Does SOC 2 apply to AI agents? What auditors ask

01What is SOC 2, and what is it not?

SOC 2 is a report from a CPA firm's examination of controls at a service organization. The AICPA describes the reports as relevant to security, availability, processing integrity, confidentiality or privacy, and notes that customers and business partners often request one from the service organization. The criteria come from the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. Security is the category every SOC 2 report covers, and its common criteria are numbered CC1 to CC9.

Three things it is not. It is not a certification: the output is an auditor's opinion on your controls, in a report you share. It is not a checklist: the criteria say what the controls must achieve, and you design the controls. The 2017 document itself says some points of focus may not be suitable or relevant to a given entity. And it is not static: an AICPA page dated 26 October 2026 offers exposure drafts of proposed 2027 Trust Services Criteria and Description Criteria, so watch for changes.

A Type 1 report looks at whether controls are suitably designed at a point in time. A Type 2 report also tests whether they operated effectively over a period, which is why gaps in logs or reviews during that period matter.

02Which SOC 2 criteria apply to AI agents?

The criteria are written about the entity, users, software and changes, not about any particular technology. An agent with credentials is a user in the sense the criteria care about, and an agent that edits code or infrastructure is a source of changes. These are the common criteria agents touch most, quoted from the 2017 Trust Services Criteria.

Your auditor decides how the criteria apply to your system description. The mapping below is a starting point for that conversation, not an interpretation an auditor has to accept.

• CC6.1: "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives." For agents: where they run and what they can reach.
• CC6.2: before issuing credentials, the entity "registers and authorizes new internal and external users", and credentials are removed when access is no longer authorized. For agents: an inventory of agent identities and an off-switch.
• CC6.3: access is granted, changed or removed based on roles, "giving consideration to the concepts of least privilege and segregation of duties". For agents: scoped tokens, and no agent approving its own change.
• CC6.6 and CC6.7: protection against threats from outside the system boundaries, and restricting "the transmission, movement, and removal of information". For agents: untrusted input and outbound network control.
• CC6.8: controls to "prevent or detect and act upon the introduction of unauthorized or malicious software". For agents: packages and tools an agent installs.
• CC7.2 and CC8.1: monitoring for anomalies, and authorizing, testing, approving and implementing changes. For agents: the action log and the review trail.

03How do auditors look at agent access and credentials?

Expect the questions you already answer for people and service accounts, applied to agents. Which agents exist, who owns each one, what each can access, and how access is removed when an agent is retired? An agent that runs with a developer's personal token is hard to answer for, because its actions and access are indistinguishable from the developer's.

Least privilege under CC6.3 is where agents add work. A coding agent rarely needs production credentials, cloud admin rights or every repository. Scope tokens to the task, prefer short-lived credentials, and keep a record of which keys an agent could see, so you know what to rotate if it misbehaves. A key that never enters the agent's environment is a key that does not need rotating after an incident.

Segregation of duties needs one explicit rule: the agent that writes a change should not be the identity that approves or deploys it. Where an agent can take risky actions directly, a human approval step, named and recorded, is the control an auditor can test.

04What AI agent audit evidence do SOC 2 auditors ask for?

Auditors test controls by sampling evidence. For a Type 2 report, the evidence has to cover the whole period, so an action log that was turned on halfway through, or that cannot show it is complete, leaves a gap. Plan the evidence before the period starts.

CC7.2 asks that the entity monitor system components "for anomalies that are indicative of malicious acts, natural disasters, and errors", and CC7.3 asks that security events be evaluated and acted on. For agents, the raw material is a record of what each agent did, which tool calls and network requests were refused, and what happened next.

• An inventory of agents and agent identities, with owners and the access each holds.
• Access reviews that include agent identities, and records of agents removed.
• Change records showing who, person or agent, authored a change and which human approved it.
• Logs of agent actions that separate human actions from agent actions, kept for the period.
• The network and tool policies agents ran under, and the refusals those policies produced.
• Incident tickets for agent-related security events, with how each was evaluated.

05Where do AIUC-1 and other agent frameworks fit?

Some customers now ask about agent-specific frameworks next to SOC 2. AIUC-1, published by the Artificial Intelligence Underwriting Company, describes itself as a certification for AI agent security. It groups requirements into six domains: data and privacy, security, safety, reliability, accountability and society. Its process includes technical evaluations and a third-party audit, and its site says certificates are valid for one year while the standard is updated quarterly.

AIUC-1 is separate from SOC 2 and is not an AICPA standard. Its site promotes earning both together, but a SOC 2 report does not include AIUC-1 results, and AIUC-1 does not replace a SOC 2 examination. If a customer asks for one, confirm which they need before you start.