SOC 2 vs ISO 42001: which one a customer will ask for first
An AI product company whose enterprise buyers now ask AI governance questions in security reviews should first pursue a SOC 2 report, because it is the assurance most security teams already know how to read. A SOC 2 is a CPA attestation of security controls, issued as a Type 1 (control design as of a date) or a Type 2 (operating effectiveness over a period). ISO/IEC 42001 is different in kind: it is a certifiable AI management system standard, and an accredited certification body issues the certificate, not the CPA. For most buyers the question is less "which standard" than "what does this customer's procurement form ask for," so start by pulling the vendor questionnaire and any AI addendum your largest accounts send you.
Expect the two to answer different questions. A SOC 2 covers the trust services criteria you chose and the controls behind them, while ISO/IEC 42001 requires an AI risk assessment, an AI system impact assessment (clauses 6.1.4 and 8.4) and a statement of applicability that justifies which of the 38 Annex A controls you include or exclude. Ask buyers whether they want evidence of AI impact assessment, model life cycle controls or third-party management specifically. If they do, a SOC 2 alone will not answer those questions, and you should confirm with your auditor whether the AI-specific criteria you need fall inside a SOC 2 scope or require a separate management system.
Before committing to 42001 certification, confirm which certification bodies in your market can audit against it. ISO does not certify organizations, and the supplied facts show that ISO/IEC 42006:2025 sets requirements for bodies certifying AI management systems and that 42001 is not yet an endorsed sub-scope of the Global ACI recognition arrangement. Ask any candidate body for its accreditation scope in writing, and plan for the three-year certification cycle that European Accreditation describes for ISO/IEC 17021-1 bodies. Do both when a buyer's contract names ISO/IEC 42001 explicitly, or when you sell into the EU and need evidence for the EU AI Act. The European Commission notes that 42001 does not match the AI Act's quality management system, so do not treat one as a substitute for the other.
How SOC 2 and ISO 42001 differ on scope, proof and structure
This table compares what each framework assesses, what it produces and how it is structured, so you can tell which one answers a customer's question. Neither is a legal obligation for most vendors, so read each row as a question about what your buyers will accept as evidence.
| Dimension | SOC 2 | ISO/IEC 42001 |
|---|---|---|
| Purpose | Attests to a service organization's security controls, with optional availability, processing integrity, confidentiality and privacy categories | Establishes, implements, maintains and improves an AI management system for organizations that provide or use AI systems |
| Framework assessed | 2017 Trust Services Criteria: 61 criteria, including 33 common criteria that cover security | Annex A: 38 controls under nine objective areas, from AI policies to third parties and customers |
| Output | A CPA attestation report, restricted in use (SOC 3 is the general use version) | A certificate issued by an accredited certification body, with a stated cycle end date |
| Type 1 and Type 2 | Type 1 covers control design as of a date. Type 2 adds an opinion on operating effectiveness over a period | No equivalent split. Certification is a point-in-time audit against the management system, followed by surveillance |
| AI impact assessment | Not a required element. Customers may ask how AI-related risks are handled inside the scoped system | Required through clauses 6.1.4 and 8.4, alongside AI risk assessment (6.1.2, 8.2) and risk treatment (6.1.3, 8.3) |
| Applicability control | Scope is set by the system description and the criteria you select | A statement of applicability must list necessary Annex A controls and justify each inclusion or exclusion |
| Who performs it | A licensed CPA firm acting as the service auditor | An accredited certification body. Accreditation of these bodies is voluntary, and ISO/IEC 42006:2025 adds requirements for AI certification |
| Confirm before buying | Whether your customers accept a Type 1 or need a Type 2 with a stated period | Which accredited bodies currently offer AI management system certification in your country and sector |
What a SOC 2 report shows a customer about AI systems
A SOC 2 report shows that controls over an AI product's infrastructure and operations were described and tested, not how the model behaves. A Type 1 report covers the system description and whether control design was suitable as of a single date. A Type 2 report adds an opinion on operating effectiveness over a period. Security is covered by the common criteria CC1 to CC9, which apply to every SOC 2. Privacy, processing integrity, availability and confidentiality apply only when the auditor and your management include them in scope. If your customers ask about output quality or data handling in model training, confirm with your auditor whether those topics sit inside the chosen categories before you promise coverage.
