---
title: "SSAE 18 vs SOC 2: An in-depth guide - Axipro"
description: "SSAE 18 vs SOC 2 explained: key differences, audit standards, and which report your customers need. Expert guide for service organizations."
canonical: "https://axipro.co/ssae-18-vs-soc-2/"
language: "en-US"
modified: "2026-05-11T02:40:42+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [All Blog](https://axipro.co/category/blog/), [SOC-2](https://axipro.co/category/soc-2-2/)

/ SSAE 18 vs SOC 2: What’s the Difference and Which One Do You Need?

# SSAE 18 vs SOC 2: What’s the Difference and Which One Do You Need?

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- March 14, 2026

Copy Link

## The “SSAE 18 vs SOC 2” debate typically surfaces when buyers, vendors, and even internal teams are all talking about the same general assurance problem, but using the wrong labels.

A procurement team asks, *“Do you have SSAE 18?”* A founder says, *“We’re going for SSAE 18 certification.”* A customer security team asks for an *“SSAE 18 SOC 2 report.”* Everyone is circling the same planet, but not always landing on the right terminology.

**SSAE 18 and SOC 2 are not competing things.** They are related, but they are not interchangeable.

The[AICPA defines SOC 2](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) as an **examination and report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy**. **SSAE 18, by contrast, is the[attestation standard framework](https://en.wikipedia.org/wiki/SSAE_No._18)** under which these kinds of engagements are performed.

That distinction matters because buyers often ask for the wrong artifact. If you answer the wrong question, you can waste months preparing the wrong report.

## **Quick Answer: SSAE 18 Is a Standard; SOC 2 Is a Report**

The simplest accurate explanation is this: **SSAE 18 is the professional attestation standard; SOC 2 is the report deliverable.** The standard tells the auditor how to perform the engagement. The report is what your customers actually read.

The AICPA states that[SSAE No. 18 was issued as part of its attestation clarity project](https://www.aicpa-cima.com/resources/download/aicpa-ssaes-currently-effective), which clarified and recodified attestation standards. The same organization also explains that[SOC reports are part of the AICPA’s broader SOC suite of services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) used to communicate controls at service organizations.

So when someone says, *“We need SSAE 18,”* what they usually mean is one of two things: either they want a **SOC 1 report** for financial-reporting-related controls, or they want a[SOC 2 report](https://axipro.co/soc-2/) for security and broader system controls.

### **How SSAE 18 Relates to SOC 1, SOC 2, and SOC 3**

**SOC 1** addresses controls at a service organization that are relevant to a user entity’s internal control over financial reporting. The[AICPA positions SOC 1](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-1) specifically for management of user entities and their financial statement auditors.

**SOC 2** addresses controls relevant to the[Trust Services Criteria (TSC)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022): Security, Availability, Processing Integrity, Confidentiality, and Privacy. It is designed for customers and other specified users who need detailed information about system controls.

**SOC 3** covers the same trust services subject matter as SOC 2, but in a general-use format with less detail, so it can be freely distributed. (Think of it as the marketing-friendly version.)

In plain English: **SSAE 18 sits underneath the engagement methodology; SOC 1, SOC 2, and SOC 3 are the reporting formats and scopes that come out of it.**

## **What Is SSAE 18?**

SSAE 18 stands for[Statement on Standards for Attestation Engagements No. 18](https://en.wikipedia.org/wiki/SSAE_No._18). It is an AICPA-issued attestation standard used in examinations, reviews, and agreed-upon procedures for nonissuers. The AICPA describes SSAEs as applicable to the preparation and issuance of attestation reports for nonissuers, and specifically notes that SSAE No. 18 completed the attestation clarity project through clarification and recodification.

### **Who Issues SSAE 18 and Who Performs the Engagement**

The **AICPA Auditing Standards Board (ASB)** issues SSAE standards. The actual engagement, however, is performed by an **independent CPA firm** or service auditor. That division of labor is important. Your company does not “self-issue” SSAE 18. A CPA firm performs an attestation engagement under that standard and then issues the related report.

### Insider Tip

When a buyer asks whether you are "SSAE 18 certified," they are using market shorthand, not technical language. The better response is: "We have a SOC 2 Type 2 report issued by an independent CPA firm under the applicable attestation standards."

### **What SSAE 18 Replaced (SSAE 16 / SAS 70 Context)**

Historically, the service-organization reporting world moved from **SAS 70** to **SSAE 16**, and then to **SSAE 18**. The AICPA’s clarity and convergence work eliminated the old SAS 70 framing, established the SOC-branded reports, and recodified the underlying attestation standards into SSAE 18. The standard was introduced in 2016 and implemented in 2017 as part of this evolution. (For international context, SSAE 18’s closest equivalent is[ISAE 3402](https://en.wikipedia.org/wiki/ISAE_3402), issued by the International Auditing and Assurance Standards Board.)

