AICPA Proposes Update to SOC 2 Trust Services Criteria

The American Institute of CPAs announced on October 28, 2026 a proposed update to the SOC 2 Trust Services Criteria, with comments due by January 15, 2027, a change that will feed into AICPA pricing for engagements and how firms scope them.

If the AICPA approves the criteria next year, the 2027 version would apply to engagements beginning on or after December 31, 2027. Early adoption would be permitted.

For practitioners, the draft arrives with a clear date to plan around. For service organisations that hand customers a SOC 2 report as evidence of their controls, it signals that the next report cycle will be measured against a rewritten framework.

What the AICPA exposure draft proposes

The AICPA’s Assurance Services Executive Committee issued exposure drafts to revise the Trust Services Criteria and the Description Criteria used in SOC 2 examinations. The institute publishes the proposed 2027 criteria and a redlined version on its website, and downloading them requires a free AICPA account.

The SOC 2 Working Group describes the changes as targeted restructuring. The draft consolidates duplicative concepts, removes criteria where appropriate, adds new criteria where greater clarity or emphasis is needed, and revises existing wording so each criterion has a concise and uniform meaning.

The criteria cover security, availability, processing integrity, confidentiality and privacy. A SOC 2 examination is performed by a licensed, independent CPA under the AICPA Attestation Standards and evaluates controls relevant to those five categories.

The AICPA’s announcement does not give a count of criteria added, removed or merged. Practitioners will need the redline to see which criteria change in substance and which change only in wording.

Why the AICPA says SOC 2 needs updating

The stated aim is to improve the clarity and usability of SOC 2 reports so they keep meeting the needs of report users, while keeping the criteria relevant as artificial intelligence, automation and other emerging technologies change third-party risk.

Amy Pawlicki, the AICPA’s vice president of assurance and advisory innovation, said the way organisations manage and process information and identify risk has changed substantially over the past decade.

“These proposed revisions are intended to improve the usability of SOC 2 reports and refine criteria so they can adapt to rapidly evolving technologies.”

Amy Pawlicki, Vice President of Assurance and Advisory Innovation, AICPA

The rationale rests on three words the AICPA uses repeatedly: relevance, usability and value. The institute wants reports that customers and their auditors can read without translating dense, overlapping criteria into their own vendor risk questionnaires.

AI points of focus in the SOC 2 criteria

The one area where the AICPA names specifics is emerging technology. The draft adds points of focus on AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and the risks of automated decision-making.

The AICPA says these additions are designed to help organisations and auditors judge whether controls address the risks of advanced technologies. They are framed as points of focus, which sit beneath the criteria as considerations for the examiner, rather than as stand-alone criteria.

That distinction matters for scoping. Points of focus guide how a practitioner assesses a criterion, and a service organisation that builds or runs AI features will face more questions about those systems when its auditor applies them.

The AICPA has separately been setting out what auditors will ask about client AI use. Our coverage of AICPA AI audit guidance sets out those questions, and the survey-based piece on AI auditability in finance shows why trust in AI outputs remains a sticking point for finance teams.

What changes for scoping, testing and AICPA pricing

The draft is not a fee schedule. The AICPA does not set engagement fees, and every firm sets its own pricing, so any effect on AICPA pricing for SOC 2 work will come from changes in effort rather than from the institute.

Three areas are likely to drive that effort once the final text is known.

• Scoping: removed or merged criteria shrink the control mapping a service organisation maintains, while new criteria and AI points of focus may bring systems into scope that were previously out of it.
• Testing: reworded criteria mean test programmes and working papers built on the 2017 criteria need to be remapped before the first engagement under the new version.
• Reporting: practitioners will need to update their report templates and the control descriptions they agree with clients.

Firms that price on the number of controls tested will see the effect most directly. Firms that move toward value pricing for recurring SOC 2 work can absorb a one-off remapping cost into the engagement scope, though that is a commercial choice rather than anything the AICPA prescribes.

Service organisations should expect questions on AICPA pricing from their auditors in the second half of 2027, when fieldwork planning for periods starting on or after the effective date begins. A company with a calendar-year reporting period starting January 1, 2028 would fall under the new criteria if the draft is approved as proposed.

Transition for existing SOC 2 reports

The announcement gives one date. The proposed 2027 criteria would be effective for engagements beginning on or after December 31, 2027, so a period that begins before that date would remain under the existing criteria.

Early adoption is permitted, which gives service organisations that already field heavy AI questions from customers a way to move sooner. It also means a service organisation and its auditor can agree to use the new criteria for a period that begins in 2027.

The announcement does not describe separate transition rules for reports already issued. Reports issued under the current criteria are not affected by an effective date that looks forward to engagements beginning on or after December 31, 2027.

For practitioners, the sensible planning assumption is a split period. Engagements through 2027 follow the existing criteria, and the first full cycle under the new version follows in 2028. Firms that run full-population testing for controls such as access reviews or change management should check early whether any revised criterion alters the population being tested.

What comes next for the 2027 criteria

Comments close on January 15, 2027. The AICPA then has to consider the responses, finalise the text and approve it in 2027 for the December 31, 2027 effective date to hold.

Practitioners and service organisations that want to influence the wording have a little over two months from the announcement. The most useful responses will be specific: which criteria are clearer after the rewrite, which points of focus are hard to test, and where a merged criterion loses detail that customers rely on.

The Description Criteria exposure draft sits alongside the Trust Services Criteria draft on the AICPA page, and firms should read both before commenting. The next marker to watch is the AICPA’s approval of the final 2027 criteria, which determines whether the December 31, 2027 date stands.