What Does SOC 2 Actually Require When You're Building With AI?

SOC 2 doesn't have an 'AI clause,' which is exactly why teams get it wrong. The same Trust Services Criteria apply, but your LLM API just became a subprocessor handling customer data, and your auditor will notice.