AI Transformation · Compliance

“The AI did it” won't pass your next audit

AI writes the code, agents ship the changes, model providers see the data. Auditors and customers now want to know who is accountable - and "the AI" isn't an answer.

What changed for audits in 2026, what you'll be asked, and how we help you stay compliant and get through audits faster.

11 Nov 2026QCerris Team5 min read

What changed

AI is now inside the audit

Every audit asks the same thing a hundred ways: who did this, who checked it, who approved it? More and more often the honest answer is "the AI" - and no auditor accepts that.

What gets audited changed. By Veracode's estimate, AI now writes roughly half of all committed code, and its 2026 tests put the average security pass rate of that code at 56%. Agents change systems; model APIs see customer data.
How audits run changed. Auditors use AI to test whole populations of changes, not a sample. Customers ask about AI in every security questionnaire.

Large enterprises feel this first, so most of the research below comes from them. A 50-person SaaS company feels it the day its first enterprise customer sends a questionnaire.

Ten months

In 2026, the rulebook caught up

Figure 1

Most of the new AI audit rules landed in 2026. Three deadlines are still ahead.

Jan 2026Jul 2026Jan 2027Jul 2027Jan 2028

COSO guidance on GenAI controlsFeb 23, 2026

EU AI Act Omnibus in forceJul 27, 2026

AI Act transparency rules applyAug 2, 2026

AICPA: AI in SOC exams (TQA 9561)Sep 11, 2026

AICPA + AIUC: SOC 2 plus AIUC-1Oct 19, 2026

Revised SOC 2 criteria: draftOct 28, 2026

Draft comment period closesJan 15, 2027

AI Act high-risk rules applyDec 2, 2027

Revised SOC 2 criteria in effect*Dec 31, 2027

In placeAhead* if finalized; early adoption allowed

No separate AI audit - AI is judged by the controls you already have.

The message is the same everywhere: there is no separate AI audit. The AICPA's September guidance (TQA 9561) adds no AI criteria to today's SOC 2, and COSO treats generative AI as an internal-control problem. AI is judged by the controls you already have. The revised SOC 2 criteria, proposed in October for audits starting from 31 December 2027, make it explicit: AI points of focus under 17 criteria, from AI agents to unapproved AI tools.

Stage by stage

What AI changes at each stage of an audit

Stage	What AI changes	What auditors now expect
Scoping	AI tools, agents and model APIs sit inside the system boundary	An AI inventory, with the reason each item is in or out
Controls	Change, access and vendor controls were written for people	The same controls covering AI: approver isn't the author, agents have their own identity, model providers are managed as vendors
Evidence	More changes, while evidence is still gathered by hand	Evidence the workflow produces itself, across the whole period
Testing	Auditors test larger populations, not small samples	Every change holds up, not only the ones you'd show
Customer reviews	Questionnaires such as SIG 2026 ask about AI	Answers backed by records

Policy is not control

A policy won't cover it

Most companies answer with an AI policy. IBM's 2026 Cost of a Data Breach report shows the gap:

68%

of breached organizations had no governance to manage AI or detect shadow AI

43%

of breaches involved shadow AI, up from 20% a year earlier

92%

of AI-related breaches happened where AI access controls were missing

Banning AI pushes it into personal accounts. Ignoring it ends in audit exceptions and stalled security reviews. What works is governing it in the flow: approvals, data boundaries and evidence that happen as the work happens.

Our role

Where QCerris fits: two ways we help

We're not your auditor, and we don't sell a compliance platform. We're the consulting and engineering partner that changes how the work flows, so the audit holds up.

Approach 1

Audit-ready AI

"Can we prove we control the AI we use?"

What we doMap AI use against your audit scope and close the gaps: change management, access, vendors, shadow AI.

Start withAI Delivery Health Check →

Approach 2

AI-powered compliance

"Why does every audit still take weeks?"

What we doAutomate evidence collection, control monitoring and first drafts of questionnaire answers. Your team reviews and signs off.

Start withAI Quick Start →

We did this on ourselves first, under ISO/IEC 27001. When your data can't leave your environment, we run self-hosted models inside your infrastructure.

The product

Where CodeMerlin fits

Most AI audit questions start in software delivery. CodeMerlin, built by QCerris, makes AI-built code audit-ready by default: one approved spec per ticket, agents working from that spec, every pull request reviewed against it, every action recorded with a name and a time.

Figure 2

Every step leaves its own evidence, so nothing is rebuilt for the audit

The workThe record it leavesWhat it answers

1. Request System

A ticket in Jira or Linear, even a vague one

Change request with an owner

SOC 2 CC8.1ISO A.8.32

2. Spec approved Human gate

Requirements and acceptance criteria signed off before any code

Named approver, timestamp, every edit recorded

SOC 2 CC8.1ISO A.8.25

3. Governed build AI agents

Approved tools and context, inside your data boundary or self-hosted

Tool and model inventory, data flow per provider

SOC 2 CC9.2ISO A.5.19 to A.5.23

4. Intent review Human gate

Tests, plus a reviewer who isn't the author, check the PR against the spec

Test results and review record, approver is not the author

SOC 2 CC8.1ISO A.8.25, A.8.28

5. Release System

Deployed with a rollback path, linked back to the approved spec

Release record with the full spec-to-PR trail

SOC 2 CC8.1ISO A.8.32

One unbroken line from request to release, ready for auditors and questionnaires

Human gate: a named person decidesAI or system stepSOC 2 (2017 criteria) · ISO/IEC 27001:2022

This is the loop CodeMerlin runs on every AI-built change.

When the auditor asks for a sample, the trail already exists - with the same standard in every team. More on how it works in Turn AI Speed Into Enterprise Delivery.

Our process

How we work

Pick the door that matches where you are. Both lead into the same four steps.

Figure 3

Two ways in, one path to audit-ready

Approach 1 · Audit-ready AI

AI Delivery Health Check

You already use AI and need to prove control

Approach 2 · AI-powered compliance

AI Quick Start

You want AI to take on compliance work

1DiagnoseAI use mapped against your audit scope, gaps ranked by impact

2DesignControls built into the workflow: gates, data boundaries, vendors

3DeliverA first use case live in production, inside the guardrails

4Govern and scaleCodeMerlin and training across teams, evidence produced as work happens

Audit-ready by default, and faster through every audit cycle

"The AI did it" won't pass.
"Here's the record" will.

Start with a Health Check if you already use AI, or a Quick Start if you want AI to take on compliance work.

Explore AI Transformation →Book the Health Check

General information, not legal or audit advice. Scope decisions belong to you and your auditor.