Short answer
Three different tools for different buyers. SOC 2 (and from 31 Dec 2027, its new 7 AI points of focus) is the US enterprise baseline. ISO 42001 is the EU and regulated-industry answer — the AI management-system certification. NIST AI RMF is a voluntary reference framework — vendors align with it, buyers cite it, no one certifies against it. Most AI startups ship all three artefacts, in that order.
This piece covers what each is, a side-by-side, the 2027–2028 timeline, and a sequencing plan for a small AI team. For the EU AI Act angle in depth, see our EU AI Act, NIST AI RMF and ISO 42001 explainer.
Side-by-side
| Dimension | SOC 2 (2017 / 2027) | ISO 42001 | NIST AI RMF |
|---|---|---|---|
| Type | US attestation | International certification | US framework (not certifiable) |
| Issuer | Licensed CPA firm | Accredited certification body | Self-attested alignment statement |
| Scope | Service organisation | AI management system (org-wide) | Reference framework for AI risk |
| AI-specific? | 2027 revision adds 7 AI points of focus | Yes — purpose-built | Yes — purpose-built |
| Buyer recognition | Very high (US) | High (EU, regulated) | Moderate (US questionnaires) |
| Report cycle | Annual Type 2 + bridge letter | Three-year certificate + annual surveillance | As-of alignment statement |
| Timeline from zero | 5–7 months (first Type 2) | 7–13 months | 2–4 weeks (self-attestation) |
| Cost (first year, 10-person team) | $10–40k all-in | $45–130k all-in | Internal time only |
SOC 2 figures assume LowerPlane pricing. Enterprise platform pricing (Vanta, Drata) runs 2–5x.
Timeline: 2027–2028
Four dated milestones determine when each framework becomes load-bearing. Plan your readiness work against these dates, not against vendor marketing cycles.
AICPA public comment period on the 2027 TSC closes
Last chance to influence the final AI points of focus
EU AI Act Annex III obligations apply
High-risk AI system providers in the EU must be compliant
2027 SOC 2 criteria effective
Engagements beginning on or after this date use the new criteria; early adoption allowed
EU AI Act Annex I obligations apply
Product-safety-aligned AI systems in the EU must be compliant
How the three overlap
Evidence collected once can report against all three. The crosswalk is:
- AI governance: SOC 2 2027 (new point of focus under CC1/CC3) ↔ ISO 42001 clause 5, A.2, A.5 ↔ NIST AI RMF Govern function.
- Model monitoring: SOC 2 2027 (CC7.2) ↔ ISO 42001 A.6.2.6 ↔ NIST AI RMF Measure function.
- Training data governance: SOC 2 2027 (C1/P4) ↔ ISO 42001 A.7 ↔ NIST AI RMF Map function (data mapping).
- AI output transparency: SOC 2 2027 (CC2) ↔ ISO 42001 A.8 ↔ NIST AI RMF Manage function.
- Automated decision-making: SOC 2 2027 (CC3/CC5) ↔ ISO 42001 A.5, A.9 ↔ NIST AI RMF Map and Measure functions.
This is why running SOC 2 and ISO 42001 together is efficient: one evidence base, two reports, plus a free NIST AI RMF alignment statement on top. See the full SOC 2 ↔ ISO 42001 crosswalk for the CC-level mapping.
Sequencing for an AI startup
0–6 months
SOC 2 Type 1 (if closing a first deal urgently); start the Type 2 observation window. Build to current criteria plus the proposed 2027 AI points of focus so no rework.
6–12 months
SOC 2 Type 2. Publish a NIST AI RMF alignment statement — 2–4 weeks of writing once your AIMS evidence exists. Trust Centre goes live.
12–18 months
ISO 42001 (if an EU or regulated buyer has asked). Combined audit with ISO 27001 if already certified; otherwise sequence 27001 then 42001.
18+ months
AIUC-1 (if the product is an AI agent). EU AI Act compliance work for Annex III if you ship a high-risk system in the EU — target completion by Dec 2027.
💡 One rule
Don't pursue frameworks speculatively. Each one is a specific procurement answer. Check which buyer is in front of you (US SaaS → SOC 2; EU or regulated → ISO 42001; AI agent → AIUC-1) and sequence from there. Running the three on one evidence base — SOC 2, ISO 42001 and NIST AI RMF share roughly half their controls — costs much less than running each on its own.
Frequently asked questions
Which AI framework do US buyers ask for?
SOC 2 Type 2 remains the baseline. Once the 2027 criteria take effect (engagements beginning on or after 31 Dec 2027), the 7 AI points of focus satisfy most US procurement ask. ISO 42001 is secondary unless the buyer is in a regulated industry. NIST AI RMF is a reference framework — cited in questionnaires, never certified against.
Does NIST AI RMF certify?
No. NIST publishes the framework as a voluntary reference — the four functions (Govern, Map, Measure, Manage) and the Generative AI Profile. There is no AI RMF certification. Vendors write alignment statements against it; buyers accept those as evidence the vendor thought through AI risk, not as attestations.
Do I need to do all three?
Rarely. For most US AI startups: SOC 2 Type 2 (required), ISO 42001 (when an EU or regulated buyer asks), NIST AI RMF alignment statement (useful on the trust centre, costs almost nothing once ISO 42001 is in place). AIUC-1 if the product is an AI agent.
Does the EU AI Act accept SOC 2 or ISO 42001 as proof?
The EU AI Act doesn't name either standard, but ISO 42001 is widely used as a de-facto conformance aid for high-risk AI providers. SOC 2 is not accepted as EU AI Act evidence by itself; it attests to information security, not to the Act's risk-management and data-governance obligations. The practical EU-ready stack in 2026 is ISO 27001 + ISO 42001 + a GDPR / EU AI Act data governance pack.
What changes in 2027?
Four dated milestones. 15 Jan 2027: AICPA comment period on the 2027 TSC closes. 31 Dec 2027: 2027 SOC 2 criteria effective for engagements beginning on or after this date (early adoption permitted). 2 Dec 2027: EU AI Act Annex III (high-risk) obligations apply. 2 Aug 2028: EU AI Act Annex I obligations apply.
Run SOC 2 and ISO 42001 on one evidence base
Book a 20-minute call to scope the sequence that matches your buyer pipeline.
Book a demo