Does AI code review count for SOC 2?

No. An AI reviewer's comments and even its approval do not satisfy the change-management control a SOC 2 auditor tests. They can count as evidence that the change was examined. They cannot count as the approval, because the control assumes a qualified person other than the author approved the change and understood it, and a bot is neither a person nor accountable.

What CC8.1 asks

The 2017 Trust Services Criteria say, at CC8.1, that the entity authorizes, designs, develops or acquires, configures, documents, tests, approves and implements changes to infrastructure, data, software and procedures to meet its objectives. The word that matters for code review is "approves". The criteria do not say who, but every auditor reads it the same way: someone other than the person who made the change.

Auditors test it by sampling. They pull a list of merged pull requests for the period, pick a sample (commonly 25 for a Type II), and check each one for an approving review from an account that is not the author. If the sample is clean, the control passes. If one PR was merged with only the author's hand on it, that is an exception, and depending on the auditor it becomes a finding.

Why a bot approval fails the test

Three reasons, in the order an auditor will raise them.

First, accountability. The approval record exists so that a named person can be asked "what did you check?". A bot cannot be asked and cannot be held to an answer. Tian Pan's May 2026 analysis put it well: the approval record says one thing, and the actual cognitive accountability trail says something much weaker.

Second, qualification. Frameworks that are explicit about code review, PCI DSS 6.2.3.1 for one, require the reviewer to be knowledgeable about secure coding. Auditors carry that expectation into SOC 2 even though CC8.1 does not spell it out. A model's training is not a credential.

Third, precedent. As of mid-2026 no practitioner in the Vanta community reports an audit passing with AI-only approval, and the view relayed from A-LIGN is that fully AI-only review is not being accepted as standard. The AICPA is drafting guidance on emerging technology; until it lands, auditors default to the human reading.

GitHub's September 2026 change, which lets Copilot approvals count toward a repository's required-approvals rule, does not change any of this. It is a merge-gate setting. The audit gate is the auditor.

What makes AI review count as evidence

Keep the AI reviewer. Its comments are useful evidence of the "tests" and "designs" parts of CC8.1, and they make the human reviewer faster. What the auditor needs added is:

• An approving review from a named person other than the author, on every in-scope PR.
• Evidence that the person is qualified: experience, credentials, background check.
• A control description that names the approver and the standard they review against.
• A way to produce the full population of changes and their approvals without assembling it by hand.

That is what a PSCO Officer adds. The Officer reads what the AI posted, reviews the PR against your Security & Compliance Model, and posts the Approved Review from their own account. The attestation record per PR and the monthly Evidence Pack give the auditor the population and the sample.

Control wording that holds up

"All changes to production code require approval from a qualified reviewer who is not the author. Reviewers are PSCO Officers, background-checked US-based engineers contracted by the company, who review each change against the company's Security & Compliance Model before approval."

Name the approver. Name the standard. Keep the AI reviewers as an additional detection control in a separate sentence, so the auditor does not read them as the approver.