AICPA Proposes Update of SOC 2® Trust Services Criteria to Enhance the Relevance, Usability and Value of CPAs’ Reports

NEW YORK (Oct. 28, 2026) – The American Institute of CPAs (AICPA) is seeking comment on a proposed SOC 2® Trust Services Criteria update that represents a significant modernization of the framework used by CPAs to evaluate controls over information systems.

SOC 2® is an examination performed by a licensed, independent CPA under the AICPA Attestation Standards that evaluates controls relevant to the security, availability, processing integrity, confidentiality or privacy of an organization’s systems. The proposed updates are intended to improve the clarity and usability of SOC 2® reports so they continue to meet the evolving needs of report users, while ensuring the underlying criteria remain relevant as artificial intelligence, automation and other emerging technologies alter third-party risk considerations.

"The way organizations manage and process information and identify risk has changed substantially over the past decade," said Amy Pawlicki, the AICPA’s vice president of assurance and advisory innovation. "These proposed revisions are intended to improve the usability of SOC 2 reports and refine criteria so they can adapt to rapidly evolving technologies."

The proposed updates include targeted restructuring of the criteria, including consolidating duplicative concepts, removing criteria where appropriate, adding new criteria where greater clarity or emphasis is needed, and revising existing criteria language to provide concise and uniform understanding of the intention of each criterion. The objective is to ensure the criteria remain relevant, clear and practical.

At the same time, the exposure draft incorporates expanded considerations for emerging technologies, including AI. For example, new points of focus address issues such as AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and the risks associated with automated decision-making. These additions are designed to help organizations and auditors evaluate whether controls effectively address the growing risks introduced by advanced technologies.

The AICPA’s SOC 2 Working Group is seeking public comment on the exposure draft through Jan. 15, 2027. If approved next year, the proposed 2027 SOC 2 Trust Services Criteria would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted.