SOC 2 vs ISO 27001 for AI Companies: Which to Get First and How to Scope It

Choosing between SOC 2 and ISO 27001 is like a restaurant choosing between a hygiene certificate by the door and an inspector's detailed report for serious customers. Both come from an independent examiner, but each satisfies a different visitor. This guide shows how to pick your first credential from your own pipeline, scope it to cover your AI and build one control set for both.

The difference in brief

SOC 2 is an attestation report. An independent CPA firm examines your controls against the AICPA Trust Services Criteria. A Type I report checks design at one point in time. A Type II report tests whether controls worked over a period, typically three to twelve months, and lists any exceptions.

ISO/IEC 27001 certifies an information security management system: a defined scope, risk assessment, internal audit and management review. The 2022 edition has 93 Annex A controls, and the transition from the 2013 edition ended on 31 October 2025. A certificate lasts three years, with annual surveillance audits.

Neither was written for model risks such as prompt injection, where hidden text manipulates a model. Treat both as the security foundation, not the AI answer.

Let your pipeline choose the first one

Neither is better in general. In our view, US buyers tend to ask for SOC 2 Type II, while buyers in Europe, the UK, India, the Middle East and much of Asia often favour ISO 27001. Patterns are not proof, so check your own data first.

• Count the asks: record which credential each questionnaire and RFP named over two quarters.
• Weight by revenue: one large deal can outweigh ten small prospects.
• Read the contract language: "SOC 2 Type II or equivalent" may accept ISO 27001, if confirmed in writing.
• Ask stalled deals: lost prospects will often say which evidence was missing.
• Check sector rules: request the buyer's third-party risk policy, not a summary of it.

Scope it so your AI is covered

The most common weakness is scope, not the choice of standard. A credential covering the web application and corporate IT, but not the model pipeline, answers yesterday's question. Trace one customer document from upload to output, and keep every component it touches in scope.

Under the SOC 2 carve-out method, a model provider's controls are excluded from your report and listed as controls you rely on. That is acceptable, but buyers will then ask how you gain comfort over the provider. Keep its assurance report, your review of it and your data processing terms ready.

Build one control set for both

Most AI companies that sell internationally end up holding both credentials. The AICPA publishes a mapping between the Trust Services Criteria and ISO 27001, and the overlap is large. Build one control set, map it to both, and collect evidence once.

The separate work is smaller than expected. ISO 27001 adds management system artefacts, such as the Statement of Applicability, which lists the controls that apply and why. SOC 2 adds a system description and proof that controls ran throughout the period.

A worked plan (hypothetical)

A 45-person AI company in Pune finds 14 questionnaires in two quarters. Nine US buyers named SOC 2, four UK and EU buyers named ISO 27001, and one accepted either. US deals are about 62% of pipeline value. The team therefore starts with a SOC 2 Type I, follows with a six-month Type II, and begins ISO 27001 in month seven.

Cost follows drivers you can estimate early: scope size, Trust Services categories, observation period, entities and sites, existing evidence and remediation effort. Excluding the model pipeline to save money is a false economy, because it removes the value as well.

Why the choice matters more in 2026

Buyers are scrutinising suppliers harder. Verizon's 2025 Data Breach Investigations Report found third parties involved in 30% of breaches, double the previous year. EU AI Act Article 50 obligations have applied since 2 August 2026, and Annex III high-risk obligations apply from 2 December 2027. AI questions will increasingly sit on top of this security baseline, not replace it.