SOC 2 and the training evidence employers keep about AI operations staff

SOC 2 auditors check that a service organisation's controls work, and several of those controls concern people: commitment to competence, security awareness training, policy acknowledgement and access reviews. When staff run or review AI agents, employers keep evidence that each person was trained for that work, when, and on what. Knowing what that evidence looks like helps you supply it.

What does SOC 2 look at when it comes to people?

SOC 2 is an attestation report on a service organisation's controls, prepared by an independent auditor against criteria covering security, availability, processing integrity, confidentiality and privacy. A Type 1 report looks at whether controls are designed properly at a point in time. A Type 2 report tests whether they operated effectively over a period, which means the auditor samples real evidence.

Among the criteria, several concern people. In substance, the organisation should show a commitment to attracting, developing and keeping competent individuals; define roles and responsibilities; train staff, including on security; have staff acknowledge codes of conduct and policies; and review who has access to what. These are tested by sampling records: training completions, onboarding checklists, signed acknowledgements, access review sign-offs.

Once agents act inside the service, people who review or direct them become part of the controls. An auditor testing processing integrity may ask how the organisation knows agent outputs are reviewed by competent staff. The employer answers with evidence about you. The team-level picture is covered in SOC 2 and evidence of training for teams running AI agents.

Who does it apply to?

SOC 2 is not a law. Service organisations, such as software providers, outsourced operations centres, payment processors and data processors, obtain SOC 2 reports because their customers ask for them. It is most common in the US and widely requested internationally by enterprise customers.

So the employers who keep SOC 2 training evidence are often the suppliers behind the brands you know: the firm running a bank's customer service, the platform processing an insurer's claims, the company providing an AI workspace. These employers can be a good first step into AI operations, because their processes are documented and audited.

What training evidence do employers keep about AI operations staff?

Expect an employer with a SOC 2 Type 2 report to keep, for each person in an AI operations role:

1. Onboarding records: the date you started, the role you were assigned, and the checklist completed.
2. Policy acknowledgements: signed confirmation that you read the code of conduct, the security policy and the acceptable use policy.
3. Security awareness training: completion dates for initial and refresher training.
4. Role-specific training: records showing you were trained on the agents you review, the review standard and the escalation route.
5. Competence evidence: assessments, certificates or sign-offs that show you met the standard, not only that you attended.
6. Access approvals and reviews: who approved your access to the agent workspace, and when it was last reviewed.
7. Refresher and change training: records when the agent or the process changed and you were retrained.

The difference between attendance and competence matters. A record that you sat through a session is weaker than a record that you were assessed against a standard. The idea is explained in what is evidence of competence.

Which roles and competence does this create?

SOC 2 creates demand for two kinds of people around agents. The first are the reviewers and operators whose training is evidenced; their competence must be real enough to survive sampling. The second are the people who keep the evidence: compliance coordinators, training administrators, GRC analysts and audit liaisons. Titles vary; the duties to read for are evidence collection, control testing, training records, access reviews and audit support. For a list of the titles used for supervisory roles, see what job titles employers use for people who supervise AI agents.

How do you show employers you will hold up to an audit?

What might an interviewer ask?

1. "Our SOC 2 auditors will sample your training records. What will they find?" Show you understand that records must exist, be dated and show competence.
2. "How would you prove you reviewed an agent's output properly?" Point to decision records with reasons, not only to approvals.
3. "What would you do if you realised your access to the agent workspace was broader than your role needed?" Report it so access can be corrected.

A support specialist we will call Ravi, moving into an AI operations analyst role at a software provider, prepared by listing every certificate and training record he could produce, with dates. The hiring manager noted that he was the first candidate to arrive audit-ready.

What does SOC 2 not cover?

It does not certify individuals. It is not a legal requirement, though contracts may make it one. It does not set AI-specific requirements, so organisations decide how agent controls fit into their criteria. And it does not replace laws such as the EU AI Act's literacy duty, discussed for staff in what Article 4 means for employees whose employers use AI agents.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Certificates from Pryme Intelligence Academy are built to be evidence. They carry an issue date and expiry, are issued through VerifyDoc.ai, and can be checked at source by number or QR code; a lapsed or revoked certificate shows as such on the same page. That suits an employer whose auditor will sample staff records.