SOC 2 Is Getting Its First Update Since 2017: What the AICPA's Proposed 2027 Criteria Change

On Oct. 28, 2026, the AICPA published an exposure draft of proposed 2027 SOC 2 Trust Services Criteria and opened public comment through Jan. 15, 2027. If approved next year, the new criteria take effect for engagements beginning on or after Dec. 31, 2027, with early adoption permitted.

That makes this SOC 2 Trust Services Criteria 2027 update the first substantive revision of the framework since the 2017 criteria were introduced. The 2022 refresh touched only the Points of Focus, the guidance layer, leaving requirements alone. The timing is telling. Since 2017, AI has moved out of research demos and into the products fintech, crypto and SaaS companies actually sell, while the framework most of them are examined against has stayed still.

SOC 2 matters beyond compliance habit here: it is the assurance report these mid-market companies hand to banks, enterprise customers and their boards when someone asks whether the controls are real. The yardstick change hits two groups: the organizations examined against it, and the ones relying on it to vouch for their vendors.

What the AICPA actually proposed

The release describes a targeted restructuring: consolidating duplicative concepts, removing criteria where appropriate, adding new ones where greater clarity or emphasis is needed, and revising wording so each criterion carries a concise, uniform meaning. The five categories are untouched: security, availability, processing integrity, confidentiality and privacy. The stated purpose is relevance, keeping the criteria current as artificial intelligence, automation and other emerging technologies alter third-party risk considerations.

“The way organizations manage and process information and identify risk has changed substantially over the past decade,” said Amy Pawlicki, the AICPA’s vice president of assurance and advisory innovation. “These proposed revisions are intended to improve the usability of SOC 2 reports and refine criteria so they can adapt to rapidly evolving technologies.”

One caution for anyone tracking the commentary. Specific counts circulating about the draft (how many criteria were consolidated or removed, how the common criteria renumber) come from unofficial readings of the draft documents, not from the AICPA’s announcement. Until the AICPA confirms its own numbers, qualitative is as specific as anyone outside the working group should get.

The AI question, answered carefully

The release names new points of focus in areas such as AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management and the risks associated with automated decision-making. The list is explicitly illustrative, introduced in the release by the words “for example” rather than presented as exhaustive.

Points of focus are guidance that helps a practitioner judge whether a criterion is met. They are not mandatory criteria, and the proposal creates no separate mandatory AI category. CBIZ’s early read lands the same way: AI considerations are woven through the existing control structure, touching access, technology management, system development, third-party oversight, processing integrity, availability and privacy rather than sitting in a silo.

A subtler implication matters more in practice. An examination covers what is in the system description, nothing else. A vendor can run a fully featured AI product and keep it outside the report’s scope; the most sophisticated points of focus never touch it. That was the core of our September piece on the SOC 2 AI controls gap: the gap is being addressed at the source, but through guidance, and only if AI is actually in scope. For the internal picture examiners will eventually ask about, an AI inventory paired with a shadow-AI roadmap is the starting artifact.

Vendor management is the sleeper change

The AI content will draw the headlines. The change with more practical consequence is third-party risk. CBIZ’s reading of the draft describes vendor and business-partner inventories, risk-based assessments that reach farther down the supply chain, explicit attention to the security of externally sourced technology including AI and interconnected software components, and subservice-organization reviews that use available SOC or other assurance reports and evaluate their gap coverage.

From a practitioner’s seat, the vendor-management chapter is usually the thinnest part of a mid-market SOC 2 report. The narrative reads fine; the inventory and assessment behind it often sit at a granularity that would not survive a serious dispute, let alone the standard regulators now hold banks to on their own third-party ecosystems, the ground the bank TPRM guidance overhaul covers. If the final criteria raise that bar for service providers, the fix will be substantive, not cosmetic.

Resilience shifts from uptime to proof

Availability broadens as well. CBIZ characterizes the direction as moving the conversation from keeping systems running to preparing for disruption and demonstrating that recovery measures work. In CBIZ’s reading, the proposal addresses capacity, backups, recovery, infrastructure and testing. Ransomware is one contemplated scenario, with protected backup approaches, including air-gapped and immutable backups, as part of recovery planning. And continuity and crisis-management testing, per the same account, would need to consider third-party vendors and the potential unavailability of key personnel.

The written policy is never the hard part here. Proving a control operates consistently is where examinations get uncomfortable: restore tests that actually restored something, continuity exercises built on realistic scenarios, documentation an examiner can follow without a guided tour. This draft pushes all of it toward evidence, the direction most teams are least ready for.

What does not change

Until final criteria are approved, examinations continue under the 2017 Trust Services Criteria with the 2022 revised Points of Focus. Reports issued under them stay valid for the periods they cover. Nothing expires on Dec. 31, 2027. Engagements beginning before the effective date run on the current criteria; the transition turns on engagement start dates, not report-read dates.

