Evaluating an AI tool’s security means more than checking a badge on their homepage. Get the actual SOC 2 Type II report, not just the certificate. Confirm that AI components sit inside the audit scope. Get a signed BAA if PHI is involved and get clear answers on data retention, training use and sub-processors. Skip any of these and you’re the one who fails the audit, not your vendor.
Your vendor’s compliance failure becomes your compliance failure. Most procurement teams learn this the hard way.
If an AI tool touches your customer data, your employee data, or anything covered by HIPAA and that vendor has a gap in their controls, the auditor doesn’t just flag the vendor. They flag you, because you’re the one who chose to hand over the data without checking.
That means knowing exactly what to ask a vendor and what a real answer looks like.
What does it actually mean to evaluate AI tool security?
Evaluating AI tool security means verifying a vendor’s SOC 2 Type II report covers their AI components specifically, confirming HIPAA compliance through a signed Business Associate Agreement if health data is involved, checking data encryption and retention policies and reviewing sub-processor and model training practices. A security badge alone is not proof of compliance. You need the full audit report and documented answers to specific questions before granting an AI tool access to sensitive data.
Most AI vendors show you a SOC 2 badge fast. Getting the actual report takes longer and the report is where the answers are.
The badge tells you an audit happened. The report tells you what was actually tested, what exceptions were noted and whether the AI components were even inside the scope of that audit in the first place.
How do you actually read a SOC 2 report for an AI vendor?
Don’t accept the certificate. Request the full report and go through it step by step.
Check the system description first
This section defines what was actually audited. For an AI vendor, confirm it explicitly includes model APIs, vector databases and embedding pipelines, not just the surrounding web application. A SOC 2 report that only covers the login page and billing system tells you nothing about how your data flows through their AI layer.
Check the coverage dates
A report from eighteen months ago tells you far less than a current one. Controls drift, infrastructure changes and vendors add new AI features constantly. Request a report dated within the last 12 months.
Check for exceptions
Look specifically at the auditor’s opinion section for noted exceptions or qualifications. An exception doesn’t automatically disqualify a vendor, but it does mean you need to understand exactly what failed and what they’ve done to fix it since.
Check the sub-processor list
Does the report include subservice organizations, meaning the GPU cloud providers and model APIs the vendor itself depends on? If your AI vendor runs on another company’s infrastructure, that company’s security posture is now part of your risk too.
Do you know: How Application Security Software Handles Cryptographic Failures?
What should be in the Trust Services Criteria?
SOC 2 reports can cover up to five Trust Services Criteria, but only Security is mandatory for every report. Confidentiality and Privacy are the two categories that matter most once AI enters the picture.
For AI-specific risk, three areas matter most:
- Logical access (CC6): Who authorized the AI to act and does it operate under least-privilege permissions
- System operations (CC7): Is every AI agent action logged and monitored for anomalies like unusual data transfer volumes
- Change management (CC8): Are changes to AI models or policies reviewed and version-controlled before going live
One detail that trips up a lot of buyers: from an auditor’s perspective, AI agents count as nonhuman identities. If a tool can log in, call APIs, or read customer data autonomously, it falls under the same access controls as a human employee.
What makes an AI tool HIPAA compliant?
SOC 2 and HIPAA are not the same thing and passing one doesn’t automatically mean you’ve passed the other. If your AI tool touches protected health information, you need specific additional confirmations.
The Business Associate Agreement is non-negotiable
HIPAA requires a signed Business Associate Agreement with any third party that handles PHI on your behalf. An AI API provider processing patient data without a signed BAA makes your organization non-compliant, regardless of how good your own internal controls are.
Do you know: Is LLaMA 3 HIPAA Compliant?
Four technical safeguards to confirm
The HIPAA Security Rule specifies four categories your AI vendor needs to demonstrate:
- Access controls under 45 CFR §164.312(a)(1): unique user identification, automatic logoff, encryption and decryption
- Audit controls under 45 CFR §164.312(b): mechanisms to record and examine access and activity
- Integrity controls under 45 CFR §164.312(c)(1): mechanisms confirming PHI hasn’t been altered or destroyed
- Transmission security under 45 CFR §164.312(e)(1): protection against unauthorized access to PHI while it’s in transit
Data residency and retention
HIPAA requires you to know exactly where PHI is stored and for how long. Confirm regional data residency options, since most healthcare use cases require US-only storage and ask directly whether the provider excludes PHI from model training data. Some providers retain API inputs and outputs for up to 30 days by default, which needs to be explicitly addressed in your agreement.
Audit log retention
HIPAA requires audit logs retained for a minimum of six years, with tamper-evident storage. Confirm the vendor’s logs capture timestamps, user or service identifiers and request metadata, not just a generic activity feed.
“An AI API provider that processes patient data without a signed BAA makes you non-compliant, regardless of your own controls.” — AI API Playbook, SOC2 & HIPAA Compliant AI APIs Guide, 2026
Data privacy checklist: questions to ask every vendor
Before granting any AI tool access to sensitive data, get documented answers to these questions:
- What data is being ingested into the system and where does it come from
- Whether the underlying AI model will be trained on your data and how you opt out
- Whether privacy-enhancing techniques like anonymization or tokenization are applied
- How data is protected during transmission and storage within the AI system
- What regulatory standards the vendor’s tool has been evaluated against
- What their default data retention window is and whether it’s configurable
IBM’s own research is a useful data point here: 97% of organizations that experienced an AI-related security incident lacked proper access controls going in. That statistic alone justifies treating access control review as non-optional.
