The AICPA wants to rewrite SOC 2 by 2027. Should a startup wait?
5 min read
No. The proposed 2027 Trust Services Criteria are a draft with comments open until 15 January 2027, and if approved they would apply to engagements beginning on or after 31 December 2027, with early adoption allowed. A first SOC 2 started now will be examined under the current criteria, and the report will be valid for the period it covers. What the draft does change is the questions to ask a platform: whether it will remap your controls when the final text lands, and how it governs its own AI.
What is the AICPA proposing?
A restructuring of the criteria, consolidating duplicates, removing some, adding others and rewriting wording for consistency, plus new points of focus on AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management and automated decision-making. The AICPA calls it a significant modernisation and says the aim is reports that stay usable as AI and automation change third-party risk.
Does a report under the current criteria become worthless?
No. A SOC 2 report covers a period and is read by customers for that period. Reports issued under the current criteria will continue to be issued through 2027 and, for observation periods that began before the effective date, beyond it. Customers asking for your SOC 2 in 2027 will be asking for the one you have.
What changes for a startup starting now?
The remap, later. Your controls are mapped to criteria inside the platform. When the criteria are renumbered, the platform has to publish a new map and your team has to check it: which controls now satisfy which criteria, which criteria were removed, which are new and have no control yet. That is work for 2028. The question for this year's purchase is whether the platform does that work for you. Ask each vendor, in writing, how it handled the last criteria change and whether remapping is part of the plan.
What about the AI points of focus?
They apply to AI in your product and to the platform's own agents, which collect evidence, draft policies and answer questionnaires on your behalf. The draft does not say "no AI"; it says governance, monitoring and human review should be visible. Scytale says its AI questionnaire answers are reviewed by a human expert and that its MCP server is read-only in its first phase; Vanta describes an AI agent that drafts policies and questionnaire answers. Ask every vendor the same thing: what the agent can change, who reviews it, and where the log is.
What is the timeline?
Comments close 15 January 2027. The AICPA says that if approved next year the criteria would be effective for engagements beginning on or after 31 December 2027, with early adoption permitted. A Type I this winter and a Type II observation period through 2027 both sit under the current criteria. A Type II observation period starting in 2028 would be the first under the new ones.
What should a founder do?
Start the audit you need for the deal in front of you. Put two questions in the vendor evaluation: remapping on criteria change, and AI agent governance. Keep the 15 January comment deadline in mind if your company has a view on how SOC 2 should treat AI; the AICPA is asking.
Sources
- AICPA news release, 28 October 2026Source: aicpa-cima.com · Read 2026-10-28
- AICPA exposure drafts, proposed 2027 SOC 2 criteriaSource: aicpa-cima.com · Read 2026-11-05
- Scytale MCP launch, 13 October 2026Source: finance.yahoo.com · Read 2026-10-13
Questions founders ask
Should I wait for the 2027 SOC 2 criteria before my first audit?
No. The criteria are a draft, and if approved they would apply to engagements beginning on or after 31 December 2027. A report under the current criteria stays valid for its period.
Will my controls need to be remapped?
Yes, once the final criteria are published. Ask your platform whether remapping is included in your plan and who performs it.