I've started noticing a specific kind of relief cross a founder's face when they mention their SOC 2 report or their ISO certification in the middle of a conversation about AI governance, as though the certificate has already answered the question I'm about to ask before I've even finished asking it. It hasn't, and I think it's worth being precise about exactly what these certifications do cover, because the gap between "certified" and "governed" is exactly where a lot of quiet brand damage happens.
What SOC 2 actually verifies
SOC 2 is an attestation, not a certification in the strict sense — an independent auditor, typically a CPA firm, assesses an organization's controls against one or more of five Trust Services Criteria defined by the American Institute of Certified Public Accountants: security, availability, processing integrity, confidentiality, and privacy. It's flexible enough that an organization can scope its SOC 2 examination to include AI-related controls — secure handling of training data, access management, incident response for AI-related failures. That's genuinely valuable, and I don't want to undersell what a SOC 2 report tells a customer or partner: your data is being handled with a documented, audited level of operational rigor that took genuine time and money to earn.
What SOC 2 does not do, by design, is ask whether the actual content your AI systems produce still sounds like your brand. It's an operational and security framework, not a content or identity framework. A company can pass every relevant SOC 2 criterion with a chatbot that's drifted completely away from its stated values, because nothing in the Trust Services Criteria asks that specific question, and nothing in the audit process would flag it if it did.
What ISO/IEC 42001 actually verifies
ISO/IEC 42001, published in December 2023, is the first international standard specifically for an AI management system — a structured way of governing the responsible development, provision, and use of AI within an organization. It's considerably broader than SOC 2 in its ambition, covering nine control domains including AI policies, impact assessments across the AI system lifecycle, data quality, transparency to interested parties, and third-party relationships. This is closer to what I'd want a business to have in place, and I think it's a genuinely useful standard for organizations serious about AI governance at the operational level, worth pursuing on its own merits regardless of anything else in this piece.
But even here, the standard's controls are process-oriented: does the organization have a policy, does it conduct impact assessments, does it document its AI system lifecycle. A company can satisfy every one of ISO 42001's thirty-eight Annex A controls — have the policies, run the assessments, keep the documentation — while still never actually checking whether last month's AI-generated customer communications sound like the brand. The standard asks whether you have a process for managing AI responsibly. It does not, and was never built to, ask whether your specific brand voice has quietly gone generic this quarter.
Why this gap is easy to miss, and expensive to miss
I think the reason "we're SOC 2 compliant" or "we're pursuing ISO 42001 certification" so often gets treated as a complete answer is that certification requires real, visible effort — audits, documentation, sometimes tens of thousands of dollars and months of preparation — and effort that visible feels like it should have covered everything adjacent to the topic. It hasn't, because the effort was aimed at a genuinely different target. A company can be fully certified under both frameworks and still be the next CNET, publishing AI-assisted content that quietly drifts from its editorial standards for months, because neither framework was built to catch that specific failure mode, however rigorously each is implemented.
This matters practically because certification can create a false sense that the harder work is already done. A leadership team that's just finished a demanding ISO 42001 audit has every reason to feel they've addressed AI governance seriously — and they have, for the specific risks that standard covers. But if that same team treats the certificate as covering brand-level integrity too, they've quietly closed the loop on a question the certificate never actually asked.
What sits underneath both frameworks, unaddressed
My own BIG Framework isn't a replacement for SOC 2 or ISO 42001 — it operates at a different, narrower altitude, the same way I've argued my broader research question sits underneath the big-question work of AI ethics scholarship. Brand Integrity, Intelligent Human Oversight, and Governance for Human Flourishing are checks a company runs in addition to, not instead of, whatever compliance certifications it holds. A business can and should pursue both: the operational and security assurance a certification provides, and the brand-level content check no certification was ever designed to perform. Treating one as a substitute for the other is precisely the mistake that leaves the gap open.
A concrete scenario worth sitting with
Let me make this less abstract with a scenario I think plays out constantly, even if it rarely gets written up as a case study the way a viral chatbot mishap does. Picture a mid-sized company that has, over the past year, invested seriously in AI governance — genuinely, not performatively. They've completed a SOC 2 Type II examination covering their AI-related data handling. They've begun the process toward ISO 42001 certification, building out impact assessments and lifecycle documentation for every AI system in production. Leadership feels, reasonably, that they've taken this more seriously than most of their competitors. And yet, over that same year, their AI-drafted customer support responses have quietly grown flatter, more generic, more interchangeable with a dozen competitors' responses — not because anyone made a decision to let that happen, but because nobody's compliance checklist ever asked the question "does this still sound like us," and every other part of their governance investment was, quite reasonably, pointed somewhere else entirely. This company is not a hypothetical outlier. It's the modal case I run into, and it's precisely why I think this distinction deserves to be said plainly rather than assumed to be obvious.
Why auditors aren't the right people to catch this, and shouldn't be expected to be
I want to be fair to the auditors and compliance professionals doing SOC 2 and ISO 42001 work, because I don't think the gap I'm describing is a failure on their part. A SOC 2 auditor's job is to verify controls against the Trust Services Criteria, and an ISO 42001 auditor's job is to verify an AI management system against a defined set of Annex A controls. Neither is trained, mandated, or even positioned to evaluate whether a specific piece of AI-generated marketing copy captures a specific brand's specific voice, because that's a fundamentally different kind of expertise — closer to editorial judgment than to security or process auditing — and expecting a compliance audit to also perform that function would stretch the audit well past what it's actually built to assess. This is exactly why the gap persists even at organizations working with genuinely competent, thorough auditors: the auditors are doing their job correctly. The job itself was never scoped to include this.
Why I think this distinction will matter more, not less, over the next few years
As more businesses reach for a certification as proof of "responsible AI use" — and I expect that pressure to grow, given how quickly ISO 42001 in particular is being adopted by major cloud providers and enterprise vendors — I think the temptation to treat certification as a complete answer will grow right alongside it. That's the trend I most want this piece to push back on early, before it hardens into an industry-wide assumption. A certificate is real evidence of real, valuable work. It is not, and I don't think it will ever become, evidence that a brand's specific voice has been checked against what that brand actually claims to be.
The one question a certificate will never ask for you
If your organization holds a SOC 2 report, an ISO 42001 certification, or both, the honest test isn't whether you passed the audit. It's whether anyone, at any point in that audit process, actually read a sample of your AI-generated output and asked whether it still sounds like you. If the answer is no — and for most organizations I've talked to, it is, regardless of how much they've genuinely invested elsewhere — then you have real, valuable, hard-won compliance, and you still have an ungoverned brand, sitting exactly where the certificate's scope quietly stopped and nobody thought to look further.
Curious what your compliance work actually covers, and what it doesn't, when it comes to your brand's own voice? Book a Brand Call →
References
Cloud Security Alliance. (2025, May 8). ISO 42001: Auditing and implementing framework.
Elevate Consult. (2026). ISO/IEC 42001 for AI platforms: Understanding AIMS scope.
Konfirmity. (2026). ISO 42001: The AI management system standard.