Guide · Governance
Mapping APRF Evidence to SOC 2 and ISO for AI
Do not rebuild AI controls from scratch for every audit. APRF Compliance expects a crosswalk: gate evidence that maps to SOC 2 Trust Services and ISO control objectives—with AI-specific artifacts included.
Audits need evidence, not pillar names—map APRF artifacts to SOC 2 and ISO via Compliance crosswalks. Primary control: Compliance
Auditors want artifacts, not pillar names
Compliance mapping ties APRF pass conditions—evals, BOMs, kill-switch tests, corpus registers, access reviews—to SOC 2 / ISO 27001 (and AI extensions you claim). One team passed infra SOC 2 but couldn't show model/prompt change approval; Slack wasn't evidence. Mapping Change Management + Evaluation artifacts (release ticket, eval report, model ID pin) into the change-management TSC closed the finding.
Build the crosswalk once, reuse forever
Scope which AI systems are in. Map APRF check → SOC 2 TSC / ISO control → artifact + owner. Include AI-specific evidence: model/prompt pins, eval gates, tool allowlists, corpus register, safety tests, decision traces. Feed Core Profile outputs into continuous monitoring where you can. Store with audit-period retention; revisit when APRF or system scope changes.
One evidence store beats two narratives
Security shouldn't rewrite SOC 2 prose while AI keeps a separate spreadsheet. APRF Compliance and the how/crosswalks page are the shared map—Organizational Governance names who signs.
Assess against APRF Core
Run the Core Profile quiz — gated pass/fail blockers for AI production readiness, not a vanity score.
Related
Frequently asked questions
- Does APRF replace SOC 2?
- No. APRF is a production-readiness gate set. Use it to generate evidence that SOC 2 and ISO already ask for—plus AI-specific gaps those frameworks under-specify.
- What about the EU AI Act?
- Treat it as an additional crosswalk target: risk class, transparency, and human oversight map cleanly to Safety, Explainability, and Human Approval pillars.
- Where do we start if we are early?
- Core Profile evidence + system ownership register + change/eval artifacts for your highest-traffic assistant.