SOC 2 and ISO 27001 for a self-hosted AI platform: mapping the controls

Ask a security team what they need before they will approve an AI tool and two acronyms come up fast: SOC 2 and ISO 27001. They get treated as interchangeable trust badges, which is a mistake, because they are different instruments that answer different questions. If you run AI in-house, understanding the difference tells you what evidence you actually have to produce, and where owning the system helps.

What SOC 2 actually is

SOC 2 is an attestation. An independent auditor examines your controls against the Trust Services Criteria published by the American Institute of CPAs and writes an opinion on them. There are five criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Only Security, sometimes called the common criteria, is mandatory. You choose the others based on what you promise customers.

There are also two flavours. A Type I report looks at whether your controls are well designed at a single point in time. A Type II report watches whether they actually operated effectively over a period, usually six to twelve months. Enterprise buyers who know what they are doing ask for Type II, because a snapshot of good intentions is easy and a track record is not.

What ISO 27001 actually is

ISO 27001 is a certification, which is a different animal from an attestation. Instead of an auditor's narrative opinion, you get a pass-or-fail certificate from an accredited body that says your information security management system meets the standard. The 2022 edition organises 93 controls into four themes: organisational, people, physical and technological. You do not implement all 93 blindly. You run a risk assessment, decide which apply, and record your reasoning in a statement of applicability.

The useful news is that these two frameworks are not rivals so much as cousins. The overlap between the SOC 2 criteria and the ISO 27001 controls is large, commonly estimated around eighty percent, so the evidence you gather for one carries most of the weight for the other. Doing both is far less than twice the work.

Where self-hosting maps cleanly

Several of the criteria and controls land naturally when the system lives in your own environment. Confidentiality, one of the five Trust Services Criteria, is straightforward to evidence when the data never leaves a boundary you control and the encryption keys are held by you rather than a third party. Access control, a whole cluster of ISO 27001 technological controls, is yours to enforce end to end. Physical security, an ISO theme in its own right, becomes a question about your own premises rather than a paragraph of trust in someone else's data centre you will never visit.

The flip side is real and worth stating. Owning the controls means owning the evidence. Nobody hands you a report to forward. You have to run the access reviews, keep the logs, test the backups and document the lot. A well-built self-hosted platform makes that easier by generating the audit trail for you, but the responsibility is yours. That is the trade: less borrowed trust, more of your own.

How to think about it as a buyer or a builder

If you are evaluating AI, do not accept a vendor's SOC 2 as evidence about your own use of their tool. Ask what controls you are responsible for and whether the architecture lets you satisfy them. If you are building an internal capability, decide early which criteria and controls you will need to show, because retrofitting an audit trail onto a system that was not designed to keep one is miserable. Either way, the frameworks are not the goal. They are a structured way of proving that the sensible things are actually being done, and a self-hosted design gives you direct control over most of the sensible things.

This paper is general information rather than a compliance opinion. The exact scope of a SOC 2 examination or an ISO 27001 certification for your organisation is a conversation for your auditor and your security function.