AI & Client Data: A SOC 2 Checklist for Accounting Firms

Before you put a single client transaction into a new AI tool, run this checklist. It's not a substitute for your firm's risk policy — it's the shortlist most engagement letters and SOC 2 audits actually care about.

1. Vendor attestations#

• SOC 2 Type II report from the last 12 months. Type I is fine for new vendors but plan to upgrade within a year.
• Subprocessor list — including LLM providers (OpenAI, Anthropic, Google) — with their attestations.
• Data residency. Confirm where client data is processed and stored.

2. Data handling#

• No-training clause in the DPA — your data must not be used to train base models.
• Retention policy — how long is processed data retained, and where?
• Deletion on request — can you remove a client's data on offboarding?

3. Access controls#

• SSO / SAML support, plus enforced MFA.
• Role-based access down to the client level.
• Audit log export.

4. Incident response#

• Breach notification timeline — 72 hours or sooner is standard.
• Incident history — ask for the past 12 months.

5. Engagement letter updates#

• AI usage clause — disclose that AI tools may be used to process client data.
• Sub-vendor disclosure clause covering LLM providers.

What "good" looks like in 2026#

The vendors we recommend in our AP automation, bookkeeping, and practice management guides all clear this checklist. If a vendor can't produce the documents in section 1 within a week, walk.