A SOC 2 report on an AI agent platform covers the controls the vendor describes for its service, measured against criteria for security and, if chosen, availability, processing integrity, confidentiality and privacy. It tells you those controls were designed and, in a Type 2 report, operated over a period. It does not test whether the agents make good decisions.
What does SOC 2 cover, in plain words?
SOC 2 is an attestation, not a certification. An independent auditor examines a service organisation's description of its system and its controls, and reports whether the description is fair and the controls meet the chosen criteria. The criteria come in five categories:
- Security: protection against unauthorised access and use. Always included.
- Availability: the system is available for operation and use as committed.
- Processing integrity: processing is complete, valid, accurate, timely and authorised.
- Confidentiality: information designated confidential is protected.
- Privacy: personal information is collected, used, retained and disposed of as committed.
A Type 1 report assesses design at a point in time. A Type 2 report also tests operating effectiveness over a period, and lists exceptions where a control did not work for some samples. For reading technique, see our guide to reading an agent vendor's SOC 2 report.
Who gets a SOC 2 report, and who reads it?
Service organisations whose customers rely on them to handle data or run processes: software platforms, hosting providers, payment processors and, increasingly, AI agent platforms. The vendor commissions the audit; customers and their auditors read the report under a confidentiality agreement. Our answer to whether an agent platform should have a SOC 2 report is yes for any vendor holding customer data or acting in customer systems.
How does scope work on an agent platform?
Scope is set by the system description, and the vendor writes it. That is the single most important thing to read, because an agent platform has more moving parts than a typical service.
A complete description for an agent platform should name:
- The agent runtime, where agents execute and call tools.
- Connectors to customer systems, with how credentials are stored and permissions set.
- The configuration layer, where agent instructions, sources and limits are defined and changed.
- The model provider, as a subservice organisation, either included or carved out.
- Logging, including records of agent actions, not only user access.
- Customer responsibilities, listed as complementary controls.
If the description covers the web application and hosting but treats the runtime and connectors as out of scope, the report says little about the part of the platform that acts in your systems.
Criteria selection matters too. Processing integrity is the category closest to agent work, because it is about whether processing is complete, accurate and authorised. Few vendors include it, and even when they do, it tests whether the platform processes as designed, not whether an agent's judgement on a case was right.
What does a SOC 2 report not test about agents?
SOC 2 tests controls. It does not test outcomes of agent reasoning. So it will not tell you:
- whether answers are grounded in the right sources;
- whether the agent refuses requests outside its scope;
- whether it escalates to a person when it should;
- whether its behaviour has drifted since the last test;
- whether it performs on your cases rather than the vendor's.
Those are the questions that certifying an agent answers, case by case. Our guide to what it means to certify an agent covers that evidence.
How do you use the report well?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Report is the right type and current | Ask for Type 2 covering a recent period; bridge letter for any gap | Report and bridge letter on file |
| Scope reaches agent components | Check runtime, connectors and configuration layer are in the description | Scope mapping note |
| Model provider understood | Identify inclusion or carve-out; obtain separate assurance if carved out | Subservice review |
| Agent changes controlled | Look for change controls covering instructions, sources and model versions | Control references from the report |
| Agent actions logged | Look for logging controls that cover actions, not only access | Control references from the report |
| Your controls in place | Implement complementary controls the report assigns to you | Control mapping with owners |
| Agent quality tested | Certify each agent on your own cases | Per-agent results |
If a failed control on your side should leave a record, our failed certification run report template shows how to document an agent that did not meet its floor.
What will your auditor or supervisor ask?
- Which SOC 2 report did you rely on, and what period did it cover?
- Did its scope include the components that act in your systems?
- How did you treat the model provider?
- Which complementary controls are yours, and do you operate them?
- How did you test the agents themselves?
What does SOC 2 not cover beyond agents?
It is not a certification of an information security management system, which is ISO/IEC 27001's role; see ISO/IEC 27001 vs SOC 2 for agent platforms. It is not an AI governance standard. It does not establish compliance with laws such as DORA in EU finance or NIS2 for essential and important entities; our answer to whether NIS2 applies to agent platforms covers the latter.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
A platform's SOC 2 report covers how it runs. Pryme adds evidence about what each agent does: every verdict is filed in an append-only record, and Attest certifies each agent on the customer's own cases. A buyer can then point to both the vendor's controls and the agent's results.
Questions people ask
Should an agent platform include processing integrity in its SOC 2 scope?
It is worth asking for, because it is the category closest to whether processing is complete and authorised. It still does not test an agent's judgement on cases.
Does a SOC 2 report cover the model provider?
Only if the provider is included in scope. Most reports carve it out, so you need separate assurance for the model provider.
Is a SOC 2 report enough for regulated buyers?
It is one piece. Regulated buyers usually also need security certification, resilience evidence, AI governance and their own testing of the agents.