What Actually Enters SOC 2 Scope When You Automate With AI

A zero-retention option changes data handling. Your audit still needs a defined system boundary, evidence of the active configuration, and a decision about the provider's role.

This article covers the audit-scope surface in the AI governance series. The scoping decision depends on the service and data flow, not the retention headline.

Zero retention is a setting, not a scope decision

Anthropic announced Enterprise Frontier Safeguards on September 1, 2026, with a phased rollout planned for fall. It describes customer-controlled storage for monitoring data and interim ZDR for eligible Fable 5 and Fable 5.1 customers. Access requires a request. The announcement is not proof that a particular account has EFS enabled.

OpenAI's data-control documentation describes approval plus organization/project configuration, with endpoint and capability exceptions. The current table marks /v1/batches ineligible for ZDR. Some ineligible endpoints retain application state even when ZDR is enabled. A no-training policy, a retention setting, and customer-controlled storage are distinct commitments.

A vendor setting can be part of a control when its configuration, effective date, permissions, and operation are evidenced. Preserve what was actually enabled for the account and endpoint. Do not read "zero retention" as no processing, no exceptions, or no logs anywhere in the system.

The question underneath: carve-out or inclusive

Determine with the auditor whether the provider performs a service relevant to the system's commitments and requirements. Not every model provider your company touches automatically becomes a subservice organization in the same audit boundary. Vendor risk assessment and the report's scope are related decisions, with different jobs.

For a relevant subservice organization, the carve-out method excludes its controls from the auditor's testing in your report; the inclusive method includes them. Complementary subservice organization controls describe controls expected at the provider. They are not the provider's name. Confirm the method, disclosures, and required evidence with the responsible auditor.

Review the provider evidence relevant to your risk and use. A SOC report, its coverage period, exceptions, applicable customer controls, and a bridge letter may inform that review. Set the review cadence against the actual audit requirements and risk; the cited guidance does not establish one universal annual-report rule for every AI vendor.

What a subprocessor list has to actually track

Legal and security owners should determine the provider's role in the actual data relationship and the applicable contractual duties. A model provider is not automatically a subprocessor in every use.

Maintain the service, data categories, processing locations, relevant subprocessors, and retention/training configuration you actually rely on. The DPA supplies contractual terms. SOC reports, questionnaires, and configuration evidence are separate due-diligence artifacts rather than contents that every DPA must contain.

What the review needs to answer

The review should identify the data flow, the service's role, the controls your team operates, the provider evidence you rely on, and unresolved exceptions. A statement about a completed audit needs its own documented scope; a vendor announcement cannot supply it.

Capture the scoping decision and active setting with a date and owner. If a provider changes eligibility, retention, or the endpoint you use, review the effect on the existing decision rather than assuming yesterday's configuration still applies.

What this means for the rest of the governance series

The access article covers what data and actions connectors can reach. Audit logging preserves the configuration and actions used at a particular time. A named review owner needs to resolve exceptions with legal, security, and the auditor. AI ownership covers that division of responsibility.

The series

The published governance series:

AI Governance for Commercial Teams: the operating system, not the policy PDF.
What Actually Enters SOC 2 Scope When You Automate With AI: the audit-scope surface. This piece.
The Human Gate That Isn't a Rubber Stamp: the review surface.
What to Connect and What to Refuse: connector access and permissions.
The AI Audit Log: reconstructing the evidence behind an action.
AI Vendor Review: where your data actually goes. This closes the series.

Before enabling a provider, agree on the data flow and relevant control evidence. Revisit that decision when the actual service or configuration changes.

Frequently asked questions

Does an AI vendor's zero data retention policy remove it from SOC 2 scope?

No. Retention affects data handling but does not decide the system boundary or provider role. Confirm the relevant service, scoping method, controls, and evidence with the auditor. A retention setting can form part of an evidenced control.

What is the difference between carve-out and inclusive method for AI subservice organizations?

Carve-out excludes relevant subservice-organization controls from testing in your report; inclusive includes them. Complementary subservice organization controls are expected provider controls. The auditor should confirm the method, disclosures, and evidence for your actual boundary.

What did Anthropic and OpenAI actually announce about zero data retention?

Anthropic's September 1 announcement describes a phased EFS rollout and interim ZDR eligibility for Fable 5 and Fable 5.1. OpenAI provides approved organization/project settings with endpoint exceptions; its current table marks /v1/batches ineligible for ZDR. Verify the active account configuration rather than inferring it from either announcement.

What does a Data Processing Agreement need to cover for an AI vendor?

Legal owners should establish the contractual data-processing terms for the actual provider relationship. Processing locations, subprocessors, retention/training terms, and deletion commitments may be relevant. SOC reports, security questionnaires, and setting evidence are separate due-diligence artifacts.

What evidence should the audit-scope owner preserve?

Preserve the actual data flow, scope decision, provider agreement, relevant assurance evidence, active account/endpoint settings, effective dates, and reviewed exceptions. The responsible auditor determines what that engagement needs; a general article cannot certify its scope.

Sources

Primary provider sources: Anthropic's September 1, 2026 EFS announcement and OpenAI's data-control and endpoint table, reviewed October 6, 2026. Method background: Linford's carve-out/inclusive explanation. Use the actual system description and responsible auditor to determine applicability.

About the author

Jeff Brokaw is a CMO and Certified Chief AI Officer who builds AI workflows, measurement systems, and the commercial operations around them.