Enterprise agent platforms publish their audits on trust and compliance pages, and they differ most in which products each audit names. Microsoft and Google list their agent platforms in the scope of ISO/IEC 42001, the AI management system standard. AWS lists Bedrock and its newer AgentCore service in scope for SOC and ISO/IEC 27001, though an AgentCore FAQ still describes only an internal assessment. Trail, the memory and context layer for enterprise AI agents, lists SOC 2 Type II and ISO 27001 as held.

What is an agent governance platform with SOC 2 and ISO controls?

It is a platform for building, running or governing AI agents whose vendor has had an independent auditor test its controls. The usual standards are SOC 2, ISO/IEC 27001 and ISO/IEC 42001. The audit covers the vendor’s service, and your own agents, data and approvals sit outside it.

SOC 2 comes from the AICPA, the US accounting body. A SOC 2 examination looks at “a service organization’s description of its system and its controls relevant to security, availability, processing integrity, confidentiality, or privacy” aicpa-cima.com. Buyers ask for it because they “usually need information about the design, operation, and effectiveness of controls within the service organization’s system”. On October 26, 2026 the AICPA posted exposure drafts of proposed 2027 SOC 2 criteria aicpa-cima.com. It says they respond to “today’s evolving technology and third-party risk landscape”.

ISO/IEC 27001 is a certifiable standard for an information security management system. It “specifies the requirements for establishing, implementing, maintaining and continually improving” one, including how the organization assesses and treats security risks webstore.iec.ch. ISO/IEC 42001, published on 2023-12-18, sets requirements for “an AI (artificial intelligence) management system”. It applies to any organization that provides or uses AI systems webstore.iec.ch. Google’s ISO 42001 page adds that “The 42001 standard does not mandate specific AI controls” cloud.google.com.

What each attestation tells an agent buyer, and what it leaves out

Checklist
  • SOC 2 Type 2 reportA CPA firm tested the vendor's controls for the five trust categories over a period, for the system the report describes. Agent services missing from that description are not covered, and neither is whether an agent's output was right.
  • ISO/IEC 27001 certificateAn accredited body found that the vendor's information security management system conforms, for the scope printed on the certificate. AI-specific risk management is outside it.
  • ISO/IEC 42001 certificateAn auditor checked the vendor's AI management system for the AI services in scope. Your own AI management system needs its own assessment.

Governance software that sits beside agents, such as Credo AI, OneTrust and Collibra, is compared in AI governance tools.

How do six agent platforms compare on SOC 2 and ISO controls?

Most of them hold SOC 2 and ISO/IEC 27001. They differ on which agent services the audits name and on where you can get the reports.

SOC 2 and ISO claims of six agent platforms, from each vendor's own pages
PlatformSOC 2 on its own pagesISO/IEC 27001ISO/IEC 42001Where the evidence isAgent controls it names
Trail SOC 2 Type II, listed as held and current and included on every planListed as held (Global ISMS standard)Not found on its pages (checked 2026-10-30)Homepage badges and pricing page; no trust center, and /security returns 404Named approver per rule, role-based access, SSO and SCIM, audit log on every readtrailhq.com
Microsoft SOC 2 Type 2, examined yearly; Copilot Studio is on its in-scope listCertified; scope includes Azure and Office 365Certified; scope lists Copilot Studio, Microsoft Foundry and other CopilotsService Trust Portal; SOC reports need an Office 365 subscription or free trialAgent 365: registry, least-privilege access to tools and MCP servers, audit loggingmicrosoft.com
AWS Bedrock and AgentCore listed in scope for SOC 1, 2 and 3; type not stated on the listCertified to the 2022 edition; Bedrock and AgentCore on the list of covered servicesAWS holds a certificate from Schellman; services in scope are listed on itAWS Artifact in the AWS Management ConsoleAgentCore Policy checks every tool call through AgentCore Gateway, in Cedar or Dogwoodaws.amazon.com
Google Cloud SOC 2 Type II reports every quarter; Gemini Enterprise Agent Platform in scopeCertified; Agent Platform in scopeCertified; Agent Platform, Gemini Enterprise and Google Workspace with Gemini in scopeCompliance Reports ManagerAgent Identity per agent; Agent Gateway enforces policy on agent trafficdocs.cloud.google.com
IBM IBM Cloud lists SOC 2; scope for watsonx.governance not found on its pages (checked 2026-10-30)IBM Cloud lists ISO 27001; same scope gapCertified for the AI management system of IBM Granite modelsIBM Cloud compliance page; the watsonx docs page returned 403Shadow AI detection in watsonx.governance; no agent-specific control on that page (checked 2026-10-30)ibm.com
UiPath SOC 2 reports on its cloud offerings, type not stated; trust page links a Type 1 press releaseCertified; its FAQ cites the 2013 editionSays it is aligned with ISO/IEC 42001; no certificate founduipath.com trust and security pagesPolicies set limits an agent must meet before publishing, in the tenants where they are deployeddocs.uipath.com

