SOC 2
Voluntary. SOC 2 is an attestation framework, not legislation. A law firm is usually reading a vendor’s report, and nothing requires the firm to commission its own unless a contract mandates it.
A CPA firm’s report, under AICPA standards, on a service organisation’s controls for security, availability, processing integrity, confidentiality or privacy.
MaintainedLast reviewed
Key facts
- Issued by
- American Institute of CPAs (AICPA)
- Sources listed
- 1
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The AICPA describes SOC 2 as reporting on an examination of controls at a service organisation relevant to security, availability, processing integrity, confidentiality, or privacy. An independent CPA firm performs the examination and issues the report, under the AICPA’s professional standards. The AICPA publishes the standards and the guidance. It does not issue the reports, and it is not a management-system certificate of the ISO kind.
A report has a scope, a period, the categories that were in scope, and an opinion. Vendors often add the words “Type I” or “Type II”. In the AICPA’s usage a Type I report covers the description and design of controls at a point in time, and a Type II report also covers whether the controls operated effectively over a period, so a Type I report is weaker evidence. The report is what states the date or period and the opinion. This page does not reproduce the AICPA’s Trust Services Criteria. They are the AICPA’s.
Who it applies to
SOC 2 is a report a service organisation can commission for its customers. A law firm is usually the user entity reading a vendor’s report, not the organisation being examined. Nothing requires a firm to commission its own SOC 2. A report about the vendor’s platform is not a report about the firm’s own network.
What it asks of a law firm using AI
- Ask for the report, not the logo. Read which of the five categories are in scope. In a SOC 2 examination the Security (common criteria) category is always in scope; the other four categories are optional.
- Read the period the opinion covers and the system description. A report for a different product, a different region, or a period that has ended is a different document.
- Read the exceptions and the complementary user-entity controls. Those are controls the report assumes the customer will do. A firm that does not do them is outside the conditions of the opinion.
- Do not treat SOC 1, SOC 3, or “SOC 2 Type II” in a blog post as the same artefact. SOC 3 is a shorter public report. The examination report is the one that carries the opinion in full.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Processing integrity is one of the categories an examination can cover. If it is not in the report’s scope, the report says nothing about it. Even when it is in scope, it is about the vendor’s stated system objectives, not about legal accuracy. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | Reading the report, the carve-outs and the user controls is the due diligence. A sentence in a security white paper is the prompt to ask for the report. It is not the report. |
| Confidentiality Whether client and other confidential information can go into the tool. | Confidentiality and privacy are optional categories in the AICPA’s description. A report that covers only security does not, on that description, examine the confidentiality or privacy category. Client confidentiality remains the solicitor’s duty. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | This framework records SOC 2 next to ISO 27001 and IRAP. “Present” means a source names a SOC 2 report. It does not mean the firm has read the opinion, and it does not mean every category was examined. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | A SOC 2 report can describe where the examined system runs, if the system description says so. The AICPA landing page does not require a country. Read the description. Do not infer it. |
Sources
Checked 2026-10-10. Issued by American Institute of CPAs (AICPA).