Proposed SOC 2 criteria update: a practical readiness guide

A proposal is a reason to examine your programme, while continuing the work required for your current examination.

MicroApz Security · Updated 2 November 2026

A proposed update can create a rush of questions: Do we need to rewrite our controls? Will the next SOC 2 examination change? What should we tell customers about AI?

The useful response begins with a distinction. A proposal helps organisations prepare and provide feedback; its publication does not, by itself, replace the criteria applicable to an existing examination. Start by understanding the source, then map the implications without disrupting work already under way.

Open the phone-size infographic for larger text ↗

Keep the current control programme and the proposal assessment visibly separate.

What has been proposed?

AICPA’s Assurance Services Executive Committee issued exposure drafts of proposed revisions to the SOC 2 Trust Services Criteria and description criteria. The AICPA’s exposure-draft page identifies the proposed 2027 material; access to downloads may require a free account. Read the actual drafts and accompanying instructions for the latest status, scope and comment process.

A SOC 2 engagement is an examination performed by an independent CPA. Your service, selected categories, description and examination period matter. Discuss the specific implications and timing with your CPA rather than relying on a generic checklist.

What should a readiness team do now?

1. Keep current commitments moving. Continue operating controls and collecting evidence for the agreed examination period.
2. Create a separate impact log. Record the draft reference, question, potentially relevant control, owner and evidence source. Do not silently relabel current obligations.
3. Trace the real service. Identify technology and suppliers that affect the service description or controls, including AI features where relevant.
4. Discuss interpretations. Ask your CPA which questions need further analysis and when a change would affect your engagement.
5. Track the decision. Revisit the log when AICPA publishes the final outcome or further guidance.

Worked example: an AI-assisted support feature

Imagine a customer-support service adds an assistant that searches internal guidance and drafts responses. Product owns the feature, security reviews access, and support managers approve what agents send. An impact review might ask:

These are practical investigation questions for the example, not a claim that each is a new mandatory criterion. Map specific requirements only after reading the relevant text and discussing your engagement.

A simple impact-log template

Example: a useful impact-log entry

Illustrative entry: “AI-assisted support search uses an external provider and internal knowledge articles. Product owns the feature; security owns access review. Existing evidence: supplier assessment, access configuration and change tickets. Open question: how does the proposed text affect the service description and evidence expected for this feature? Discuss with the CPA after comparing the precise draft text.”

That entry does not assert a new requirement. It gives the team a system, an owner, existing evidence and a question that can be resolved. Keep the draft reference and exact version alongside the entry when you make it.

What should you tell a customer?

Separate what you can evidence today from what you are evaluating. For example: “We are reviewing AICPA’s exposure drafts and will assess any final changes with our independent CPA. Our current examination work continues under the criteria agreed for the engagement.” Tailor the statement to your actual engagement and avoid promising a result or adoption date you cannot support.

Questions leadership should ask

• Which services or controls could be affected, and how confident are we?
• What evidence already exists, and what remains unknown?
• Who owns the assessment and the conversation with our CPA?
• What decisions can wait until the proposal is final?

Four questions for your CPA meeting

1. Which criteria and description apply to our next examination and reporting period?
2. Which proposed changes might affect our service, selected categories or evidence?
3. When should we reassess once final material is available?
4. How should we communicate uncertainty to customers in the meantime?

Make the impact map technically useful

For each service component, identify the production boundary, data sources, dependencies and change path. For the AI assistant example, record the model provider and version, retrieval index, permission enforcement point, tool scopes, logging and approval path. Link each item to the control owner and evidence that shows how it operates over the relevant period.

Use three labels in the working register: current obligation (with the applicable criterion and engagement context), draft interpretation (with the exact exposure-draft reference), and open question (owner and CPA discussion date). Avoid copying speculative language into a current control description. Review the actual draft before asserting a particular change.

Status can change. This article is a practical readiness discussion, not an interpretation of all draft criteria or a substitute for advice about a specific examination.