AI Audit & Compliance: A SOC 2, ISO & GDPR Checklist for Dev Teams

This is general guidance for developers, not legal advice. Confirm specifics with your compliance or legal team.

AI Is Now in Scope

Auditors used to ask about your database and your S3 buckets. Now they ask where your prompts go, whether a third party trains on your users' data, and how you log AI decisions. If you ship AI features, those questions land in your SOC 2, ISO 27001, and GDPR reviews. The good news: most of it maps to controls you already understand — data handling, access, vendor management, logging — applied to a new data flow.

The Core Checklist (Maps to All Three)

• • Data handling: Know what data leaves your system in prompts. Redact or tokenize PII before it goes to a model. Confirm the provider does not train on your data and document the retention window.
• • Access & secrets: API keys in a secrets manager, scoped per service, rotated. Least-privilege access to AI tooling and logs.
• • Vendor / sub-processor due diligence: List every model provider as a sub-processor, with a DPA, security posture, and data-residency terms. An aggregator changes this materially (see below).
• • Logging & audit trail: Record who/what invoked the model, the model used, and (where lawful) inputs/outputs — enough to investigate an incident.
• • Output governance: Guardrails, human-in-the-loop for consequential decisions, and a documented process for AI errors.
• • Data subject rights (GDPR/CCPA): Be able to honor deletion/access requests for data that flowed through AI features.

Where an Aggregator Helps

The hardest part of AI compliance is sprawl: five providers means five DPAs, five security reviews, five sets of logs, five data-residency stories. A unified platform collapses that. With Vincony, you manage one vendor relationship, one set of usage logs and analytics, and team controls in one place. BYOK lets sensitive workloads bill against your own provider account so the data path matches your existing agreements, and a no-training policy keeps your inputs out of model improvement. Frame these as features that support your controls — you still own the audit.

import vincony
client = vincony.Client(api_key=os.environ["VINCONY_KEY"])  # from secrets manager

clean = redact_pii(user_text)                 # strip emails, card numbers, etc. first
res = client.chat(model="gpt-5", messages=[{"role": "user", "content": clean}])

audit_log.write({                              # tamper-evident audit trail
    "actor": user_id, "model": "gpt-5",
    "purpose": "support_reply", "ts": now_iso(),
    "input_hash": sha256(clean), "output_hash": sha256(res.text),
})

Framework Notes

SOC 2: Your AI controls roll up under the Trust Services Criteria you already report on (Security, Confidentiality, Privacy). The auditor wants evidence: documented data flows, vendor list, access reviews, logs.

ISO 27001: Add AI tooling and providers to your asset inventory and risk assessment; reflect them in your Statement of Applicability and supplier controls (A.5.19–A.5.23).

GDPR/CCPA: Identify the lawful basis for processing personal data through AI, list providers as processors/sub-processors with DPAs, minimize data in prompts, and ensure deletion/access requests reach AI-touched data.

A Minimum Viable Compliance Posture

You don't need a 90-day program to start: (1) document your AI data flows, (2) redact PII before prompts, (3) consolidate providers and keep DPAs on file, (4) log every AI call with actor + model + purpose, (5) put a human in the loop for consequential outputs. Consolidating onto one unified platform knocks out a surprising amount of the vendor-management and logging work in one move. Then iterate toward your framework's full requirements — see our deeper AI security & compliance and enterprise deployment guides.

FAQ

Do I have to log every prompt? Log enough to investigate incidents and prove controls — actor, model, purpose, hashes. Storing raw PII-laden prompts can create its own GDPR liability, so weigh that.

Is using one aggregator enough for compliance? It reduces vendor sprawl and centralizes logs, but you still own the controls, DPAs, and evidence.

What about data residency? Check your provider's region terms; BYOK lets you route through accounts that already meet your residency requirements.