SOC 2 is getting its first major rewrite since 2017. Here's what Autenix customers should do now
The AICPA has proposed a 2027 update to the SOC 2 Trust Services Criteria. It would consolidate overlapping criteria, give vendor management more weight, and add AI-specific points of focus. Nothing changes for your next audit yet, but the timeline is short enough to plan around.
/Autenix/3 min read
What happened
On October 26, 2026, the AICPA's Assurance Services Executive Committee released exposure drafts of revised Trust Services Criteria and Description Criteria for public comment. The AICPA announced the proposal on October 28. Its stated aim is to make SOC 2 reports clearer and more usable as AI, automation and other technology change third-party risk.
"The way organizations manage and process information and identify risk has changed substantially over the past decade," said Amy Pawlicki, AICPA vice president of assurance and advisory innovation.
This is a draft, not a standard. Today's reports are still issued against the 2017 criteria (with the 2022 points of focus).
Key dates
| Date | What happens |
|---|---|
| October 26, 2026 | Exposure drafts released |
| January 15, 2027 | Public comment period closes |
| 2027 | Final criteria approved, if the AICPA proceeds |
| December 31, 2027 | Proposed effective date: engagements beginning on or after this date. Early adoption would be permitted |
What the draft changes
Restructuring
The AICPA describes three kinds of change: consolidating duplicate concepts and removing criteria where appropriate, adding criteria where more clarity or emphasis is needed, and rewording existing criteria so the language is concise and uniform. Independent analyses of the draft count the common criteria falling from 33 to 20. Those counts are a reading of the draft rather than a number the AICPA publishes, so treat them as approximate.
Same five categories
Security, Availability, Processing Integrity, Confidentiality and Privacy all remain.
AI points of focus
Instead of a separate AI framework, the draft adds AI-related points of focus to existing criteria. The AICPA's examples include AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and the risks of automated decision-making. Points of focus are guidance auditors consider, not mandatory controls.
Vendor management
Analyses of the draft say third-party oversight becomes its own category, covering tiered vendor inventories and the evaluation of external components such as AI models and APIs. If your product depends on a model provider, expect your auditor to ask about it.
Open question: business disruption
One analysis reads the draft as moving business-disruption coverage into the Availability category. If so, a Security-only report might no longer address it. That is an interpretation, so confirm it with your auditor.
What stays the same
- Your current SOC 2 reports remain valid under the 2017 criteria.
- Audits that begin before the effective date are expected to use the current criteria.
- SOC for Cybersecurity and SOC for Supply Chain are reported to stay on the 2017 criteria.
What to do now
- Don't rebuild your control matrix around the draft. The text can still change before it is final.
- Ask your auditor three questions: which criteria version applies to your next engagement, whether early adoption will be offered, and how a Type 2 observation period that spans December 31, 2027 will be treated.
- Inventory your AI components and vendors. List every model, API and AI-enabled service in your product and internal tooling, tier your vendors by criticality, and record their critical vendors too.
- Add AI risks to your risk assessment. Training data manipulation, prompt injection and model drift are the obvious starting points.
- Include AI and service accounts in access reviews.
- Consider commenting by January 15, 2027, particularly on the effective date and how it applies to Type 2 periods.
What to watch
The comment period closes January 15. How the AICPA handles the transition for Type 2 periods that cross December 31, 2027 will decide how much of this lands in the 2028 audit cycle.
Sources
- AICPA. AICPA Proposes Update of SOC 2 Trust Services Criteria (October 28, 2026)
- AICPA. Exposure Drafts: Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria (October 26, 2026)
- Elevate Consult. SOC 2 Trust Services Criteria 2027: What the Draft Changes (criteria counts, vendor category and business-disruption reading)