AI Supplier Security Reports: Read the Scope Behind the Badge

The security badge sits beside the price, the demonstration looks convincing, and the supplier is ready to connect its AI assistant to your business files. Before agreeing, ask what the supporting report actually covers. The answer may matter more than the badge’s appearance.

For a small business, the buying question is practical: does the evidence address the service, data and connections you intend to use? A report can be valuable while leaving a particular feature or operating arrangement unresolved. Reading its boundaries helps you make a decision you can explain.

Understand what you are being offered

SOC 2 concerns assurance about a service organisation’s controls. The AICPA’s public description of its illustrative Type 2 report, dated 30 September 2023, identifies several parts: management’s assertion, a system description, the auditor’s report, and control tests with their results. That is considerably more information than a logo communicates.

Report type also matters. Microsoft’s SOC 2 documentation, updated on 8 April 2026, explains that Type 2 reporting addresses control design and operation over a specified period. It distinguishes this from Type 1 examinations, which do not look back over a performance period. Record both the report’s issue date and the date or period it examines.

Keep the conclusion proportionate. Do not infer that an assurance report demonstrates accurate AI answers for your own task. Ask for the evidence supporting that separate claim, and assess whether it resembles the work you will actually give the assistant.

Describe the purchase precisely

Consider a fictional design studio choosing an AI research assistant. Its first trial would summarise public reference material. A later proposal would let it inspect unpublished client briefs through a connected file store. Those are different uses, even if they appear inside the same application.

Before requesting documents, the owner writes down the proposed arrangement:

• The exact product, subscription and AI feature being considered.
• The material it would receive, including whether files are public or confidential.
• The connected services and whether the assistant would only read information or also change it.
• The people who would administer access and review its output.

This gives the supplier something concrete to answer. Instead of asking whether the company is secure, the studio can ask where its planned AI feature and file connection appear in the report’s system description. A useful response points to evidence and explains its relevance.

Follow the boundary beyond the brand

The UK National Cyber Security Centre’s cloud-provider guidance says that a service built on another cloud platform needs consideration at both levels: the underlying platform’s security features and the way the service configures and uses them. Its guidance, reviewed on 7 June 2023, also emphasises matching assurance scope to how and where a service will be used.

For the fictional studio, evidence about a hosting platform would therefore be one part of the enquiry. The owner would still need an explanation of the research assistant’s own operation. Which organisation handles the uploaded brief? Where does the file connector fit? What evidence supports the controls on that part of the journey?

The AICPA’s illustrative report-review form specifically asks about subservice organisations excluded from the report’s scope, described as carved out, and whether the supplier’s monitoring is adequate. An exclusion is a boundary to investigate. It does not, by itself, establish that the excluded provider is insecure.

For a broader view of the connected services involved, MaryChuks.com’s guide to SaaS and AI dependencies offers a useful starting point for mapping the chain.

Put the evidence on a timeline

Continue the fictional example. Suppose the supplied report examines a file-storage service for a period ending on 30 June 2026, while the AI review feature was introduced in September. The report remains relevant to the system it examined. It leaves a further question: what assurance applies to the new function today?

Ask the supplier to explain the relationship between the new feature and the examined system. Existing controls may be relevant; additional evidence may be available; a gap may remain. Record which explanation is supported rather than filling the gap with an assumption.

A bridge letter can help explain the time since an examination, but identify who makes the statement. Microsoft explicitly describes its own bridge letters as management self-attestations, rather than reports based on an auditor’s examination. Treat the letter according to its stated author, coverage and limitations.

Read findings and customer responsibilities

The AICPA review form asks readers to consider the auditor’s opinion, exceptions in control testing and their effect on the services used. It also explains that an unmodified opinion can coexist with exceptions. Read the findings rather than treating the opinion label as the whole assessment.

If a finding is relevant to the studio’s proposed use, the next enquiry is specific: what happened, how does it affect this service, and what evidence supports the supplier’s response? Where the technical significance is unclear, a qualified security reviewer can help interpret it before confidential files are connected.

Microsoft also directs customers to the user responsibilities in its report. In any report you receive, identify the work expected of your organisation and check how it maps to your intended setup.

In the fictional studio, that might mean assigning someone to review account access and remove a departing collaborator. The actual report and service documentation must establish the applicable expectations. A task that everyone assumes someone else owns is still unfinished.

Make a decision with stated limits

Finish with a short decision note: the proposed use, documents reviewed, evidence that matches it, unresolved questions, permitted next step and review date. This is an editorial suggestion for organising the decision, rather than a formal audit method.

The studio might continue a public-material trial while postponing the confidential-file connection until its questions are answered. Another business may need a fuller review from the outset. Choose the next step according to the consequences of the proposed use and the evidence available to support it.

A careful purchase ends with a clear account of what you are trusting the supplier to do, why the available evidence supports that trust, and what your own team still needs to operate. That explanation is worth keeping beside the report.

Sources

Primary sources checked on 25 October 2026. The fictional studio and its dates are illustrative.

• AICPA & CIMA: Illustrative SOC 2 Report with Illustrative System Description — public resource description, 30 September 2023.
• AICPA: SOC 2 Report Review — undated illustrative review form.
• Microsoft Learn: SOC 2 Type 2 — updated 8 April 2026.
• NCSC: Choosing a cloud provider — reviewed 7 June 2023.