AICPA’s SOC 2 Proposal Cuts Criteria and Expands AI Coverage

Editorial Note: This working draft uses published analyses for the detailed criteria counts and mappings.

AICPA’s proposed 2027 SOC 2 Trust Services Criteria would reorganize the framework and expand its treatment of artificial intelligence. SOC2Auditors.org’s published comparison counts a reduction from 61 criteria to 50, including a drop in common criteria from 33 to 20. That gives the proposal practical significance for businesses whose control registers, evidence libraries, and audit preparation materials use the existing numbering.

The American Institute of CPAs announced the proposal on October 28, 2026. The changes address overlapping concepts and introduce more explicit treatment of AI risks. For organizations preparing for SOC 2, the work could include checking what each revised criterion covers, reviewing AI responsibilities, and confirming how continuity controls fit the examination’s scope.

Comments are due January 15, 2027. Subject to approval in 2027, the proposed criteria would take effect for engagements beginning on or after December 31, 2027, with early adoption permitted. The proposal remains open to revision, so teams can assess its implications while continuing work under the criteria applicable to their existing engagements.

What Would Change In The SOC 2 Criteria?

SOC2Auditors.org reports the following counts in its draft comparison. These figures count criteria, excluding points of focus and privacy section headings.

Its review also reports eight common-criteria groups, numbered CC1 through CC8. The current framework uses CC1 through CC9.

A lower count alone cannot demonstrate that an examination becomes easier or that a company needs fewer controls. A consolidated criterion can cover several activities, and one control can support multiple criteria. The useful comparison is between the substance of each requirement and the organization’s actual practices.

For background on how these categories fit together, see our guide to the SOC 2 Trust Services Criteria.

Why Does The Renumbering Matter?

A criterion number can acquire a different meaning in a revised framework. SOC2Auditors.org’s comparison reports two particularly consequential examples:

These are comparisons of reused identifiers. They do not provide a complete migration path for the controls currently mapped to those identifiers.

Consider a control register with an access-review procedure tagged only “CC6.1.” Copying that tag into a register for the proposed framework could imply that someone reviewed the procedure against a different requirement. Adding the framework version and criterion text makes the relationship easier to check.

Existing mappings would therefore need review. The extent of platform changes would depend on how a provider stores framework versions, maintains crosswalks, and handles migrations. There is insufficient evidence to claim that every compliance platform mapping would break.

What Could Change For Security Only Reports?

CGVantage’s published technical review, written by Director of Assurance Al Tanju, maps the business-disruption planning material from current CC9.1 to proposed Availability criterion A1.3. The review also notes incident-recovery coverage under proposed CC6.2.

That distinction makes report scope important. A business commissioning a security-only examination would need to discuss how its continuity commitments and recovery arrangements are addressed under the proposed framework. Availability coverage becomes a specific conversation to have with the CPA firm.

The reported relocation does not prove that every continuity-related obligation disappears from security-only examinations. Customer commitments, system requirements, and the remaining criteria can affect the controls relevant to a particular engagement.

For example, a software provider may promise customers that service can be restored within a defined period. Its readiness review can trace that promise to recovery procedures, test records, responsible staff, and the proposed examination scope. The reported move to A1.3 is a reason to revisit that analysis before selecting categories for a future report.

How Would The Proposal Address AI?

AICPA’s announcement lists expanded points of focus addressing AI governance, model monitoring, prompt manipulation, data poisoning, output transparency, training data, and automated decisions.

CGVantage’s analysis reports AI language under 17 criteria, including 12 common criteria, with no separate AI-specific criterion. That finding suggests AI considerations would appear throughout familiar control areas. It does not demonstrate that every SOC 2 engagement would use an identical AI testing program.

Criteria provide evaluation benchmarks. Points of focus explain characteristics relevant to applying those benchmarks; applicability depends on the system and its risks. AICPA’s existing guidance allows judgment in their use. A proposed point of focus therefore needs to be read in context before a team converts it into a control or evidence request.

