A SOC 2 Type II is a beautiful document. It proves you control access, you monitor systems, you manage change. Auditors love it, procurement accepts it, everyone relaxes.
Then a customer asks three questions:
- Which model versions processed our data in the last 90 days?
- Can you show the specific decision your AI made about our user, and replay the inputs that produced it?
- Who could edit those records, and how would we detect it if they did?
SOC 2 has no criteria for any of them. Its trust services criteria were written for systems where logic is deterministic and humans write the code. Your inference stack breaks all three assumptions: the logic is statistical, the "code" changes when you swap a checkpoint, and your agents call tools you didn't hardcode.
This is why ISO 42001 exists, and why the AICPA has been drafting AI-specific guidance. But you don't need to wait for a framework to fix the gap. The engineering is concrete:
- Pin model + version + prompt template ID on every inference record
- Store records append-only, with a hash chain so edits are detectable
- Capture the policy version in force at decision time
- Keep retention long enough to answer "last quarter" without shrugging
None of that is hard. What's hard is realizing your SOC 2 gave you false confidence, and the first customer who asks will find out before you do.
Which of the three questions above could you answer today, with artifacts?
