AI Security Compliance: Meeting SOC 2, ISO 27001, and GDPR Requirements

Published: 2026-04-05 · Rewritten: 2026-09-23

AI Security Compliance: What SOC 2, ISO 27001, and GDPR Actually Require

AI security compliance is the practice of proving that the AI tools and models your company uses meet three separate sets of rules: SOC 2's trust services criteria, ISO 27001's information security management system, and GDPR's data protection obligations. Each framework was written for a different purpose, and none of them mention large language models by name.

That is the gap that trips people up. Your auditor is not going to hand you an "AI checklist" because one does not exist yet. You have to map existing controls onto AI systems and then defend that mapping.

This guide walks through how to close that gap in a defensible order. It also flags where the work gets genuinely expensive, because there are points where the effort outweighs the return — and knowing which ones those are saves budget.

Why the Three Frameworks Conflict Before They Agree

The first thing to understand is that SOC 2, ISO 27001, and GDPR are asking three different questions.

A control that satisfies one may not satisfy the others. Encryption at rest, for example, is a strong SOC 2 and ISO 27001 control. It does nothing for GDPR's right to erasure if you cannot locate an individual's data inside a model or a vector store.

This is why compliance work on AI tends to stall. Teams build a control set for one framework, then discover the second framework needs something structurally different.

Step 1: Inventory Every AI System, Including the Shadow Ones

You cannot scope compliance for systems you have not found. The inventory step is boring and it is the one most teams skip.

Start with procurement records and expense reports. Any AI tool that shows up on a corporate card is in scope. Then check browser extensions, because those rarely go through procurement at all.

For each system, record four things: what data goes in, where that data is stored, who can access the output, and whether the vendor trains on your inputs. That fourth item is the one that decides your GDPR exposure.

If a vendor trains on your data by default and you never turned it off, you have a data processing problem regardless of how good your encryption is.

Tools like Notion AI and Slack AI sit in a category that makes this harder: they are embedded in systems you already use, so they never felt like a new vendor. Notion AI is an add-on to a workspace that, according to an internally verified tool snapshot from 2026, serves over 100 million users. That scale is exactly why the embedded-AI category gets missed in inventories.

Step 2: Map Controls to Framework Requirements

Once you have the inventory, build a single control matrix that serves all three frameworks. Do not build three separate ones.

A practical matrix has one row per control and one column per framework. For each cell, note whether the control satisfies the requirement, partially satisfies it, or is not applicable. The partial cells are your work queue.

Here is what that looks like for a common control:

The reason to do this on one matrix is that auditors from different firms will ask for overlapping evidence. One matrix means you produce one evidence set instead of three.

Step 3: Handle GDPR's AI-Specific Problems

GDPR is where AI compliance gets genuinely hard, and it is worth being honest about why.

Three GDPR rights are structurally difficult for AI systems:

The mitigation for all three is the same: know where personal data enters the AI pipeline and put a control at that entry point. Prompt-level filtering is more effective than trying to scrub data after the fact.

A Worked Example: Reviewing an Embedded AI Tool

Suppose your company uses Slack AI. The review would look like this.

Inputs: channel messages, including any personal data employees have typed into Slack, plus thread history and file contents.

Vendor position: Slack AI is a Salesforce product. According to an internally verified tool snapshot from 2026, the platform serves over 200,000 organizations and the AI add-on provides channel summaries, thread catch-ups, and conversational search. That feature set means the AI reads message content, which makes every channel a potential data source.

Control mapping: for SOC 2, you need evidence that access to AI-generated summaries follows the same permission model as the underlying channels. For ISO 27001, you need this documented as part of your risk assessment. For GDPR, you need a lawful basis for processing message content, and you need to know whether the vendor retains it.

Output of the review: a one-page record with the data categories, the vendor's retention and training terms, the controls applied, and the residual risk. That record is what an auditor will actually ask to see.

The important part is not the length of the review. It is that the same template gets reused for every tool in the inventory, so the work compounds instead of restarting each time.

Where This Approach Breaks Down

Two honest caveats.

First, the control matrix approach assumes you can get clear answers from vendors about training and retention. Some vendors publish this. Some bury it in a subprocessor list. A few will not answer directly. When you cannot get a clear answer, that uncertainty is itself a finding you should document — and it may mean the tool does not belong in a regulated workflow.

Second, the cost curve is not linear. Scoping and inventory are cheap. Control mapping is moderate. The expensive part is the first audit cycle, where you produce evidence for a period that has already passed and may not have been logged properly. Teams that start logging before they start the formal program spend significantly less in that first cycle.

How Often Should You Re-Review?

There is no framework-mandated cadence for AI tool reviews, so treat any specific interval as a recommendation rather than a requirement.

The reasoning behind a quarterly cycle is that vendor terms and features change faster than most compliance calendars assume. A vendor can change its training policy, add a new data source, or ship a new AI feature between your annual reviews. If your review cadence is annual and the vendor's terms change quarterly, you are always behind.

A more defensible trigger is event-based: re-review when the vendor changes terms, when you add a new data category to the pipeline, or when a framework requirement is updated. Run a light quarterly check on top of that to catch anything the event triggers miss.

Key Takeaways

The practical takeaway: the frameworks will not tell you what to do about AI, so the work is in the mapping. Build one control matrix, reuse one review template, and start logging before you need the evidence. That sequence is what keeps the first audit cycle from becoming a fire drill.

Sources

Frequently Asked Questions

Does SOC 2 cover AI systems specifically?

No. SOC 2 is framework-agnostic — it evaluates whether your controls work, not whether they address AI. You satisfy SOC 2 for an AI system by showing that your existing controls, such as access logging and change management, apply to that system and produce evidence over time. There is no separate AI addendum, which is why mapping AI systems into your existing control set matters more than looking for AI-specific criteria.

Is ISO 27001 certification required for GDPR compliance?

No, but it helps. GDPR does not require ISO 27001, and ISO 27001 does not guarantee GDPR compliance. What ISO 27001 gives you is a documented risk management process, which supports GDPR's accountability principle. Many organizations use their ISO 27001 documentation as the backbone of their GDPR evidence, then add the data-subject-rights work that ISO 27001 does not cover.

How do you handle GDPR right to erasure with a fine-tuned model?

You generally cannot delete a single record's influence from a trained model. The practical options are retraining without that data, or documenting that the data was never used for training in the first place. The second option is far cheaper, which is why knowing your vendor's training terms before you send data is the control that actually matters. Document whichever path applies.

How this article was produced: it was generated by an automated content pipeline from the sources listed above. No human editor wrote or reviewed it, and we did not personally test the tools described. Facts and prices that appear here come from our own AI tool database, and its verification date is noted where relevant. Spotted an error? Tell us and we will correct or remove it.

Want to try this yourself? AI-Mind generates content from a plain description — no prompt engineering required.

Try AI-Mind