SOC 2 Type I vs Type II for AI companies: what they are and how to get a report

Overview

Understand the CPA attestation process, Trust Services Criteria, system description, evidence period, exceptions, and the difference between a point-in-time Type I and period-based Type II report.

What it is

SOC 2 is an AICPA assurance engagement in which an independent CPA reports on controls relevant to selected Trust Services Criteria. Type I addresses design as of a specified date; Type II also tests operating effectiveness over a stated period.

Why it matters

AI vendors handle valuable prompts, customer data, model access, and critical workflows. Buyers use the restricted-use report to understand security governance, test results, exceptions, and dependencies before trusting the service.

How to obtain it or demonstrate compliance

1. Define customers, scope, system description, subservice organizations, and applicable Trust Services Criteria.
2. Perform readiness work, document controls, assign owners, and remediate gaps.
3. Choose an independent licensed CPA firm with relevant SOC and technology experience.
4. For Type I, prepare evidence as of the examination date; for Type II, operate and evidence controls throughout the period.
5. Support auditor sampling, walkthroughs, testing, exception analysis, management assertion, and representation.
6. Receive the final report, remediate exceptions, manage distribution, and plan the next examination.

What to review

1. Call it a SOC 2 report or examination—not a government certification.
2. Select security and any relevant availability, confidentiality, processing integrity, or privacy criteria.
3. Define the AI service boundary, infrastructure, model/API vendors, people, data, software, procedures, and complementary customer controls.
4. For Type I, identify the specified date; for Type II, define the review period and maintain operating evidence throughout it.
5. Read the auditor’s opinion, management assertion, tests, results, exceptions, subservice treatment, and report restrictions.
6. Share the confidential report under appropriate access controls and never claim systems outside its scope are covered.

What to do next

A Type I report can provide an earlier design snapshot; enterprise buyers often seek Type II evidence that controls operated over time. Only a properly licensed CPA firm can perform the SOC examination under the applicable professional standards.

Official sources and further reading

• System and Organization Controls: SOC Suite of Services — AICPA & CIMA