SOC 2 and ISO/IEC 42001: what each one covers.
When a regulated firm assesses an AI supplier, two standards tend to appear in the due diligence questionnaire: SOC 2 and ISO/IEC 42001. They are often mentioned together, but they answer different questions. This post sets out what each one covers, how they relate, and where Lynctera stands on each.
SOC 2
SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). An independent audit firm examines a service organisation's controls against the AICPA's Trust Services Criteria, of which security is the foundation; availability, confidentiality, processing integrity and privacy can be added to the scope.
There are two types of report. A Type I report considers whether the controls are suitably designed at a single date. A Type II report goes further and tests whether they operated effectively over a period, usually between three and twelve months, which is why it is the report most firms ask for. SOC 2 does not result in a certificate. The outcome is the auditor's report, which describes the controls, the tests performed and any exceptions found, and which is shared with clients under a confidentiality agreement.
ISO/IEC 42001
ISO/IEC 42001, published by ISO and the IEC in December 2023, is the first international standard for an AI management system. It follows the same structure as ISO/IEC 27001 and, like it, can be certified by an accredited body. Where SOC 2 asks whether a service and its data are protected, ISO/IEC 42001 asks whether the organisation governs the AI itself: who is accountable for it, how the impact of each AI system on people is assessed before it is used, how people oversee it, and how it is monitored and improved over its lifecycle.
How the two fit together
The two standards overlap in places, such as access control, supplier management and incident handling, but neither replaces the other. A supplier can hold a clean SOC 2 report and still have no defined process for deciding whether an AI system should be used at all. Equally, a well-governed AI programme says little about whether the infrastructure beneath it is secure. For that reason a firm placing client data with an AI supplier may reasonably ask to see evidence of both.
Where Lynctera stands
Our first SOC 2 Type II audit is complete, covering the period from August to October 2025. Our second observation period runs from November 2025 to the end of October 2026, and the report will follow once the auditor has completed its review. The current report is available on request through the Yellow Be trust centre.
Our ISO/IEC 42001 programme is in progress. We are not certified, and we have not set a public date for certification. Several of the controls the standard asks for are already part of how the platform works. Each AI agent we run has an impact assessment record, generated from its live configuration and kept current by our release checks, and completing the written risk analysis for every agent is part of the work still in progress. A named person signs off before anything consequential happens, and every decision is recorded. Anyone can report an adverse impact of our AI through Yellow Be's reporting form. We will post here when the programme reaches certification.
Once ISO/IEC 42001 is in place, we intend to pursue ISO/IEC 27001, the international standard for information security management. SOC 2 already covers much of the same ground, and because the two ISO standards share a structure, much of the management system built for one serves the other. As with ISO/IEC 42001, we have not set a public date.
A fuller description of the standard is on our ISO/IEC 42001 page, and the controls that apply across the platform are described on Governance.
If your risk or compliance team would like to go through either assurance in more detail, we would be glad to arrange it.