Distribution matters as much as content. A SOC 2 report is generally restricted in use, so it is typically shared under a non-disclosure agreement with prospects who have a need to know. A SOC 3 report covers the same categories in less detail and can be freely distributed, which makes it a public-facing trust artifact. Ask your auditor which report you can publish and which one your security reviewers should receive directly. Both reports are silent on fairness, bias, accuracy, transparency to end users and the impact of AI decisions on individuals, because those topics are outside the trust services criteria.
Those gaps are where ISO/IEC 42001 begins to matter. Its Annex A controls and the impact assessment in clauses 6.1.4 and 8.4 address questions a SOC 2 leaves open. Before you answer an AI governance questionnaire, list each question and mark whether a SOC 2 criterion, a published SOC 3 summary, or a separate AI management artifact would answer it. Questions that no current report covers should be documented as known gaps, with an owner and a plan, so that sales teams do not overstate what your attestation proves.
What ISO/IEC 42001 requires that a SOC 2 does not
A SOC 2 examines security controls against the Trust Services Criteria, while ISO/IEC 42001 requires a management system built around AI risk, AI impact and a justified list of controls. The cards below cover the elements a SOC 2 report does not test, and what to check before you promise a customer either one.
AI risk assessment and treatment
ISO/IEC 42001 requires you to identify AI risks through clauses 6.1.2 and 8.2, then select and implement treatments through clauses 6.1.3 and 8.3. A SOC 2 tests whether your security controls operate, but it does not require a risk process aimed at AI harms such as unsafe model outputs or misuse. Check whether your risk register names AI-specific risks, who owns each treatment, and how residual risk is accepted.
AI system impact assessment
Clauses 6.1.4 and 8.4 add planning and operational requirements for assessing the impact of an AI system on individuals and society. This has no direct equivalent in the Trust Services Criteria, so a clean SOC 2 report says nothing about whether impact was assessed. Ask who runs the assessment, when it is repeated after a model or data change, and where the results are kept as evidence.
Statement of applicability
Clause 6.1.3 requires a statement of applicability that lists the Annex A controls you need and justifies including or excluding each one. This document is the core of an ISO/IEC 42001 management system, and an auditor will read it first. A SOC 2 has no comparable document, since its scope is set by the system description and the criteria you select. Confirm that every exclusion has a written reason an auditor can test.
Annex A control areas
Annex A lists 38 controls under nine objective areas, including policies related to AI, internal organization, resources, impact assessment, the AI system life cycle, data, information for interested parties, use, and third parties and customers. Several areas, such as the life cycle and data controls, go beyond what a SOC 2 examines. Map each area to an existing owner before you start, because most gaps will sit in model and data governance rather than in access control.
Selective implementation of Annex A
Organizations are not required to implement every Annex A control. What matters is that the exclusions are justified in the statement of applicability and that the remaining controls are implemented and evidenced. A SOC 2 works differently, because the auditor tests the controls you describe against the criteria you chose. Ask your certification body how it expects exclusions to be documented and tested before you finalize scope.
Applies regardless of organization size
ISO/IEC 42001 applies to any organization, regardless of size, type or nature, that provides or uses products or services that use AI systems. A small AI product company is in scope in the same way as a large one, though the depth of controls should match its risk. Confirm with your buyer whether the standard is the right reference for their questions, since the management system must be maintained after certification, not only prepared for it.
Where SOC 2 and ISO 42001 work overlaps
SOC 2 and ISO/IEC 42001 both expect a documented management approach, named owners and evidence that controls run over time. ISO/IEC 42001 uses the harmonized structure shared by ISO management system standards, which helps teams reuse governance records, but the overlap is a starting point, not a equivalence claim.
