Proposed 2027 SOC 2 Criteria Put AI, Risk Management and Resilience in Sharper Focus

The AICPA’s proposed update to the SOC 2 Trust Services Criteria would substantially modernize the framework, with changes addressing AI, emerging technology, vendor risk and today’s more complex cybersecurity environment. Organizations that rely on SOC 2 reporting may want to understand the proposal now rather than waiting for the final criteria.

The American Institute of Certified Public Accountants (AICPA) has released proposed 2027 SOC 2 Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. For organizations that undergo SOC 2 examinations, the exposure draft offers an early look at how control expectations could evolve. The exposure draft is open for comments through Jan. 15, 2027. If finalized as proposed, the criteria would apply to engagements beginning on or after Dec. 31, 2027, with early implementation permitted.

The proposal does more than refresh terminology, the proposed revisions seek to make SOC 2 reporting easier to use while addressing technology risks that have changed significantly since the existing criteria were developed, particularly the risks associated with AI.

AI Moves Deeper Into the Control Environment

AI receives substantial attention throughout the proposed criteria. Rather than creating a separate AI category, however, the proposal incorporates AI considerations throughout the existing control structure. That approach matters. It suggests organizations should consider AI as part of established governance and control processes instead of treating it as an isolated technology initiative.

The reach of these changes goes well beyond AI-specific security threats. AI considerations appear throughout the proposed criteria, including access, technology management, system development, third-party oversight, processing integrity, availability, and privacy. This broader approach reflects how AI can affect multiple parts of a system, from the data used to train and operate models to how those models process information, generate outputs, interact with users, and are monitored over time. Organizations need to consider whether employees have appropriate competencies, understand when AI contributes to an output and how risks unique to AI systems are identified and managed.

For organizations adopting AI quickly, the practical takeaway is straightforward: AI governance may increasingly need to connect directly with the controls already supporting SOC 2 readiness.

Risk Management Gets a More Defined Structure

The proposal also restructures risk assessment around a more explicit risk-management lifecycle, prompting organizations to look beyond periodic risk assessments and examine how their risk-management activities connect over time. Documentation, ownership, monitoring, and communication all play prominent roles in the proposal.

The proposed criteria touches on governance, risk tolerance, resource allocation, risk identification, risk treatment, risk registers, and communication to leadership. They also contemplate using information such as vulnerability assessments, business-impact analyses, and third-party risk scores outputs to be evaluated and incorporated into their risk management program. The proposal further emphasizes periodic evaluation of the risk management program itself, including whether risk management activities remain appropriately calibrated and the use of independent assessments to evaluate the effectiveness of the program.

Third-Party Risk Becomes Harder to Separate From Technology Risk

Modern systems often depend on a web of vendors, software providers, APIs and other external components. The proposed criteria recognize that reality.

Under the vendor-management provisions, organizations would need to consider risks associated with vendors and business partners, including third-party access and network connections. The proposed vendor-management criteria also broaden the focus beyond traditional service providers by considering the security and reliability of externally sourced technology, including AI and interconnected software components.

The criteria further contemplate inventories and risk-based assessments of relevant vendors and business partners, including risks arising farther down the supply chain. Reviews of subservice organizations may include available SOC or other third-party assurance reports and an evaluation of gaps in control coverage.

For businesses with rapidly expanding technology ecosystems, those provisions reinforce an important point: the control environment increasingly extends beyond systems the organization operates directly.

Resilience and Recovery Receive Greater Attention

Availability also receives meaningful proposed updates. The availability criteria broaden the conversation from keeping systems running to preparing for disruption and demonstrating that recovery measures work. The proposal addresses capacity, business resilience, backups, recovery, infrastructure, and testing.

Ransomware is one scenario contemplated by the proposed availability criteria, which point to protected backup approaches, including air-gapped and immutable backups, as part of recovery planning. Business continuity and crisis-management testing would also need to consider third-party vendors and the potential unavailability of key personnel or vendors.

This framing connects availability more closely with an organization’s ability to respond to disruption, recover critical operations, and test whether recovery plans work as intended.

What Organizations Can Do Now

The criteria remain proposed, so organizations should avoid treating the exposure draft as a finalized requirement. Still, waiting until the effective date to evaluate the potential impact could compress the time available for changes.

Organizations can use the proposal as a reason to examine several questions:

• Are AI systems, models and AI-enabled tools accounted for in existing technology inventories and risk processes?
• Do risk-management activities connect identified risks with owners, treatments, monitoring, and reporting?
• Are vendor and subservice-organization controls aligned with the organization’s current technology dependencies?
• Do change-management processes address data and AI-related changes where relevant?
• Are resilience and recovery capabilities tested against realistic disruption scenarios?

The larger message is less about adding isolated controls and more about keeping the control environment aligned with how technology is actually being used.

The proposed 2027 criteria give organizations an opportunity to assess that alignment before the changes become final. For businesses preparing for future SOC 2 examinations, now may be an appropriate time to compare existing controls with the proposal, identify potential gaps, and determine where governance practices may need to mature.

Preparing for changes to SOC 2? Connect with CBIZ CPAs to discuss how the proposed criteria may affect your organization’s readiness strategy.