The AICPA has published an exposure draft of the proposed 2027 SOC 2 Trust Services Criteria. If you're a small team planning a first SOC 2, here's what matters and what doesn't.
What's confirmed
- The draft is real. The AICPA published it on Oct 26, 2026 and announced it on Oct 28.
- Comments are open until Jan 15, 2027.
- If approved, it applies to engagements beginning on or after Dec 31, 2027, with early adoption allowed.
- It adds new points of focus on AI: governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, and automated decision-making.
What's reported but not yet verified against the draft
Several firms that have read it say the common criteria drop from 33 to 20 and get renumbered. For example, access control would move to CC5 and change management to CC7, and vendor management would get its own series. Treat the exact numbers as provisional until the final version is out.
What it means if you start in 2026 or 2027
Most first Type I engagements starting before Dec 31, 2027 will still be examined against the current criteria. So don't stall your readiness work waiting for the new numbering. The underlying controls (MFA, access reviews, change management, vendor reviews, backups you've actually tested) stay the same. What changes is how they're grouped and labeled.
Two practical moves
- Store your evidence by control, not by criterion number. Then remapping later is a relabel, not a rebuild.
- If your product uses AI, start writing down how you govern it now: who can change prompts, how outputs are reviewed, and what data the model sees. That's the area auditors are adding.
I'm building Attestlane, SOC 2 readiness software for small B2B teams, so I've been reading this closely. If you're preparing for a first SOC 2, the free assessment at attestlane.to shows your gaps against today's criteria.
