An AI tool is a vendor like any other

Vendor management under the common criteria asks how third parties are assessed, approved and monitored. An AI provider holding your data is a third party, whatever the contract size.

If confidentiality is in scope for your report, the commitments you made about protecting confidential information apply to data in a prompt exactly as they apply to data in a file.

Not audit advice. Which criteria are in scope and how they are tested is between you, your auditor and your service commitments.

An approved vendor list is easy to produce. What an auditor increasingly asks is how you know it is complete, and that question is harder because an employee can onboard an AI tool with a work email in about five minutes without touching procurement.

An answer that rests on policy alone is weak. An answer that shows what the fleet actually reached, and what was done about the tools nobody had listed, is the kind that closes the point. That is a discovery problem before it is an audit one.

The artefacts that tend to satisfy this are a dated policy, a list of sanctioned tools with their contract terms, a measurement of what is in use across the fleet, and a record of what happened when something sensitive was about to go somewhere unapproved.

The last of those is the one organisations most often lack, and it is the one that turns the rest from a statement into a control. It is also what a GDPR or HIPAA assessment wants, which means the work is not duplicated.

In practice the first party to ask an organisation about its AI controls is not the auditor. It is a customer, in a security questionnaire, somewhere between the encryption questions and the subprocessor list.

The questions have settled into a recognisable set: which AI tools your staff use with customer data, whether those tools train on it, how you know staff are not using others, and whether a human reviews output that affects the customer. The third one is where most answers become vague, because the honest answer for most organisations is that they do not know.

A measured answer is worth having ready, because this question is increasingly a gate on the contract rather than a formality after it. What it should not become is a claim you cannot evidence: a questionnaire answer that outruns what you actually monitor is a problem you have written down and signed.

AI use lands on a SOC 2 in two places, and organisations usually prepare for one of them.

The first is vendor management. An AI provider processing data on your behalf is a vendor like any other: it needs to be in the inventory, assessed, and reviewed on a cycle, with its own report collected and read rather than filed. Where the provider is integral to delivering your service, your auditor may treat it as a subservice organisation, which changes how it appears in the system description and whether the inclusive or carve-out method applies. That is a conversation to have with your auditor early, because it affects the description rather than a control.

The second is the one that surprises people: the tools nobody put in the inventory. A vendor management control that covers the three AI products procurement knows about, while staff use eleven, is a control that is accurately documented and not operating. Auditors have started asking how the inventory is kept current, and "we ask teams annually" is a weaker answer than it was two years ago.

The difference between a Type I and a Type II is the difference between showing a control exists and showing it ran, and AI use is where that gap tends to open.

For the period under review, a prepared organisation can produce the policy and its acknowledgements, the inventory and its review dates, the detection records showing what was caught and what happened next, and the exceptions with their approvals. Gaps in the middle of a period are worse than a late start, because they raise a question about the whole window rather than about its beginning.

Two limits worth planning around. A control deployed in month nine produces no evidence for months one to eight, and no amount of documentation fixes that, so the deployment date is worth choosing against the audit window. And evidence that consists of an unredacted archive of what staff wrote creates a confidentiality problem while solving a monitoring one, which is a trade your auditor will notice even if nobody else does.