SOC 2
The AICPA trust-services audit (TSP 100) enterprise buyers ask for first. Not an AI law — but the report that unlocks enterprise deals, now extended to how you govern AI.
The report enterprise procurement asks for before anything else.
SOC 2 is an independent audit against the AICPA Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality and Privacy. It is the proof enterprise buyers demand before signing, delivered as a Type I or Type II report.
As buyers extend due diligence to AI, the System Description and control evidence increasingly need to cover how AI systems are governed — not just the surrounding infrastructure.
The files this framework actually requires.
SOC 2 needs a System Description and control evidence. Hael generates the AI-governance portions and keeps them current.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
A checklist lists the controls you owe. Hael generates the System Description and the AI-governance evidence behind them.
Discover, classify, produce — for SOC 2.
Find the systems in SOC 2 scope, including embedded third-party AI.
Assess each against SOC 2's risk tiers and obligations.
Generate the SOC 2 records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
The System Description and control evidence behind a SOC 2 report overlap with ISO 42001's management system and feed directly into your buyer-facing Trust Center — answer due diligence once.
On record before the deal stalls, not scrambled during diligence.
Hael generates the System Description and AI-governance control evidence the SOC 2 audit needs.