Your next SOC 2 audit includes AI agents: the evidence list

SOC 2 audits are changing — not because AICPA rewrote the Trust Service Criteria, but because auditors are now applying the 2017 criteria to a category of system the framework was never designed for: autonomous AI agents. If your agents access customer data, execute autonomous actions or connect to external systems, they are in your SOC 2 scope, and your existing program almost certainly does not have the evidence.

The shift is already measurable

The scope expansion has hard numbers: reports with more than 150 security controls rose from 16% to 23% in the past year. Confidentiality is now included in 64.4% of SOC 2 reports, nearly double the 34% from 2023. Availability appears in 75.3%. The scope is expanding because the systems in scope are expanding — and AI agents are the newest addition.

Why SOC 2 breaks for agents

SOC 2 was designed for deterministic systems, and agents violate three of its assumptions. First, controls can be documented and tested at a point in time — a firewall rule stays effective until someone changes it, but agent behavior changes on its own as models update, data distributions shift and dependent tools modify APIs. An agent that was compliant last month may not be compliant today, and nobody touched it.

Second, systems process information \"as intended\" based on documented logic — agents produce non-deterministic, emergent outputs, so you cannot document their intended processing logic the way you document a database query. Third, access is human-mediated — agents call APIs, query databases, execute code and interact with other agents without a human initiating each action, so the access control model must extend to non-human autonomous identities.

These are not theoretical gaps. 97% of organizations that suffered AI-related breaches lacked proper access controls; 33% of organizations lack audit trails entirely and 61% have fragmented logs across systems — the evidence your auditor needs does not exist in a queryable form.

The three standard evidence categories in 2026 audits

Three categories of agent-specific evidence have become standard expectations: agent inventory with per-agent identity, owner, risk tier and certification status — auditors want the complete list, including shadow agents built without IT approval; prompt and completion logs with timestamps, model version, user identity and PII handling notes; and drift evidence with a documented detection cadence plus a sample of caught deviations across the observation period.

If you cannot produce all three on demand, your CC6.1, CC7.2 and CC8.1 controls are at risk regardless of how careful the rest of your program is. Most SOC 2 programs designed for SaaS infrastructure surface none of them — which is why governance teams now treat agent compliance certification as a separate workstream from the traditional security review.

What each Trust Service Criterion demands

ISO 42001: the certifiable AI governance layer

SOC 2 verifies that security controls operated effectively; it does not assess AI governance. ISO 42001 is the first certifiable AI management system standard, covering the full AI lifecycle: policies, AI risk assessments, defined roles and a continual improvement cycle, explicitly covering data provenance, model selection, bias testing, transparency documentation and human oversight. Fewer than 100 organizations held certification by January 2026, but Microsoft, AWS and Google Cloud have all certified, and enterprise procurement is adding ISO 42001 to vendor questionnaires. For an enterprise running dozens of agents, it is the governance scaffolding that prevents chaos.

The nine-item preparation checklist

Auditors are not waiting for agent-specific standards — they already apply existing control families to agents. Work through the list: ① a complete inventory of agents (approved plus discovered shadow tools); ② a named owner for every material agent; ③ identity-based access with least privilege; ④ human gates for high-impact actions; ⑤ logging standards for agent decisions; ⑥ data minimization rules by agent tier; ⑦ AI impact and risk assessments on a cadence; ⑧ continuous monitoring for drift and anomalies; ⑨ automated evidence mapped to SOC 2, ISO 27001, ISO 42001 and NIST AI RMF as applicable.

The bottom line

The frameworks are catching up, but the direction is set: attributability and reversibility must be structural properties of the system, not procedures applied after the fact. Evidence is a schema, not a report artifact — if any field is optional in production, an auditor will eventually request it during an incident sample. The most practical starting point for organizations running agents: take your highest-risk workflow, trace one decision to its responsible agent, model, data source and authorizing spec, then ask whether the output can be rolled back without cascading failure. If either answer is no, the architecture needs to change — not the audit calendar.

References

• Roval: SOC 2 for AI agents — what your auditor will actually ask — https://roval.ai/research/blog/soc-2-ai-agents/
• SecureSlate: Your auditor is about to ask about AI agents: 9 things they'll want to see — https://getsecureslate.com/blog/auditor-ai-agents-9-things-they-want-to-see
• CBIZ: 2024 SOC Benchmark Study — https://www.cbiz.com/insights/article/the-evolution-of-soc-reporting-key-findings-from-the-2024-soc-benchmark-study-part-two
• DreamFactory: Enterprise AI Data Governance Statistics — https://www.dreamfactory.com/hub/enterprise-ai-data-governance-statistics
• Kiteworks: 2026 Data Security Forecast — https://www.kiteworks.com/cybersecurity-risk-management/2026-data-security-forecast-ai-governance-predictions/