Using AI? What 2026 AICPA Guidance Means for SOC 1 and SOC 2 Reports
Using AI in customer support, software development or transaction processing? Bring it into the conversation before your next SOC examination.
On September 11, 2026, the AICPA released TQA Section 9561, addressing how a service organization’s use of artificial intelligence affects SOC 1 and SOC 2 examinations. The guidance addresses examinations under existing attestation standards.
Why AI matters for SOC reporting
AI can change how services are delivered, data is handled and decisions are reviewed. For organizations seeking SOC 2 reporting services, the practical starting point is to explain where AI fits into the services covered by the report.
SOC 1 addresses controls relevant to customers’ internal control over financial reporting. SOC 2 addresses controls relevant to the applicable Trust Services Criteria. Discuss AI use in the context of your report’s objectives and scope.
Four steps to prepare for your next SOC examination
Use this practical checklist to start the discussion with your service auditor:
Map AI use. Identify tools, providers, data inputs and outputs used in the services being examined.
Clarify accountability. Document who approves AI use, reviews outputs and responds to errors.
Review controls. Consider access, sensitive data, vendor oversight, changes and monitoring.
Organize evidence. Retain support showing how relevant controls are designed and, when applicable, operate during the examination period.
These are preparation steps; the appropriate procedures depend on your system, risks and engagement. Discuss changes early so your team can address questions before testing begins.
Put these steps into practice with our AI Use & SOC Readiness Worksheet. This fillable PDF helps you document AI use, relevant controls, supporting evidence and follow-up actions before your next SOC discussion.
For additional preparation tools, explore our SOC Reporting Resource Library, including the SOC Reporting Starter Checklist and SOC Readiness: Documentation & Evidence Checklist.
Plan your SOC report with confidence
Preparing for your first SOC report or adding AI to an existing system? Explore our SOC reporting services for help planning your report type, scope, timing and readiness.
Disclaimer: This article is for general informational purposes and does not constitute legal, accounting or professional advice. Requirements and circumstances vary. Consult qualified advisers regarding your organization’s specific situation.
Comments