How to Read a SOC 2 Report From an AI Vendor

A vendor sends a SOC 2 report the way they send a logo. It arrives as a PDF, it is long, and the implied message is that receiving it concludes the diligence. It does not. A SOC 2 report is an auditor's opinion about controls the vendor chose to be audited against, over a window the vendor chose, with exceptions listed in a section most people never reach.

Reading it properly takes about twenty minutes and four sections. For a firm handling client tax data under the AICPA Confidential Client Information Rule, those twenty minutes are the diligence.

Type I or Type II

Check the cover page first, because it decides how much the rest is worth.

Type I says the controls were designed appropriately as of a single date. It is a snapshot. A vendor can pass a Type I on controls that were implemented the week before the audit and abandoned the week after.

Type II says the controls operated effectively across a period, normally six or twelve months. This is the one that means something, because it tests whether the control actually ran.

A vendor offering only a Type I is not disqualified, particularly a young one. But a Type I two years after founding is a choice rather than a constraint, and it is worth asking why.

The period, and the gap since it ended

Find the review period on the cover and do the subtraction.

A report covering January to December, handed to you the following November, describes controls as they operated up to eleven months ago. Software companies rewrite a great deal in eleven months, and an AI vendor shipping weekly may have changed the architecture the report describes.

Ask two things. When does the next report cover, and will you receive it. A vendor that will not commit to sending the next one is telling you the relationship ends at the sale.

Which trust services criteria were in scope

This is the part that surprises people.

SOC 2 covers five criteria, and only Security is mandatory. Availability, Confidentiality, Processing Integrity and Privacy are each optional, and the vendor chose which to include.

For an AI tool handling client data, Confidentiality and Privacy are the ones that matter most, and neither one has to be in scope. A report scoped to Security alone tells you the vendor protects its systems from intrusion. It tells you nothing about whether your client data is segregated, retained appropriately, or used for anything else.

Check the scope statement. If Confidentiality is absent, that is the question for the call.

The exceptions, which is the section that matters

Every meaningful report has an exceptions or testing-results section, usually near the back, usually the part a salesperson has not read.

An exception is a control that failed during testing. The presence of exceptions is not disqualifying and their absence is not reassuring, because a report with no exceptions across twelve months sometimes means the testing was narrow.

What to look for:

• What failed. An access review performed late is different from encryption not applied.
• Whether it recurred. The same exception across consecutive reports is a control the vendor has decided not to fix.
• Management's response. A specific remediation with a date reads differently from a paragraph explaining why it was not really a problem.

Complementary user entity controls

Near the end, a section lists the controls you have to operate for the vendor's controls to work. They are called complementary user entity controls, and they are obligations transferred to you.

Typically: you provision and deprovision your own users, you configure the retention settings, you enable multi-factor authentication, you classify what you upload.

Firms read the vendor's controls and skip this list, which means they have accepted obligations they are not performing. If the report says you are responsible for deprovisioning and a departed staff member still has access, the vendor's control worked and yours did not.

Subservice organizations

An AI vendor almost never runs its own infrastructure, and it almost never runs its own model. Both appear in the report as subservice organizations.

Two methods exist. Under the carve-out method, the subservice provider's controls are excluded from the audit entirely, and the report tells you nothing about them. Under the inclusive method they are tested.

Carve-out is standard and not a red flag. But it means the report in your hand covers the vendor's wrapper and not the model provider underneath it, which for an AI tool is frequently where your data actually goes. Ask which model providers are in the chain and what their terms say about training.

The questions the report will not answer

Three things matter for an AI vendor that a SOC 2 is not designed to address.

Whether your data trains a model. That is a contractual term, not a control. It belongs in the agreement.

What the model does when it is wrong. SOC 2 tests controls, not output quality.

Who reviewed the output before it reached a client. That is your control to operate, not theirs.

The twenty-minute version

Cover page for Type and period. Scope statement for which criteria. Exceptions section for what failed and whether it recurred. Complementary user entity controls for what you just agreed to do. Subservice section for who is underneath.

Then one email to the vendor with whatever those four raised. A vendor that answers precisely has told you something. A vendor that responds with the logo again has told you something too.