Skip to content
NEXDGE
Start free

SOC 2 and AI-generated code: what auditors actually ask for

Using AI to write code does not break SOC 2, but it changes what you must evidence. What auditors ask about AI-generated code, and how to answer.

5 min readUpdated 29 July 2026
In short

SOC 2 does not prohibit AI-generated code, but it requires evidence that code is reviewed before deployment regardless of who or what wrote it. The practical requirement is a documented, consistently applied review step that produces a retrievable record for every change reaching production.

Key takeaways
  • No major framework prohibits AI-generated code; they require evidence that changes are reviewed before deployment.
  • The control that usually fails is consistency. A review process applied to most changes is a finding, not a control.
  • Auditors want a retrievable record per change, not a description of your intentions.
  • Vendor code retention becomes your problem in the sub-processor section of your own compliance posture.
  • Severity grading with a documented threshold turns ad-hoc judgement into a control you can evidence.

The question comes up as soon as a first enterprise deal reaches security review: does using AI to write our code create a compliance problem?

Short answer: no, not by itself. Longer answer: it changes what you have to be able to show, and the thing that trips teams up is almost never the AI. It is that the review step is inconsistent, and inconsistency is exactly what an auditor is trained to find.

What SOC 2 actually requires

SOC 2 is not a checklist of technologies. It is an attestation that you defined controls appropriate to the Trust Services Criteria and then operated them consistently over a period. Nothing in it mentions code generation tools, and nothing needs to.

The relevant criteria are the change-management ones: changes to production systems are authorised, reviewed, and tested before deployment. The control is agnostic about the author. Whether a line was typed by a senior engineer or generated by a model, the same question applies: what evidence exists that it was reviewed before it shipped?

The four questions to prepare for

1. How do you review code before it reaches production?

They want the mechanism, not the intention. Which step runs, what it checks, where it sits in the pipeline, and what happens when it fails. "Engineers review each other's pull requests" is an answer; it is just a weak one unless you can show it happened every time.

2. Can you produce the record for a specific change?

This is the question that decides the outcome. An auditor will select a sample of changes from your period and ask for the review evidence for each. If the review lives in a tool that stores a result per submission, this is a lookup. If it lived in a conversation, you have a problem, and it is not a problem you can fix retroactively, because the period has already closed.

3. What is your threshold for blocking a deployment?

Severity grading matters here for a reason that is not obvious. A documented rule (CRITICAL and HIGH findings block release, MEDIUM and LOW are tracked and scheduled) converts a judgement call into a control with a testable pass condition. Without a threshold, every release decision is discretionary, and discretion cannot be evidenced.

4. Where does your code go during review?

Your review tool is a sub-processor. If it stores your source code, that storage sits inside your compliance boundary and inherits your obligations: it appears in your vendor assessment, your data-flow documentation, and your breach analysis if that vendor is compromised.

A tool that never persists code shortens that conversation considerably, because there is no stored data to assess. The reasoning is set out in full in zero code retention.

How this maps to other frameworks

FrameworkRelevant requirementWhat satisfies it
SOC 2Change management: review before deploymentConsistent review with a retrievable record per change
ISO 27001A.8.25 / A.8.28: secure development and codingDocumented secure-development process, evidenced as operating
GDPR / DPDPSecurity of processing; breach notificationDemonstrable measures, plus a defensible position on sub-processors
PCI-DSSRequirement 6: secure systems and softwareReview covering the OWASP-style vulnerability classes before release

The shared shape is worth noticing: every framework asks for a process that runs consistently and leaves a record. None asks who wrote the code.

Making this operational without a compliance team

  1. Put review in the pipeline rather than in a habit. A step in CI runs on every change by construction; a norm runs on every change until a deadline.
  2. Store the result per change, with a timestamp and an identifier you can search during fieldwork.
  3. Write the blocking threshold down and apply it without exception, so the control is testable.
  4. Record your business rules alongside the code they govern. The same context that lets a reviewer catch logic errors also documents intent for an auditor.
  5. Confirm in writing whether your review vendor retains code, and keep the answer with your vendor assessments.

None of this requires a compliance function. It requires the review step to be automatic rather than remembered, which is the same property that makes it useful in the first place. The API and CI/CD integration docs cover wiring it into a pipeline so the record is produced without anyone deciding to produce it.

Frequently asked questions

Does SOC 2 prohibit AI-generated code?

No. SOC 2 contains no requirement about who or what writes code. It requires that changes to production are authorised, reviewed, and tested before deployment, and that you can evidence the control operating consistently.

What evidence do auditors want for code review?

A retrievable record for a sampled set of changes showing that review occurred before deployment, including what was checked and what the outcome was. A description of your process without per-change records is not sufficient.

Do I need to disclose that we use AI coding tools?

Not as a framework requirement, but enterprise security questionnaires increasingly ask. The stronger position is to disclose it alongside the review control you apply to the output, rather than to leave it unaddressed.

Is a code review tool a sub-processor?

If it stores your code or personal data, yes, and it belongs in your vendor assessments and data-flow documentation. A tool that processes code in memory without persisting it materially narrows that assessment.

What blocking threshold should we document?

A common and defensible policy is that CRITICAL and HIGH findings block release while MEDIUM and LOW are tracked and scheduled. What matters to an auditor is that a threshold exists, is written down, and is applied without exception.

Sources

  1. AICPA: SOC suite of servicesThe body that defines the trust services criteria SOC 2 reports against.
  2. NIST SP 800-218: Secure Software Development FrameworkThe practices most software supply-chain requirements are written against.
  3. GDPR Article 22: Automated individual decision-making

Produce a reviewable record for every change, automatically, from your pipeline.

See CI/CD integration