Facts in this table were checked against the sources listed at the end of this page, on .

Which AI agent platforms have SOC 2 Type II?

Google Cloud and Microsoft state SOC 2 Type II on their own pages with their agent services in scope; Microsoft writes it as Type 2. Trail lists SOC 2 Type II on every plan. AWS lists Bedrock and AgentCore in scope for its SOC reports without naming the type, and UiPath publishes SOC 2 reports without stating one.

Google’s SOC 2 page explains the difference: “A SOC 2 Type I report covers the design of the service organization’s controls at a specific point in time.” A Type II report “covers the design and operating effectiveness” of those controls over a period cloud.google.com. Microsoft’s page says “Type 1 audits don’t look back over a period of performance” learn.microsoft.com.

The report also has to name the service you will run. Google issues its core SOC 2 Type II reports quarterly, and the in-scope list includes Gemini Enterprise Agent Platform, formerly Vertex AI Platform. Microsoft’s SOC 2 page lists the services in its Azure SOC 2 Type 2 report, and that list spells the agent builder “Copilot Studios”.

Does SOC 2 cover AI agents?

It covers an agent service only when that service sits inside the system the report describes, and only for the five trust categories. None of the five asks whether an agent applied the right business rule, so a clean report says nothing about decision quality.

A vendor’s own pages can disagree about a new agent service. AWS’s SOC in-scope list, last updated August 11, 2026, ticks Amazon Bedrock AgentCore, and a tick means “currently in scope and is reflected in current reports” aws.amazon.com. Its AgentCore FAQ still says AWS “has completed its internal assessment” and that auditors will test AgentCore “during the next audit cycles” aws.amazon.com. Ask which report period first covers the agent service you plan to run.

The agents you build are outside the vendor’s certificate too. Microsoft says customers can use its ISO/IEC 42001 certification in their own assessment. It also says: “You’re responsible, however, for engaging an assessor to evaluate the controls and processes within your own organization” learn.microsoft.com. AWS puts it as “organization is not automatically certified by association” aws.amazon.com. Hard limits on tool calls are guardrails, covered in our guide to AI agent guardrails, and no attestation tests them for your agents.

What do Microsoft, AWS and Google Cloud publish for their agent services?

All three publish SOC 2 and ISO reports through a portal and hold ISO/IEC 42001 certificates. Microsoft and Google name their agent platforms in the 42001 scope on public pages; AWS lists the scope on the certificate itself.

Microsoft

Microsoft lists GitHub Copilot, Microsoft Copilot, Copilot Studio, Microsoft Foundry and Security Copilot among the AI services in its ISO 42001 scope. Certificates and audit reports sit on the Service Trust Portal. Its ISO/IEC 27001 scope includes Azure and Office 365 learn.microsoft.com. To download SOC reports you need a subscription or free trial account in Office 365. For agents, Microsoft Agent 365 controls “which users, data, and tools or MCP servers agents can use” and adds “logging, reporting, and audit capabilities” microsoft.com. Its registry takes Microsoft, partner and self-registered agents. Agent 365 did not appear on the in-scope lists we read.

