ISO 42001 vs SOC 2 for AI Vendors: What Each Proves to Regulated Buyers

Why buyers treat these artifacts as interchangeable

Regulated buyers evaluating AI vendors usually receive a SOC 2 report, an ISO certificate, or both. In many due diligence files the two sit in the same folder and satisfy the same checkbox: independent assurance exists. That shortcut hides a real difference in what is being assured.

The more useful question is not which artifact is better. It is what each one actually proves, what it leaves unproven, and which questions remain open once both are in hand. Answering that lets a compliance team scope due diligence accurately instead of assuming a certificate covers more than it does.

What SOC 2 proves, and the difference between Type I and Type II

A SOC 2 report is an attestation by an independent auditor about a service organization's controls, evaluated against the Trust Services Criteria. The report describes the system in scope, the controls the vendor says it operates, and the auditor's opinion on them.

The report type matters. A Type I report addresses whether controls are suitably designed at a point in time. A Type II report also addresses whether those controls operated effectively over a defined period. For a vendor already serving production customers, Type II is the more informative of the two because it shows controls working over time, not only on paper.

What a buyer can conclude is bounded by the report's system description and period. Controls outside the described system are not covered, and activity outside the period is not covered. A SOC 2 report is a statement about the vendor's control environment. It is not a statement about the behavior of any individual AI model or agent.

What ISO/IEC 42001 certifies, and the adjacent ISO references

ISO/IEC 42001:2023 is the international standard for AI management systems. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS): the interrelated elements an organization uses to set policies, objectives and processes for the responsible development, provision or use of AI systems. It applies to organizations of all sizes and sectors that develop, provide or use AI.

Certification is voluntary and performed by independent certification bodies. A certificate gives independent confirmation that the organization's AIMS meets the requirements of ISO/IEC 42001:2023. ISO describes the standard as a management framework that supports compliance. It is not a guarantee of legal compliance, and a buyer should not map a certificate directly to a legal obligation.

Several neighboring documents are easy to confuse with it. ISO/IEC 23894:2023 is guidance on AI risk management, so it is a reference for risk process questions rather than a certificate to request. ISO/IEC 27090:2026 addresses security threats and compromises to AI systems. ISO/IEC 27001 is the information security management system standard that many vendors hold alongside 42001. ISO/IEC AWI 42003, guidance on implementing 42001, is still under development and should not be cited as a current requirement.

Side-by-side: scope, assurance model and limits

The table separates the two artifacts by the dimensions that matter during due diligence. The last row is the same for both.

• Subject of assurance: SOC 2: the service organization's controls against the Trust Services Criteria. ISO/IEC 42001: the organization's AI management system.
• Assurance model: SOC 2: auditor attestation, with Type I at a point in time and Type II over a period. ISO/IEC 42001: certification by an independent certification body against the standard's requirements.
• Primary question answered: SOC 2: are the described controls designed, and for Type II operating, effectively? ISO/IEC 42001: does the organization manage AI through defined policies, objectives and processes?
• AI specificity: SOC 2: not AI-specific by design. ISO/IEC 42001: written for organizations that develop, provide or use AI systems.
• What the buyer should verify: SOC 2: report type, period and system in scope. ISO/IEC 42001: certification body, scope statement and the AI systems and services covered.
• What remains unproven: Both: what a specific AI system was permitted to do, and what it did in a given interaction or tool call.

What neither artifact proves about runtime behavior

Both artifacts operate at the level of the organization. SOC 2 speaks to controls and ISO/IEC 42001 speaks to a management system. Neither is a record of an individual AI interaction. A buyer holding both can still be unable to answer the questions a regulator or auditor is likely to ask about a specific event: which policy applied, whether the action was allowed, blocked or modified, and what the system actually did.

This is a limit of the artifact type, not a criticism of either. A management system describes how an organization intends to manage AI. A period-based attestation describes how its controls performed. Evidence of behavior in a single interaction or tool call is a different kind of record, and it has to be produced by something that sits where those interactions happen.

There is also a scoping risk. Both documents are bound by their stated scope, so AI features the buyer plans to use may sit outside the certified or attested boundary. Regulatory expectations are moving as well. The EU AI Act, Regulation (EU) 2024/1689, was amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI) in July 2026. Treat any vendor claim that a certificate satisfies a specific legal obligation with caution, and have legal counsel confirm obligations against current text as of November 2026.

Runtime enforcement and audit-ready evidence

Closing the gap requires a control point in the execution path, where interactions and tool calls are evaluated against policy and the outcome is recorded. A certificate cannot be that control point, and a report cannot reconstruct it after the fact.

Trussed provides this for regulated enterprises. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, with actions to allow, redact, block, rate limit or escalate for human approval at the level of individual interactions and tool calls. Policy is enforced at runtime, not reviewed after the fact, and enforcement generates continuous audit-ready evidence mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST. Deployment is self-managed in the customer cloud, with configurable retention and data residency.

Trussed itself holds SOC 2 Type II and ISO 27001. Those artifacts describe its organization and controls, and the runtime evidence is a separate record, which is the distinction this comparison is built on.