International perspectives for SOC and trust in the age of AI

Artificial intelligence is no longer a discussion restricted to the areas of technology. As it starts to influence processes, services, decisions, and business models, a new expectation on the part of customers, investors, regulators, and partners is also growing: the ability of organizations to demonstrate that they use this technology in a safe, controlled, and transparent way. 

In this scenario, digital trust plays a central role. It is not just about adopting AI tools or accelerating digital transformation, but about demonstrating that there are governance mechanisms capable of controlling risks, protecting information, and sustaining decisions relevant to business. 

The question is no longer whether the organization uses artificial intelligence. The question now is another: how does it prove that it has adequate controls to govern its use? 

The gap between adoption and governance 

The use of artificial intelligence is already a consolidated reality in organizations. The challenge becomes the maturity of the mechanisms used to govern it. 

Data from Grant Thornton's Cyber & Risk Survey and AI Impact Survey, presented during the SOC in the Age of AI: The New Pillar of Digital Trust, show that 57% of organizations point to governance and the use of AI as a top source of risk or future regulatory scrutiny. At the same time, only 26% of technology leaders say they have advanced, integrated AI governance based on data monitoring.  

Another fact stands out: 78% of organizations do not believe they would be able to pass an independent AI governance audit in the next 90 days. 

These numbers reinforce an important reality. Technology adoption is advancing rapidly, but the ability to demonstrate controls, responsibilities, and evidence still poses a challenge for many companies. 

Trust needs to be demonstrated 

Historically, organizations demonstrated maturity through certifications, compliance assessments, and internal control mechanisms. 

With the evolution of artificial intelligence, this process takes on a new dimension. 

Today, investors, customers, and regulators want to understand not only what technologies are utilized, but also how those technologies are supervised, monitored, and controlled over time. 

In this context, SOC reports and ISO certifications become relevant instruments to demonstrate confidence in the market. 

More than filling out questionnaires or declaring that certain controls exist, organizations are now required to present independent evidence that their control environments work effectively. 

The role of SOC reporting 

SOC (System and Organization Controls) reports are among the main mechanisms used to demonstrate the effectiveness of the internal control environment. 

• SOC 1 is typically applied in situations in which the services provided by the organization may impact processes related to customers' financial statements. 
• SOC 2, on the other hand, is focused on the trust criteria established by the AICPA, covering aspects such as security, availability, processing integrity, confidentiality, and privacy. 

An important feature of these reports is the evaluation of the operational effectiveness of the controls. 

While a Type 1 report verifies that controls were properly designed and implemented by a specific date, the Type 2 report seeks to demonstrate how those controls operated over a period of time. 

This difference gains even more relevance in environments that use artificial intelligence, in which the market starts to demand consistent evidence of monitoring and supervision. 

SOC and ISO: complementary approaches 

During the discussions at the meeting, it became evident that SOC reports and ISO certifications should not be seen as competing initiatives. 

On the contrary. They perform complementary functions within the construction of digital trust. Among the most relevant certifications in this context are: 

• ISO 27001, focused on information security management systems; 
• ISO 27701, related to privacy management and data protection; 
• ISO 42001, aimed at the governance of artificial intelligence. 

While ISO certifications demonstrate that the organization has implemented structured management systems, SOC reports provide detailed evidence on the effectiveness of the established controls. 

Brittany Barbosa, leader of the Strategic Assurance and SOC Services practice at Grant Thornton US, reinforced that ISO certifications do not replace SOC reports, just as SOC reports do not replace ISO certifications. According to her, the combination of these initiatives tends to offer the market a more robust level of credibility and trust. 

How AI is changing assurance processes 

Artificial intelligence is also beginning to directly influence the assurance criteria themselves. In the international panel, one of the updates discussed was the proposal to revise the SOC 2 criteria by the AICPA, explicitly incorporating risks related to the use of AI, emerging technologies, and new challenges associated with digital governance. 

The proposal expands attention on topics such as: 

• AI governance; 
• Inventory of AI solutions and agents used by the organization; 
• Data governance; 
• Human supervision of results; 
• Change management; 
• Access control; 
• Continuous monitoring; 
• Use of third-party templates and components. 

According to Brittany Barbosa, one of the most relevant changes is related to the need to demonstrate effective human supervision. It is not enough to state that a person reviews the results produced by technology. It will be necessary to demonstrate evidence that this review occurs and is part of the operational process. 

Another aspect highlighted was the growing relevance of access management and change management in AI-supported environments, especially when templates, prompts, data sources, and agents can change over time. 

A new architecture for digital trust 

Throughout the discussions, it became evident that digital trust depends on different elements of acting in an integrated way. 

Among them are: 

• Transparency, especially about the use of data and artificial intelligence. 
• Independent evidence, capable of demonstrating that control exists and operates effectively. 
• Controls related to security, privacy, monitoring and risk management. 
• Governance, responsible for defining roles, responsibilities, policies, decision criteria and supervision mechanisms. 

The combination of these layers allows organizations to objectively demonstrate to the market the robustness of their control environments. 

Digital trust as a competitive differentiator 

Artificial intelligence will continue to expand its space in organizations and transform processes, products, and business models. 

In this scenario, the differential will not only be in the ability to adopt new technologies, but in the ability to demonstrate that they are used within a controlled, transparent and reliable environment. 

SOC reports, ISO certifications, and robust governance structures start to play an important role in this journey. More than compliance initiatives, they become instruments capable of strengthening credibility, supporting access to markets, and responding to the growing expectations of customers, investors, and regulators. 

In the age of AI, trust cannot be assumed. It needs to be demonstrated through governance, controls, independent evidence, and transparency.