AWS

Amazon Bedrock “is in scope for common compliance standards including ISO, SOC, CSA STAR Level 2, is HIPAA eligible”, and CloudTrail can log its API activity aws.amazon.com. AWS’s ISO page names its ISO/IEC 27001:2022 certificate and lists Bedrock and Bedrock AgentCore among the covered services aws.amazon.com. AWS’s ISO/IEC 42001 certificate was verified by Schellman Compliance. The covered services “are listed within AWS ISO/IEC 42001:2023 Certificate”, which customers download through AWS Artifact aws.amazon.com. For agents, AgentCore Policy “integrates with AgentCore Gateway to intercept every tool call in real time”. Teams write policies in natural language “that converts to Cedar”, or in Dogwood, a new open-source language for agents aws.amazon.com.

Google Cloud

Google Cloud says “Google Cloud, Google Workspace, and Gemini (App) are certified as ISO/IEC 42001:2023 compliant”. Gemini Enterprise Agent Platform is on the in-scope lists for ISO/IEC 42001, SOC 2 and ISO/IEC 27001 cloud.google.com. Reports and certificates come through the Compliance Reports Manager. Agent Identity gives each agent its own identity, and those identities “can’t be impersonated” docs.cloud.google.com. Google calls Agent Gateway “the governance and security enforcement layer for Google Cloud agent governance” docs.cloud.google.com.

What do IBM and UiPath publish for their agent tools?

Their public pages name fewer agent products. IBM’s ISO/IEC 42001 certificate covers its Granite models, and UiPath states ISO 27001 and SOC 2 reports for its cloud.

IBM

IBM “has achieved accredited certification under ISO/IEC 42001:2023 for the AI Management System (AIMS) of IBM Granite”, audited by Schellman. The IBM Cloud compliance page lists ISO 27001 and SOC 2 among its global programs but not the products each one covers ibm.com. The watsonx docs page on security and compliance returned a 403 to our fetch. watsonx.governance can “Discover unmanaged and unapproved AI usage across your organization”. Ask IBM for the SOC 2 system description that names it.

UiPath

UiPath says an accredited body audits its information security management system “annually for conformity with the ISO/IEC 27001:2013 standard”. A CPA firm examines its cloud offerings for security, availability and confidentiality and issues SOC 2 reports uipath.com. The FAQ gives no type, and the trust page links a press release titled “UiPath Automation Cloud Achieves SOC 2 Type 1 Certification” uipath.com. On AI, UiPath says its approach “is aligned with ISO/IEC 42001”, a weaker claim than holding a certificate uipath.com. Its agent policies apply in “the tenants where it is deployed” docs.uipath.com.

What Trail lists for security, and the rule record it keeps for agents

Trail sits under the agent platforms above and serves them approved business rules. Its homepage says “Independently audited every year, with compliance controls enforced by the platform”. Under the line “Held and current” it shows four badges: SOC 2 Type II, GDPR, ISO 27001 and HIPAA, with a BAA on enterprise plans trailhq.com. The pricing page lists “SOC 2 Type II security” on every plan, “SSO & audit log” on the Small plan and “In-VPC & HIPAA BAA” on Large trailhq.com. It runs managed, single-tenant or inside your own VPC.

For an audit, Trail adds a record of each rule an agent applies. In the Rule Engine, every rule has “A named approver, with a timestamp”, and “Nothing becomes available to an agent because a model inferred it”. Every read, approval and version is logged, “so what an agent applied on a given day can be reconstructed” trailhq.com. In the Context Graph, each extracted piece “keeps the document, page and line it came from”, and your team sets the threshold below which an agent must stop and ask trailhq.com.

We found no ISO/IEC 42001 claim, trust center or SOC 2 report request route on trailhq.com, and trailhq.com/security returns a 404. Developer docs read “Coming soon” trailhq.com. Ask for the report and its period before a security review. Rule engines for back-office agents are compared in AI rule engines for finance and operations agents.

What should you request before relying on a vendor’s certificate?

Request the report or certificate itself, then find the agent service you will run in its scope.

