SOC 2 vs ISO 42001
By Sam Rivera, Founder, SentinelPanda · August 6, 2026 · 3 min read · SOC 2
Your security questionnaire grew an AI section. SOC 2 does not answer it, and that is not a flaw in SOC 2 — it is a different question.
The questionnaire changed
For a decade the enterprise security review was a settled genre and SOC 2 answered most of it. Then buyers started adding a section asking how models are trained, what data went into them, whether outputs are monitored for bias, and who is accountable when a model gets something consequentially wrong.
A SOC 2 report does not answer any of that. Its Trust Services Criteria cover security, availability, processing integrity, confidentiality, and privacy of a service — not the behaviour of a model. Processing Integrity comes closest, and it is about complete, valid, accurate, timely, authorised processing, not about whether a model's predictions are fair.
What ISO 42001 adds
- AI system impact assessment — the consequences for individuals and groups affected by the system, not just risk to your organisation.
- Human oversight as an explicit control concern: who can intervene, on what signal, with what authority.
- AI lifecycle management from data sourcing and design through deployment, monitoring, and retirement.
- Transparency obligations toward people affected by AI-assisted decisions.
- Governance of third-party models and components — increasingly the whole stack for teams building on foundation models.
Report versus certificate, again
The structural difference mirrors SOC 2 versus ISO 27001. SOC 2 produces a narrative report from a CPA firm, usually under NDA, that a buyer's security team reads. ISO 42001 produces a certificate from an accredited certification body, which you can state publicly and put on a website.
That makes ISO 42001 useful in a way SOC 2 is not — as a marketing-visible signal — and less useful in another, since a certificate cannot convey the detail a thorough reviewer wants. Expect to be asked for both the certificate and a description of your AI controls.
Sequencing for an AI SaaS
SOC 2 first, almost always. It is what unblocks the majority of enterprise deals today, and the AI section of the questionnaire is usually a smaller blocker than the absence of a security report entirely.
ISO 42001 becomes worth the investment when AI is core to the product rather than incidental, when you sell into regulated sectors or the EU, or when you are losing deals specifically on AI governance questions. If you are adding a chat feature to an otherwise conventional product, a documented AI policy and clear answers will carry you further than a certification project.
Where both are in play, scope them so the AI management system governs the AI estate and the SOC 2 system description covers the platform — overlapping on the shared controls (access, change management, monitoring) rather than duplicating them.