Risk assessment and treatment
ISO/IEC 42001 adds AI risk assessment and AI risk treatment in clauses 6.1.2, 6.1.3, 8.2 and 8.3, alongside AI impact assessment. A SOC 2 expects a documented risk process that feeds the control set in the system description. A single risk register can often serve both, but AI-specific risks such as model misuse or harmful outputs may not appear in a security risk register. Confirm which AI risks your auditor and your ISO certification body each expect to see.
Policies and internal organization
ISO/IEC 42001 Annex A groups AI policy controls under A.2 and internal roles under A.3. SOC 2 common criteria CC1 to CC5 cover the control environment, including governance, accountability and commitment to competence. Policies written once can be mapped to both, but an AI policy must state responsibilities for AI systems, not only for information security. Check that each policy names an accountable owner and a review cycle.
Third parties and customers
Annex A control group A.10 covers third parties and customers, which matters when your AI product depends on model providers, data vendors or hosting services. SOC 2 covers vendor risk through the common criteria on risk mitigation. Both expect you to know which suppliers are in scope and how their performance is monitored. Ask your auditor whether they will test subservice organization carve-outs in the same way your ISO certification body does.
Change and AI lifecycle management
Annex A group A.6 covers the AI system lifecycle with nine controls. SOC 2 common criteria CC8 covers change management for the system. Model retraining, prompt changes and dataset updates can behave like changes that need approval, testing and rollback records. Where a model change is not a code change, define it in your change procedure so that both evidence sets capture it.
Data and information for interested parties
Annex A groups A.7 on data for AI systems and A.8 on information for interested parties overlap with SOC 2 confidentiality and privacy criteria. Data provenance, quality and handling records can support both, while customer-facing transparency statements are specific to ISO/IEC 42001. A SOC 2 privacy criterion does not prove AI transparency, so confirm what your customers expect to receive beyond the report.
Continual improvement and monitoring
Both standards expect evidence that controls are monitored and improved over time. ISO/IEC 42001 requires continual improvement of the AI management system, and SOC 2 Type 2 reports test operating effectiveness across a period. Internal audit findings, corrective actions and control metrics can be shared, but the two cycles differ. Confirm with your certification body and your CPA firm how they will sample and what period they will test.
Who assesses each framework and what each cycle produces
This table compares who examines each framework, what document comes out of the examination, and how long the evidence cycle runs. Read it to see that a SOC 2 is a CPA attestation over a period, while an ISO/IEC 42001 certificate depends on an accredited body and its accreditation status.
| Dimension | SOC 2 | ISO/IEC 42001 |
|---|---|---|
| Who performs the assessment | A CPA firm performing a SOC 2 examination under AT-C section 205 of the AICPA attestation standards | An external certification body. ISO does not certify organizations, and the body applies ISO/IEC 17021-1 plus ISO/IEC 42006:2025 for AI management systems |
| What the output is | A CPA attestation report with a system description and an opinion on controls (Type 1 at a date, Type 2 over a period) | A certificate that the AI management system was assessed against the standard, issued by the certification body |
| Who can use the output | Use is generally restricted to parties named in the report, while a SOC 3 is a general use report | The certificate and its scope statement are typically shared with customers, and buyers should check the scope listed on it |
| Assessment period | A Type 2 covers an observation period agreed with the auditor, and the report states that period | A certification cycle of three years, with the certificate showing the date the cycle completes, under European Accreditation FAQ 51.7 |
| Recurring work | Annual or periodic examinations are the norm for customers who expect current evidence | Surveillance activity during the three-year cycle, then recertification, planned across that cycle |
| Status of certification bodies | AICPA standards govern the CPA firm, and the AICPA's proposed baseline attestation revisions, if adopted, would apply to engagements beginning on or after June 15, 2029 | ISO/IEC 42001 is not listed as an endorsed sub-scope under Global ACI as of version 3.3, unlike ISO/IEC 27001 with ISO/IEC 27006-1 |
| What to confirm before buying | The CPA firm's standing with the AICPA and whether the report covers the trust services criteria you need | The body's accreditation for AI management systems, the accreditation body that issued it, and whether the certificate scope covers your AI products |
What drives the cost of a SOC 2 and an ISO 42001 certification
The cost of a SOC 2 and an ISO/IEC 42001 certification is mostly people time and auditor time, and the two are paid for differently. A SOC 2 is performed by a CPA firm, so the largest line is the examination fee. An ISO/IEC 42001 certificate is issued by an accredited certification body, so the largest line is the certification audit fee. Both also carry internal costs that rarely appear in a quote: engineers and control owners producing evidence, a compliance lead running the cycle, and the time spent on the AI impact assessment, which 42001 requires under clauses 6.1.4 and 8.4 and which a SOC 2 does not ask for. For cost estimates, the US Justice Department's regulatory analysis for its October 2024 proposed rule on US sensitive personal data (89 FR 86116) cited vendor publications putting a SOC 2 Type 1 audit at $5,000 to $25,000 and a Type 2 audit at $30,000 to $100,000. Those are vendor-sourced ranges from a federal rulemaking, not quotes, and they cover the audit only. Ask each firm what it includes.
