By SOC 2 Vendors editorial team · Published · Last updated
The AICPA proposed new 2027 SOC 2 Trust Services Criteria in late October 2026, with comments due January 15, 2027. If approved, they apply to engagements beginning on or after December 31, 2027, so a SOC 2 that starts in 2027 still uses the 2017 criteria with 2022 points of focus.
The AICPA announced proposed 2027 SOC 2 Trust Services Criteria on October 28, 2026, and if they are approved they would apply to engagements beginning on or after December 31, 2027. That means a SOC 2 examination that begins at any point in 2027 will still be performed against the 2017 Trust Services Criteria with the 2022 revised points of focus, unless the organization and its auditor choose to early-adopt once the new criteria are final. Public comments on the exposure draft are open until January 15, 2027.
Not before the end of 2027, and only if approved. The AICPA's announcement, the Journal of Accountancy and CPA Practice Advisor all report the same wording: the proposed 2027 criteria would be effective for engagements beginning on or after December 31, 2027, with early adoption permitted. The AICPA frames this as conditional ('if approved next year'), so nothing is locked in until the comment period closes on January 15, 2027 and the criteria are finalized.
Two things are worth noticing in that sentence. First, the trigger is when the engagement begins, not when the report is issued or when the review period ends. Second, the public announcements do not spell out how 'engagement beginning' maps onto a Type 2 review period that straddles the date. The full exposure draft may define this more precisely, but until the criteria are final, treat the exact boundary as a question for your auditor rather than something to plan around on your own.
There is a precedent for how long the AICPA gives the market. The 2017 Trust Services Criteria were released in April 2017 and, per KirkpatrickPrice's summary of the transition, SOC 2 reports had to use them beginning December 15, 2018. During the overlap, reports had to state which criteria set they used.
Almost certainly not if your next audit starts in 2027. Here is the effective-date math for common scenarios, based on the published 'engagements beginning on or after December 31, 2027' wording and assuming the criteria are approved as proposed.
If you are timing a first SOC 2 around customer deadlines, use our SOC 2 timeline calculator to see when your report would land. The criteria version will not change that timeline for anything starting in 2027.
The AICPA calls the proposal a significant modernization of the framework CPAs use to evaluate controls over information systems. The download page says the updates aim to enhance the relevance, clarity and usability of the criteria in light of changes in technology and third-party risk. The announcement describes four kinds of change to the criteria themselves:
The five trust services categories (Security, Availability, Processing Integrity, Confidentiality and Privacy) are still the frame, according to the Journal of Accountancy. Amy Pawlicki, the AICPA's vice president of assurance and advisory innovation, said the proposed revisions are intended to improve the usability of SOC 2 reports.
The exposure draft's title also covers the SOC 2 description criteria, which govern what goes into the system description section of a report. The AICPA's public announcement does not describe changes to the description criteria, and the download page we checked listed only the Trust Services Criteria files.
Not yet, and not as standalone criteria in what the AICPA has described publicly. The proposal adds expanded considerations for emerging technologies, including AI, in the form of new points of focus. Per the AICPA announcement and the Journal of Accountancy, the new AI-related points of focus address:
Points of focus matter, but they are not pass-fail requirements. Under the current framework, the AICPA has said the 2022 point-of-focus revisions did not alter the 2017 criteria, and CPA firms such as AAFCPA note that not every point of focus needs to be addressed by a control to satisfy a criterion. If the 2027 proposal keeps that structure, the AI points of focus will shape what auditors ask about rather than add a mandatory AI checklist.
For AI companies this is still a meaningful shift. Until now, the AICPA had published no AI-specific SOC 2 guidance, and auditors built their own AI evidence requests on top of the 2017 criteria. A Cloud Security Alliance research note from August 30, 2026 described that gap and warned that two AI companies could hold clean SOC 2 Type 2 reports while testing different controls. The proposed points of focus are the first AICPA text that names AI risks inside SOC 2. Our guide to AI controls in SOC 2 covers the evidence auditors already request today.
For most companies, no, at least not until the criteria are final. Early adoption is permitted, but there is nothing final to adopt as of November 2026, and the criteria could change after the comment period. Weigh it this way:
Note that you do not need the 2027 criteria to address AI risks. Auditors can and do test AI-related controls under the current criteria today, and documenting those controls now will make a later transition easier either way.