The following examples illustrate readiness work arising from the announced AI topics. These examples are illustrative and do not reproduce procedures from the draft:

• Customer Support Agents: A support agent with access to account records could expose another customer’s information after a manipulated request. A review could examine access boundaries, retrieval permissions, test results, and escalation records.
• Training And Fine-Tuning Data: A team could examine who can alter a dataset, how changes receive approval, and which records connect a deployed model to the data used in its preparation.
• Model Monitoring: An unexpected output could be traced through detection, triage, corrective action, and retesting. That exercise helps determine whether responsibilities and evidence remain clear after deployment.

The examples apply differently to a business developing models and a business consuming a hosted AI service. Recording the service boundary, supplier responsibilities, and permitted uses provides a starting point for the discussion with the auditor.

Which Draft Details Still Need Careful Review?

AICPA’s exposure-draft resource page names both Trust Services Criteria and Description Criteria. As checked on November 5, 2026, its visible downloads listed a clean Trust Services Criteria draft and a redline. A separate Description Criteria draft was not visible on that page.

That limits what this article can say about proposed changes to system descriptions. The page listing alone cannot support a claim that both sets of proposed wording have been examined.

CGVantage also reports that guidance on applying the criteria to AI components remains under development. Further guidance could affect how practitioners interpret the proposed language.

SOC2Auditors.org reports a scope distinction: the proposed criteria address SOC 2 and SOC 3, while the 2017 criteria remain intended for SOC for Cybersecurity and SOC for Supply Chain. Its review also reports the absence of explicit COSO references and a shift to “those charged with governance.” Those observations warrant checking against the complete draft before drawing conclusions about changes to governance responsibilities.

When Would Organizations Need To Make Changes?

The proposed effective-date trigger is the beginning of an engagement. Planning therefore needs to connect the final transition language with the specific engagement agreed with the CPA firm.

Teams can begin a comparison now without overwriting the framework references supporting an examination already underway. A separate working register can capture proposed mappings, unanswered scope questions, and any operational changes that might be necessary.

AICPA continues to provide the 2017 Trust Services Criteria with revised 2022 points of focus. Final approval, transition provisions, and the engagement’s circumstances will determine the appropriate migration plan.

This criteria proposal also has a different purpose from the developments covered in our articles on AICPA’s attestation standards changes and the joint SOC 2 and AIUC-1 offering. Those articles provide related context; their announcements cannot confirm the contents of this exposure draft.

What Can SOC 2 Teams Do Now?

Preparation can focus on the specific uncertainties raised by the proposed reorganization:

1. Preserve Framework Versions: Keep the current criterion number, wording, control owner, and evidence references together. Record proposed mappings in separate fields so an old identifier cannot silently acquire a new meaning.
2. Review Continuity Scope: Compare service commitments and recovery objectives with the categories planned for the next examination. Bring the reported CC9.1-to-A1.3 change to the CPA firm for discussion.
3. Document AI Responsibilities: Record the AI components within the service, their data access, approved uses, monitoring arrangements, and supplier responsibilities. Use that inventory to determine which proposed AI language warrants closer review.
4. Submit Specific Consultation Feedback: Cite the draft passage, explain the operational ambiguity, and propose a clarification. Questions about reused identifiers, scope boundaries, and AI evidence can be more useful when supported by concrete examples.

How Can Bright Defense Help With SOC 2?

Bright Defense helps businesses prepare for SOC 2 through readiness assessments, risk reviews, policy development, remediation, and ongoing compliance support.

For teams evaluating the proposal, that work can include organizing existing control mappings, documenting AI use, reviewing continuity evidence, and preparing questions for the independent CPA firm. Keeping proposed changes separate from the active examination’s documentation helps preserve a clear record while the framework develops.

Our team can also help assign control owners and track evidence gaps, giving the business a practical basis for planning remediation and future audit preparation.

Explore our SOC 2 compliance services or contact Bright Defense to discuss your readiness priorities.

Sources

• AICPA — Proposed Criteria Update Announcement
• AICPA — Proposed 2027 Exposure-Draft Resource Page
• AICPA — TSP Section 100 And Guidance On Points Of Focus
• SOC2Auditors.org — Published Criteria Comparison
• CGVantage — Al Tanju’s Technical Review Of The Proposal