The standard itself has a price, but it is a one-time purchase. ISO/IEC 42001:2023 costs CHF 225 as a PDF or ePub from the ISO store, and the IEC Webstore lists the same price. ISO/IEC 42006:2025, which sets the extra requirements certification bodies must meet when auditing AI management systems, is listed by ISO at CHF 159. Buy both before the readiness work starts, because your gap analysis should be measured against them. Certification fees, by contrast, recur. European Accreditation's FAQ 51.7 notes that under ISO/IEC 17021-1 the certification cycle is three years and the certificate shows when that cycle ends, so most organizations budget across that cycle, including surveillance audits in the intervening years. A SOC 2 is a point-in-time or period report, so its recurring cost is the annual re-examination, which for a Type 2 covers a new observation window and fresh sampling.
What to request in a written quote: for the SOC 2, the scope of trust services criteria, whether Type 1 or Type 2 is priced, the observation window length, sample sizes, the number of management representation cycles, and the cost of a second year. For the ISO 42001 certification, the certification body's audit days for stage 1 and stage 2, the surveillance and recertification fees across the three-year cycle, the accreditation status of the body for this scope, and any ISO/IEC 42006 related charges. Ask both providers which evidence they expect you to collect and which parts of the readiness work are included. Confirm with each firm whether the two engagements can share one evidence set, because duplicated control testing is often the largest avoidable cost when both reports are bought in the same year.
How to sequence SOC 2 and ISO 42001 when a company needs both
The sequence fixes the scope first, then builds one AI governance backbone that feeds both the ISO 42001 certification audit and a SOC 2 examination, so each assessor can reach its own opinion from shared evidence. Teams that skip the early steps usually rebuild evidence later.
Confirm what customers actually require
Start by listing each customer request in writing: whether the buyer wants a SOC 2 report, an ISO/IEC 42001 certificate, or a narrower AI governance answer such as a questionnaire or a policy pack. Sales, legal and the security lead should own this list, because it sets the deliverable for every later step. Confirm with the buyer whether they accept a SOC 2 report in place of a certificate, and whether they need a Type 1 or Type 2 report. The step is done when each requirement has a named owner and a stated deliverable, and no one is assuming that one document answers all of them.
Define the system and AI system boundary
Map the product, the infrastructure, the people and the third parties that make up the service, then decide which AI systems fall inside the boundary. The SOC 2 system description and the ISO/IEC 42001 scope are different documents, but they must describe the same production environment, or the two assessors will test different things. Record which models, data pipelines and hosting regions are covered, and which are excluded and why. The step closes when one boundary document is approved and both scope statements can be traced back to it.
