Compliance · SOC 2 (2017 Trust Services Criteria)
Does AI code review count for SOC 2?
Not on its own. SOC 2 CC8.1 expects every production change to be authorized, tested and approved, and auditors test it by sampling merged pull requests for an approver other than the author. An AI reviewer posting comments or even an approval is not a qualified person and is not accountable, and as of mid-2026 no practitioner reports an audit passing with AI-only approval. A PSCO Officer, named on the PR, is the approver the auditor is looking for, and the attestation record per PR is the evidence.
The mapping rows
| Framework | Control | What it asks | How PSCO satisfies it |
|---|---|---|---|
| SOC 2 (2017 TSC) | CC8.1 Change management | Changes are authorized, designed, tested, approved and implemented; auditors sample merged PRs for an approver other than the author | Named Officer approval on every PR; attestation record per PR; monthly Evidence Pack laid out for sample testing |
| SOC 2 (2017 TSC) | CC6.1, CC6.3 Logical access and segregation | Ability to change production is restricted and segregated | Branch protection requires PSCO approval and the psco/approved check; authors cannot self-approve; PSCO never merges or deploys |
Watch item
The AICPA is updating SOC 2 guidance for emerging technology, with draft guidance expected in Q4 2026. If it accepts AI-only approval for low-risk changes, PSCO shifts from the required approver to the human-oversight control over the AI reviewer, which ISO/IEC 42001 and the EU AI Act already ask for.
Suggested control wording
Name the approver. Name the standard.
Paste this into your control description. The first sentence is the control; the second names the reviewer and the standard they review against, which is what an auditor needs to accept an outside approver.
All changes to production code require approval from a qualified reviewer who is not the author. Reviewers are PSCO Officers, background-checked US-based engineers contracted by the company, who review each change against the company’s Security & Compliance Model before approval.
Segregation under CC6.1 and CC6.3 is enforced technically: branch protection requires one approval from the @psco-officers team and the psco/approved status check, so an author cannot self-approve and PSCO never merges or deploys.
What a SOC 2 auditor samples
Build the record so it is already there.
Auditors test change management by sampling. These are the facts they look for on each sampled change, and where PSCO puts them.
- 01A sample of merged PRs from the audit period, each with an approving review from a named person who is not the author.
- 02Evidence that the approver was qualified: the Officer Dossier covers qualifications, background checks and training.
- 03Branch protection configuration showing the required approval and the required check at the time of each merge.
- 04The population of changes, which the monthly Evidence Pack lists in the order and format auditors sample from.
Auditor Guide
Hand your auditor the design once. Then they recommend it.
Before public launch PSCO briefed audit firms that together cover most startup and mid-market SOC 2 reports on the control design, the Officer Dossier and the Evidence Pack. The Auditor Guide is their questions, answered, for your auditor to read before the first sample.
The control design, the Officer Dossier and the Evidence Pack, written for your auditor.
A short PDF that answers the questions audit firms asked when we briefed them: who the approver is, how they are qualified, what the attestation records, and how to sample it. Enter a work email and we send the guide.
See your exact price before you talk to anyone.
Connect GitHub, pick the repos in scope, and get a quote from your real PR history in two minutes.