What is being proposed?
A restructuring: consolidating duplicated concepts, removing some criteria, adding others and rewriting language so each criterion reads consistently. Plus new points of focus on AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management and automated decision-making. The AICPA's Amy Pawlicki describes the aim as making SOC 2 reports more usable and the criteria adaptable to rapidly evolving technologies.
What happens to your controls when criteria change?
Your controls stay; the map changes. A SOC 2 platform holds a mapping from each control to one or more criteria, and the auditor tests controls against criteria. When the criteria are consolidated or renumbered, every platform has to republish that map, and every customer has to review which controls now satisfy which criteria, where a removed criterion leaves an orphan control, and where an added criterion has no control yet. That is the same work as adding a framework, which is why our switch guide on mapping controls across frameworks applies here.
What does this mean for a switch in 2027?
Three things. First, do not let a vendor's "2027-ready" claim decide the switch; the final text does not exist yet, and no vendor can have mapped it. Second, ask every shortlisted vendor, in writing, how it handled the last criteria change and whether remapping is included in the plan. Third, if your Type II observation period will start in 2028, you will be examined under the new criteria from the first day of that period if they are approved, so plan the migration to finish well before the period opens.
Which of the eight platforms say anything about criteria updates?
None of the pages we read on 29 September describe how criteria changes are handled, which is normal: it is not a sales page topic. The question belongs in the demo. The vendors with published framework cross-mapping (Scytale and Sprinto describe it on their pages) have the machinery for a remap; the others may too.
What about the AI points of focus?
They affect you twice. Your own AI features will be in scope if you have any. And the platform's agents, which draft policies, collect evidence and answer questionnaires, are AI systems operating on your evidence. Ask each vendor how its agent actions are logged and reviewed. Our update from 7 September on AI features you gain or lose by switching lists which agents each vendor describes.
Does this change the finder?
No. The finder scores what vendors publish today. We have added "remapping on criteria change" to the audit path questions in the switch planner.
What else should a switcher know?
When would the proposed 2027 SOC 2 criteria apply?
If approved, to engagements beginning on or after 31 December 2027, with early adoption permitted. Comments are open until 15 January 2027.
Should I delay a platform switch until the 2027 criteria are final?
Not on that basis alone. Switch when the service model fits; ask the target vendor to commit in writing to remapping your controls when the final text is published.
Which sources did we use?
Source: AICPA news release, 28 October 2026 · read 2026-10-28
Source: AICPA exposure drafts · read 2026-11-05