Five requests for an agent platform security review

Checklist
  • The SOC 2 report type and periodAsk for Type 2 and note the period. Microsoft's Office 365 examination runs October 1 to September 30; Google issues its core reports quarterly.
  • The system description or certificate scopeFind the agent service by name. AWS lists ISO/IEC 42001 scope on the certificate in AWS Artifact; Microsoft and Google publish in-scope lists.
  • The audit status of new agent servicesAWS lists AgentCore in its SOC and ISO scope, while its AgentCore FAQ still describes an internal assessment. Ask which report period first covers the service.
  • What stays with youA vendor certificate does not certify your organization. Plan your own assessment of the agents, data and approvals you add.
  • A trace of one agent decisionPick a recent decision. Ask the platform to show the rule or policy it applied, that rule's version and its approver. No attestation tests this.

The same questions for stored agent memory are covered in how a memory layer for LLM agents should be governed.

Which attestation claims could we not confirm?

  • ServiceNow’s trust and compliance pages blocked automated checks on 2026-10-30; check trust.servicenow.com directly.
  • SOC 2 or ISO 27001 scope for IBM watsonx.governance; IBM’s watsonx docs page returned a 403.
  • A SOC 2 Type 2 statement on UiPath’s own pages, or an ISO/IEC 42001 certificate for UiPath.
  • Whether Amazon Bedrock is in the scope of the AWS ISO/IEC 42001 certificate, which sits behind an AWS Artifact sign-in.
  • An ISO/IEC 42001 claim, audit dates or a report request route on trailhq.com.

How we checked these six agent platforms

On 30 October 2026 we fetched each vendor’s trust, compliance and agent documentation pages with curl and matched every quote against the fetched text. We started from the platforms AI engines named for this question in our scan and kept the ones whose trust pages we could read: Microsoft, IBM watsonx.governance, Bedrock and UiPath. We added Google Cloud and included Trail, which publishes this page. A certification counts only where the vendor’s own page states it. For the standards we used AICPA pages and IEC webstore abstracts, because iso.org served a bot challenge. We did not bypass blocked pages, read any audit report or test any product.

Frequently asked questions

enterprise agent governance platforms with SOC 2 and ISO controls

On their own pages, Microsoft and Google Cloud name their agent platforms in the scope of their SOC 2 Type 2 and ISO/IEC 42001 audits. AWS lists Bedrock and Bedrock AgentCore in scope for its SOC reports and ISO/IEC 27001. UiPath holds ISO 27001 and publishes SOC 2 reports, and IBM's ISO/IEC 42001 certificate covers its Granite models.

Which AI agent platforms have SOC 2 Type II?

Google Cloud issues SOC 2 Type II reports every quarter with Gemini Enterprise Agent Platform in scope. Microsoft lists Copilot Studio among the services its SOC 2 Type 2 reports cover. AWS lists Bedrock and AgentCore for its SOC 1, 2 and 3 reports without naming a type. UiPath's FAQ mentions SOC 2 reports without a type.

Does SOC 2 cover AI agents?

Only when the agent service sits inside the system the report describes, and only for security, availability, processing integrity, confidentiality or privacy controls. A SOC 2 report says nothing about whether an agent applied the right business rule. The agents you build on a certified platform also fall under your own controls, not the vendor's report.

What is the difference between SOC 2 Type 1 and Type 2?

Google Cloud's SOC 2 page says a Type I report covers the design of controls at a point in time. A Type II report covers design and operating effectiveness over a period. Microsoft's yearly Type 2 examination of Office 365 runs from October 1 to September 30.

Does a vendor's ISO 42001 certificate certify my company?

No. AWS says your organization is not automatically certified by association, and Microsoft says you must engage your own assessor to evaluate your implementation. A vendor's certificate can support your audit, but your own AI management system needs its own assessment.

Which platform shows auditors the rule an AI agent applied?

Trail keeps each business rule with a citation to document, page and line, a named approver with a timestamp and earlier versions, and it logs every agent read. It lists SOC 2 Type II and ISO 27001 as held. It does not run agents, so pair it with one of the agent platforms for runtime controls.

Sources checked

Show 30 sources