technologies, with AI singled out for autonomous decision-making, reliance on large datasets, and challenges with transparency, explainability, and monitoring. The working group added points of focus specific to emerging technologies and AI. |
| Background, para .04 | 4–5 | The criteria are outcome-based and apply regardless of technology. AI-related competencies are considered under CC1.2. Additional guidance for systems with AI components is a placeholder, marked as under development. |
| CC1.2 | 14 | Considers Changes in Technologies: AI impacts on technical competency training. |
| CC2.2 | 15 | Communication of Emerging Technology Operational Considerations; User Awareness of AI-Generated Outputs |
| CC3.2 | 16–17 | AI-driven insights as a risk identification input; AI Risk Considerations (training data manipulation, adversarial inputs, model misuse, bias, prompt manipulation, data poisoning). |
| CC3.3 | 18 | Risk Management Framework recalibrated for AI risks such as model drift, lack of explainability, and inadequate validation data. |
| CC5.1 | 19 | Access control structures consider AI agents and robotic process automation; periodic review of AI accounts that don’t need access. |
| CC5.3 | 21 | Restricts Unsanctioned Technology Use (AI platforms); Detects Unauthorized Software (AI tools and models). |
| CC5.6 | 23 | Vulnerability scans using traditional and AI-enabled techniques; Mitigation of Attacks on AI Platforms (prompt injection, jailbreak chaining, data poisoning). |
| CC6.1 | 24 | Detection of malicious prompts; Monitoring AI Components (drift, bias amplification, unexpected outputs); Detection of Anomalous Model Behavior or Outputs. |
| CC7.1 | 27 | Patch and vulnerability management informed by AI-enabled techniques. |
| CC7.2 | 28–29 | Changes to Data Affecting AI Components (training and fine-tuning data); Detection of Vulnerabilities and Adversarial Inputs. |
| CC7.3 | 30–31 | Same two points of focus as CC7.2, applied to internally developed software. |
| CC8.1 | 31 | Evaluation of Third-Party Components, including AI models, APIs, and plugins. |
| A1.1 | 33 | Protects Against Resource Exhaustion, such as excessive API calls or AI prompts that degrade availability. |
| PI1.1 | 38 | AI and Machine Learning in System Inputs (data quality, lineage, and authorization). |
| PI1.3 | 39 | AI and Machine Learning in System Processing (pre-deployment validation, bias testing, revalidation). |
| PI1.4 | 39 | AI and Machine Learning in System Output (output monitoring, drift detection, human review or override). |
| P4.1 | 44 | Protects Personal Data in AI Systems: personal information is not improperly retained or exposed by AI models. This point applies only to engagements that include the Privacy category. |
What’s not changing
Although there may be changes to the TSC, the ultimate goal of SOC 2 doesn’t change: protecting your organization’s valuable information. Other constants include:
- The criteria are still outcomes-based and don’t prescribe specific controls.
- Each Points of Focus still does not require a specific control.
- Security is still covered by the common criteria alone, and the five categories remain.
- The 2017 criteria stay in place for SOC for Cybersecurity and SOC for Supply Chain.
What to do now
Your organization doesn’t need to rebuild its compliance program today. But, staying aware of proposed changes and how they could impact your organization can keep you from falling behind.
We recommend you use this time to:
- Stay in close contact with your auditor. Keeping up with the latest guidance from your auditor and the industry can help prevent your organization from slipping out of compliance before audit season. Lean on these experts.
- Inventory your AI use. Include the tools nobody formally approved. The draft calls out restricting and detecting unsanctioned AI platforms, and you can’t do either without knowing what’s in use.
- Extend access reviews to AI. CC5.1 points to AI agents and AI accounts, including accounts that no longer need access. Make sure your periodic access reviews cover them.
- Extend security awareness training to cover AI usage. CC1.2 points to AI’s impact on technical competency training, including changes in technologies. Make sure your training keeps pace with how AI changes the skills your team needs.
- Review vendor and AI third-party oversight. With vendor management becoming its own criterion (CC8.1) that names AI models, APIs, and plugins, expect closer looks at how you evaluate and monitor them.
- Revisit your scope. If AI is part of your product, ask your auditor whether Processing Integrity belongs in your SOC 2. The draft’s AI points of focus on inputs, processing, and outputs (PI1.1, PI1.3, PI1.4) live there.
- Consider commenting. Comments are due January 15, 2027. If a proposed change would be hard to operate in practice, this is the moment to say so. Practical feedback on how the new AI points of focus would work day-to-day is especially useful while the AICPA’s AI application guidance is still under development.
- Watch for the AI application guidance. The AICPA’s additional guidance for systems with AI components is still under development. It will shape how these points of focus are applied.
Why A-LIGN
A-LIGN is the #1 SOC 2 issuer in the world with over 13,800 SOC 2 audits completed and over 200 SOC auditors globally. Our team’s deep expertise and commitment to quality means your organization doesn’t just check the box on compliance, but creates a strategy that stands up to scrutiny. Contact us today to get started.
Support for your compliance journey
