AICPA’s Proposed 2027 SOC 2 Criteria: What Changes

On October 27, 2026, the AICPA released an exposure draft that would rewrite the SOC 2 Trust Services Criteria (TSC) for the first time since 2017. It shrinks the criteria, drops the COSO scaffolding they were built on, and adds AI-specific points of focus throughout. If finalized, it takes effect for engagements beginning on or after December 31, 2027, with early adoption allowed.

This is the first of five posts. This one covers the whole draft. The next four go deep on the sections that changed the most.

The short version

• Fewer criteria. By our count, the common criteria drop from 33 to 20, and the total across all five categories drops from roughly 61 to 50.
• COSO is gone from the surface. The 17 COSO principle labels, the TSP reference column, and the font conventions that marked COSO-derived criteria no longer appear.
• Everything is renumbered. CC1 through CC9 become CC1 through CC8. Every control matrix, automation-platform mapping, and report template keyed to the old numbers will need updating.
• AI is built in. New points of focus cover AI agents, shadow AI, model drift, prompt injection, and training-data changes. They sit inside existing criteria; there is no separate AI category.
• It is a draft. The text still has bracketed placeholders, and comments are open until January 15, 2027.

Timeline

The draft is written for SOC 2 and SOC 3 only. The 2017 criteria (with the 2022 points of focus) would stay in place for SOC for Cybersecurity and SOC for Supply Chain engagements.

‍

Why the AICPA is doing this

The draft names two goals. The first is to reduce complexity and improve clarity: combine similar criteria, remove unnecessary ones, add new ones where clarity needs them, and tighten the language. The second is to modernize the criteria for emerging technologies, with AI singled out for its autonomous decision-making, reliance on large datasets, and the challenge of explaining and monitoring it.

The working group says it kept the language flexible on purpose. It avoids naming specific technologies so the criteria still apply to ones not yet in wide use.

‍

This is our reading of the redline, not an AICPA crosswalk. Where a point of focus moved between criteria, we say so in the individual posts.

Where the biggest changes are

In the redline, the common criteria (CC1 through CC8) are almost entirely new text. Most of those criteria show 80 to 99 percent inserted language. The category-specific criteria change far less.

1. CC1 through CC4: governance, communication, risk, and monitoring. Fourteen criteria become eight.
2. CC5: access, devices, networks, encryption, and vulnerability management consolidate into one series.
3. CC6 and CC7: incident response is consolidated, and change management splits into infrastructure, acquired software, and internally developed software.
4. CC8 and availability: vendor management is rebuilt, and the old business-disruption criterion moves out of the common criteria.

Where AI shows up

The draft does not add an AI category. It adds points of focus to existing criteria instead:

• People and communication: AI-related competency training (CC1.2), operational considerations for AI systems, and telling users when outputs are AI-generated (CC2.2).
• Risk: AI risks such as training-data manipulation, adversarial inputs, bias, and data poisoning (CC3.2), plus model drift and explainability when recalibrating (CC3.3).
• Access and tools: AI agents and AI accounts in access reviews (CC5.1), unsanctioned AI platforms and unauthorized AI models (CC5.3), and attacks on AI platforms (CC5.6).
• Monitoring and change: AI component monitoring and anomalous model behavior (CC6.1), and changes to training data (CC7.2 and CC7.3).
• Vendors: AI models, APIs, and plugins as third-party components (CC8.1).
• Other categories: resource exhaustion from excessive AI prompts (A1.1), AI and machine learning in processing integrity inputs, processing, and outputs (PI1.1, PI1.3, PI1.4), and personal data in AI systems (P4.1).

The draft is explicit that points of focus are not a checklist. Paragraph .08 says each point of focus does not require a specific control. It also says AI competencies, for example, would be considered under CC1.2 even though no point of focus names them. The draft points to separate AI application guidance that is still under development.

The categories that change less

• Processing integrity keeps its five criteria. The main additions are AI and machine learning points of focus in PI1.1, PI1.3, and PI1.4.
• Privacy keeps 18 criteria and the [P] and [C] processor and controller tags. The old P3.2 on explicit consent appears to become P2.2, and P4.1 gains an AI point of focus.
• Confidentiality grows from two criteria to three: classification and inventory (C1.1), maintenance (C1.2), and disposal (C1.3). C1.2 adds encryption driven by contract or regulation, such as customer-managed keys.
• Availability grows from three criteria to four. The largest change is A1.3, covered in post five.

What to do now

1. Don't rewrite your controls yet. The draft can change before it is final.
2. Start a crosswalk. Map your existing controls to the new numbering so you can see which criteria are covered, merged, or new.
3. Inventory your AI. List AI tools, agents, models, and vendors that touch your system, sanctioned or not. Several new points of focus assume you can do this.
4. Ask your auditor how the effective date applies to your examination period. It matters most if your Type 2 period starts near the end of 2027.
5. Consider commenting. Practitioners and service organizations can respond to the AICPA by January 15, 2027, using the contact on the draft's cover page.

Questions about how the proposed criteria would affect your next SOC 2 examination? Contact Johanson Group.

Source: AICPA ASEC SOC 2 Working Group, Exposure Draft, Proposed 2027 SOC 2 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (October 27, 2026), and the accompanying redline against the 2017 criteria. The proposal is not final and may change.

‍