Terminology is worth precision, because sloppy usage causes disputes. SOC 2 is an attestation performed by a licensed, independent CPA under the AICPA’s attestation standards. It is an examination report, not a certification, and a contract demanding a “SOC 2 certificate” demands a document that does not exist. Choosing the right examination firm still outweighs the criteria year; our guidance on selecting a SOC 2 auditor has not aged with any of this.

A second AICPA project is easy to conflate with this one. The Auditing Standards Board separately proposed revisions to AT-C sections 105, 205 and 210, the attestation standards these examinations run under, with a proposed effective date of June 15, 2029, per 360 Advanced’s summary. That project concerns how an examination is conducted, not what gets tested, and the Trust Services Criteria are not changing under it.

The timeline

• Oct. 27-28, 2026: exposure draft dated Oct. 27 (per Polara Labs’ reading of the document, which remains unofficial), announced with the AICPA’s news release on Oct. 28.
• Through Jan. 15, 2027: public comment window.
• During 2027: the SOC 2 Working Group finalizes the text; approval decides what follows.
• Dec. 31, 2027: proposed effective date for engagements beginning on or after this date, early adoption permitted.
• 2028 and beyond: transition years, reports under both versions circulating together.

What service organizations can do now

This list is practitioner judgment, not doctrine.

• Know what AI you actually run before anyone asks. The proposed points of focus assume an organization can name its models, training data sources and output monitoring. An AI governance program is the structure this attaches to, and the draft’s technical themes (prompt manipulation, data poisoning) map onto the OWASP LLM Top 10.
• Pressure-test the vendor chapter: can you produce the vendor inventory, the assessment that reached downstream suppliers and the subservice-organization analysis without a scramble? If any of it is thin, fix the work, not the wording.
• Collect recovery evidence rather than recovery plans: restore test results, backup architecture documentation where ransomware is a realistic threat, continuity exercises that model losing a critical vendor or key people.
• Mark the calendar. Engagement start dates before Dec. 31, 2027 (assuming approval stays on schedule) mean the next examination runs on current criteria; dates after mean the new ones. That drives 2027 and 2028 timing and budget.
• If the draft would create real friction in your environment, comment before Jan. 15, 2027. The working group is asking, and criteria text is far cheaper to change before finalization than after.
• Resist re-engineering controls against draft language. Prepare at the theme level: vendors, resilience, AI in scope. The final wording will move, and remapping a control library twice is wasted motion.

What buyers and vendor-risk teams should do

Treat the transition as a versioning problem, not a rewrite; the playbook leans on the checklist Crest published for report users.

• Add a criteria-version field. Record the Trust Services Criteria version and the report period for every SOC 2 report in the vendor inventory, alongside the scope and exceptions already tracked.
• Treat criteria versions as different evidence. A current-criteria report and a new-criteria report are not like-for-like, and scoring them as if they were invites bad decisions.
• Keep the scope question primary. A vendor’s AI feature can sit outside the system description under either version. For critical AI vendors, tier them and request AI governance evidence directly rather than assuming the report covers it.
• Add the cheap question now. A criteria-version field on intake questionnaires is low cost even mid-transition. Hold larger questionnaire rewrites until the final criteria and effective dates are confirmed.
• Bridge the gaps. Between report periods, rely on bridge letters and continuous monitoring, not on the age of an attestation that may be months old when read.
• Expect three report populations and handle each differently: current-criteria reports, valid for their periods; early adopters, where the useful question is what changed in scope and controls versus the prior report; and new-criteria reports, which deserve today’s skepticism plus fresh attention to anything newly worded.

Early adoption, without the racing

Early adoption lets a service organization fold AI scope decisions and tightened vendor and resilience expectations into a report sooner, a genuine signal to enterprise buyers. The costs are quieter: auditor methods still moving, bridge letters back to prior-year reports getting more awkward, and customer review teams calibrated to the current criteria. Organizations formalizing AI management through ISO 42001 have a parallel track that satisfies AI governance asks while SOC 2’s AI content matures. Most annual-cycle organizations will find the timing picks itself in the first natural cycle after the finals land. Buying an earlier examination date just to be first is hard to defend to anyone, including the auditor.

Where this leaves you

Nothing here is urgent for anyone with an examination scheduled this quarter. Current-criteria reports keep working, engagements starting before the cutover run on familiar ground, and no emergency is attached to any of it. What the draft does, for the first time in close to a decade, is confirm that the questions executives, regulators and buyers keep raising about AI, vendor depth and provable recovery belong inside the standard rather than beside it. Treat 2027 as preparation, building the inventories, vendor assessments and recovery evidence this draft points toward, and the transition will read like paperwork. Wait for the final text and it will read like a scramble.