Also read about: AI Data Security Guide: Safeguard Enterprise AI Systems
Technical security checklist
Beyond paperwork, confirm these technical controls are actually in place, not just described in a sales deck:
- Data encrypted at rest using AES-256 and in transit using TLS 1.3
- Per-tenant or per-user data isolation specifically at the AI inference layer
- SSO integration supported through SAML or OAuth
- Role-based access control with granular permissions for AI-specific features
- Comprehensive audit logging covering every AI interaction, not just login events
- Documented defenses against prompt injection and unsafe output generation
How do you handle shadow AI before an audit?
Employees often adopt AI tools without going through procurement and those tools often get direct access to company data through OAuth grants or browser extensions nobody reviewed.
Before audit day, your inventory needs to answer three questions:
- What AI tools are actually active in your environment right now, including ones adopted without IT review
- Which of those tools have access to company data and through what mechanism, whether that’s an OAuth grant, API key, or direct file upload
- Which of those tools fall inside the scope of your SOC 2 or other applicable compliance framework
Run a full discovery pass across your environment rather than relying on your approved-vendor list. Shadow AI is the kind of gap an auditor finds before you do, if you haven’t looked first.
A practical evaluation timeline
For teams onboarding a new AI vendor under compliance pressure, a phased documentation review keeps this manageable:
| Phase | Timeframe | What to do |
| Documentation review | 1-2 weeks | Request full SOC 2 Type II report, architecture diagrams, privacy policy, DPA and sub-processor list |
| Technical verification | Ongoing | Confirm encryption standards, data isolation, SSO and audit logging are implemented, not just documented |
| Contractual alignment | Before signing | Secure a signed BAA if PHI is involved, confirm training opt-out and retention terms in writing |
| Ongoing monitoring | Continuous | Re-request updated SOC 2 reports annually and monitor for shadow AI tools bypassing formal review |
Common ways vendors fail this review
A few patterns show up repeatedly when AI vendors don’t hold up under scrutiny:
- Showing you a certificate or badge but refusing to share the actual audit report
- A SOC 2 report that technically exists but excludes the AI components entirely from its scope
- No willingness to sign a BAA despite processing data that clearly qualifies as PHI
- Vague answers about model training that don’t specify whether your specific data is excluded
- Retention policies that exist but aren’t configurable or documented in the contract itself
If a vendor hesitates on any of these, that hesitation is the answer. A vendor confident in their compliance posture hands over documentation without friction.
Commonly asked questions
What is the difference between a SOC 2 certificate and a SOC 2 report?
A certificate confirms an audit happened. The full report details exactly what was tested, any exceptions noted and whether AI components were included in scope. Always request the full report.
Do I need a BAA for every AI tool I use?
Only if the tool processes protected health information on your behalf. If PHI is involved and no BAA exists, your organization becomes non-compliant regardless of your internal controls.
How current should a vendor’s SOC 2 report be?
Request a report dated within the last 12 months. Older reports don’t reflect current infrastructure, control changes, or newly added AI features that may not have been audited.
What counts as an AI component in a SOC 2 audit scope?
Model APIs, vector databases and embedding pipelines should all be explicitly included. A report that only covers login and billing systems tells you nothing about AI-specific risk.
Why does model training on my data matter for compliance?
If a vendor trains its models on your data without exclusion options, that data effectively becomes part of a shared system, creating retention and confidentiality risks beyond your control.
What is shadow AI and why does it matter for audits?
Shadow AI refers to tools employees adopt without formal IT or procurement review. These tools often have undocumented access to company data, creating audit exposure nobody has assessed.
How long must HIPAA-related audit logs be retained?
HIPAA requires audit logs retained for a minimum of six years, with tamper-evident storage, covering timestamps, user identifiers and request metadata for every access event.
Are AI agents treated differently from regular software in a SOC 2 audit?
Yes. Auditors treat AI agents as nonhuman identities. If an agent can access systems or data autonomously, it falls under the same access control requirements as a human user.
What should I do if a vendor won’t share their full SOC 2 report?
Treat that refusal as a red flag. A vendor confident in their compliance posture should provide documentation without resistance, especially under a standard NDA
Can I rely on a vendor’s website compliance badges alone?
No. A badge indicates a claim, not proof. Always request the underlying report, DPA and specific answers about data handling before granting access to sensitive systems.
Conclusion
Evaluating AI tool security is an ongoing responsibility that follows your data wherever it goes. Get the full SOC 2 report, confirm the BAA if health data is involved and keep watching for shadow AI tools that slip in without review. The vendor’s compliance gap becomes yours the moment you hand over the data.
Disclaimer
This article is based on publicly available guidance from Thoropass, SkopX, Linford & Co, Nudge Security, AI API Playbook, LastPass and Agentic Control Plane as of July 2026. Regulatory requirements vary by jurisdiction and industry. Consult a qualified compliance professional before making vendor decisions involving regulated data.