Run the AI risk and impact assessment
Run AI risk assessment and AI risk treatment under clauses 6.1.2 and 6.1.3, then carry out AI system impact assessment under clause 6.1.4. The impact assessment is the AI-specific piece that a SOC 2 does not test directly, so it needs its own owner, usually the product or AI governance lead with input from security and privacy. Record the risks, the treatment decisions and the affected parties for each AI system in scope. The step is complete when each risk has a treatment decision and an accountable owner, and the impact assessment has been reviewed and signed off.
Build the statement of applicability
Work through the 38 Annex A controls and record, for each one, whether it is implemented and why, or excluded and why. Clause 6.1.3 requires this justification, and it is the document an ISO auditor will read first. Link each implemented control to its owner, policy and evidence source, and mark where a control overlaps with a SOC 2 criterion so that evidence can be reused. The step is done when the statement of applicability has been approved by management and each control points to a named evidence location.
Select the SOC 2 report type and period
Decide whether the first SOC 2 should be a Type 1 report, which covers the system description and control design as of a date, or a Type 2 report, which adds an opinion on operating effectiveness over a period. A Type 2 needs controls to have operated for the examination period before the auditor can test them, so the controls built in the earlier steps must be running first. Confirm the trust services criteria in scope, and note that the security criteria apply to every SOC 2. The step is closed when the report type, the period and the scope are agreed in writing with the CPA firm.
Schedule the certification and attestation audits
Book the ISO/IEC 42001 certification audit with an accredited certification body and the SOC 2 examination with a CPA firm, sequencing them so that the evidence period for each one is ready. Ask each provider how it will treat shared evidence, and confirm that the certification body has the scheme it needs for AI management systems, since ISO/IEC 42006:2025 sets additional requirements for bodies that certify these systems. Each assessor forms its own opinion from its own testing, so reused evidence reduces duplicated collection but never replaces the other assessor's work. The step closes when both audit dates, scopes and evidence requests are confirmed in writing.
Questions buyers ask before choosing SOC 2 or ISO 42001
Does a SOC 2 report satisfy a customer's ISO 42001 request?
No. A SOC 2 report is a CPA attestation on security controls, as of a date (Type 1) or over a period (Type 2), against the AICPA Trust Services Criteria. ISO/IEC 42001 is a management system standard that an accredited certification body certifies, and it adds AI impact assessment and Annex A controls that a SOC 2 does not cover. A customer asking for ISO 42001 expects a certificate with a defined scope. Where a buyer asks for a SOC 2 and an AI governance answer, the two can overlap on access, change and vendor controls, but each request still needs its own evidence. Ask the buyer which document they will accept, and whether they need the certificate, the report or a control mapping.
How long does a SOC 2 or ISO 42001 engagement take, and what drives the time?
The timing depends on scope and readiness more than on the framework name. For SOC 2, the main drivers are the number of Trust Services Criteria in scope beyond the common criteria, the observation window (a Type 2 needs controls operating over a period), and how much evidence already exists. For ISO 42001, certification bodies work to ISO/IEC 17021-1 for management systems, and European Accreditation FAQ 51.7 notes that the certification cycle in this case is three years, with the certificate showing the date that cycle completes. Other drivers include the number of AI systems in scope, the depth of the AI impact assessment and how many Annex A controls are justified for inclusion. Ask any provider for a written schedule tied to the defined scope.
What does each one cost, and which costs are priced separately?
Costs fall into the audit or certification fee, the preparation work, and the tooling and staff time that run the controls. The Justice Department's October 2024 proposed rule on U.S. sensitive personal data (89 FR 86116) cited vendor-based estimates of $5,000 to $25,000 for a SOC 2 Type 1 audit and $30,000 to $100,000 for a Type 2 audit. Those are estimates from one regulatory analysis, not current quotes. For ISO 42001, the standard itself is priced separately: the ISO store lists ISO/IEC 42001:2023 at CHF 225 as of October 2026, and the certification body's fee is a separate line that depends on scope and the three-year cycle. Ask each quote to separate the auditor fee, the preparation or consulting fee, the standard purchase and any recurring surveillance activity.
Can our own team run a SOC 2 or ISO 42001 program without outside help?
Often yes for the internal work, but the attestation or certification itself must come from an independent party: a CPA firm for SOC 2, an accredited certification body for ISO 42001. Your team owns the controls, the policies, the AI system inventory and the evidence that operates day to day. The skills gap is usually in translating control design into testable evidence, writing a SOC 2 system description, and building an AI impact assessment that holds up under review. Before deciding, check whether your staff has time to run the evidence collection each month and whether they have worked through an external audit before. Many teams use an outside party for readiness review while keeping ownership internal.
What does DeployOpen do for SOC 2 and ISO 42001 readiness?
DeployOpen prepares systems, controls and evidence for compliance assessments. For an ISO 42001 or SOC 2 path, that can include planning and implementing the controls in your own infrastructure, documenting them, and organizing the evidence an auditor will request. DeployOpen does not issue SOC 2 reports, attestations, ISO 42001 certificates or any other audit output. Those come from an independent CPA firm or an accredited certification body that you select. Work is usually fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and the quote follows from that written scope. Ongoing support and upgrades are available as retainers.
Should we fund the AI impact assessment before the SOC 2 or the certification?
Usually yes, if you sell AI features to customers who ask about governance. ISO/IEC 42001 requires AI risk assessment and risk treatment, and it adds a separate AI system impact assessment in clauses 6.1.4 and 8.4. A SOC 2 does not test that analysis, so starting it early gives you the scope and risk inputs that the statement of applicability and the control design depend on. ISO/IEC 42005:2025, published 28 May 2025, provides guidance on AI system impact assessment, and ISO/IEC 23894:2023 covers AI risk management. Fund the impact assessment first if your AI systems affect people in ways your customers must document. Fund the SOC 2 first if the immediate request is for a security attestation and your AI use is limited.
Can one set of controls serve both a SOC 2 and an ISO 42001 program?
Partly. ISO/IEC 42001 uses the harmonized structure shared by ISO management system standards, so it fits alongside ISO/IEC 27001 and can share governance and internal audit processes. Many security controls, such as access management, change control and supplier oversight, can serve both reports, but each must be mapped to its own criteria or Annex A controls. The statement of applicability in ISO 42001 must justify including or excluding each Annex A control, so the mapping is a deliberate document, not an assumption. Ask your auditor and certification body how they will accept shared evidence, because the sampling and scope rules differ between a CPA examination and a certification audit.
How DeployOpen prepares your team for SOC 2 and ISO 42001 readiness
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports, attestations or certifications, so the independent CPA firm or accredited certification body you choose remains the source of the opinion or certificate.
How we scope
- We agree scope, deliverables and timelines in writing before any work starts on SOC 2 or ISO 42001 readiness.
- Scope records which systems, AI features, data flows and third parties sit inside the boundary you plan to show.
- For SOC 2, we confirm the report type and trust services categories with your CPA before control work begins.
- For ISO 42001, we confirm the AI management system boundary and which Annex A controls your statement of applicability will address.
How we build
- We prepare control design, policies and procedures mapped to the criteria or Annex A controls agreed in scope.
- We harden the self-hosted platforms in your own cloud accounts, data centers or air-gapped networks where in-scope systems run.
- We run security testing of applications, APIs, infrastructure and AI systems to produce evidence that controls operate as described.
- We set up the impact assessment and risk treatment records that the AI management system needs to be auditable.
How we hand over
- We document the system description, control narratives, evidence locations and owners so your team can answer auditor requests.
- We deliver a written list of gaps, open decisions and the evidence an independent auditor will ask for.
- We train your staff on running the controls, collecting evidence and keeping AI impact assessments current after release.
- We hand over configuration, runbooks and documentation so your team can run the controls without us.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
- A retainer can cover evidence collection for a Type 2 observation period or periodic review of the AI management system.
- Ask any quote to separate one-time readiness work from recurring retainer work, and to state which auditor fees sit outside our scope.
- Confirm with your CPA or certification body which evidence and timelines they accept before we start.