That is why older buyers may still talk in legacy language. They remember SAS 70. Mid-generation buyers remember SSAE 16. Today’s market usually asks for SOC 1 or SOC 2, but sometimes with yesterday’s vocabulary still attached.

### **Which Engagements Fall Under SSAE 18**

Within the SOC context, SSAE 18 governs how the practitioner performs examinations that lead to reports such as SOC 1, SOC 2, and SOC 3. The[AICPA’s SOC suite overview](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) frames these offerings as assurance reports used to help assess and address outsourcing risk.

## **What Is a SOC 2 Report?**

A SOC 2 report is an independent attestation report on controls at a service organization relevant to the Trust Services Criteria. The[AICPA defines SOC 2](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) around the five criteria categories: **Security, Availability, Processing Integrity, Confidentiality, and Privacy**.

SOC 2 exists because businesses increasingly outsource critical systems to cloud and SaaS providers, and they want a way to evaluate whether those providers have appropriate controls in place. We’ve written an in-depth guide on what SOC 2 is, which you can [read here.](https://axipro.co/what-is-soc-guide/)

### **What SOC 2 Evaluates (Controls Aligned to Trust Services Criteria)**

SOC 2 evaluates whether the service organization’s system and controls are **suitably designed**—and, in a Type 2 engagement, whether they **operated effectively** over a review period—against the applicable TSC. Security is always part of SOC 2, while Availability, Processing Integrity, Confidentiality, and Privacy are included based on the nature of the service and customer commitments.

If you’re unsure which criteria apply to your organization, a[gap analysis](https://axipro.co/services/gap-analysis/) is a smart first step.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **SSAE 18 vs SOC 2: Side-by-Side Comparison**

| **Category** | **SSAE 18** | **SOC 2** |
| --- | --- | --- |
| **What it is** | Attestation standard | Report deliverable |
| **Issued by** | AICPA Auditing Standards Board | Independent CPA firm (after the engagement) |
| **Primary purpose** | Governs how the engagement is performed | Communicates results about controls relevant to TSC |
| **Scope** | Broad attestation framework | Security and system controls at a service organization |
| **Main users** | Auditors and firms performing the work | Customers, prospects, procurement, security reviewers |
| **Output** | Professional standard / methodology | Management assertion, system description, testing, opinion |
| **Distribution** | Not the deliverable buyers request | Restricted-use report in most cases |

### **Standard vs Report Deliverable**

This is the big one. **SSAE 18 is not something you hand to a customer.** A customer asks for the report, not the standard. If someone on your team is confused about this, that’s normal—and it’s worth correcting early.

### **Scope: Financial Reporting (SOC 1) vs Security/Compliance Controls (SOC 2)**

SOC 1 and SOC 2 both live in the same general family, but they solve different problems. The[AICPA states that SOC 1](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-1) is about controls relevant to financial reporting, while SOC 2 addresses the TSC categories tied to system security and reliability. Understanding this distinction is fundamental—if you’re also weighing other frameworks, the comparison between[ISO 27001 and SOC 2](https://axipro.co/iso-27001-vs-soc-2-understanding-the-key-differences/) is worth reading.

## **Where “SSAE 18” Shows Up in a SOC 2 Report (What to Look For)**

### **Auditor’s Report Section and Applicable Professional Standards**

The report will identify the professional standards under which the examination was performed. In practical terms, this is where the “SSAE” connection shows up most clearly—you’ll see a reference to the applicable AT-C sections that originate from SSAE 18.

### **System Description Boundaries**

A SOC 2 report includes a **system description** outlining the services, boundaries, infrastructure, software, people, procedures, and data relevant to the examination. Reading this section carefully is essential—it tells you *exactly* what is (and isn’t) covered by the report.

### **Subservice Organizations (Carve-Out vs Inclusive Method)**

This is where many teams get surprised. If you rely on a cloud host, colocation provider, or other third party, the report needs to explain how those **subservice organizations** are handled. SSAE 18 places stronger emphasis on monitoring subservice organizations and on describing whether they are *included* in the scope of the examination or *carved out*.

- **Inclusive method:** The subservice organization’s controls are tested as part of the engagement.
- **Carve-out method:** The subservice organization’s controls are excluded, and the report states that the user entity should obtain and review the subservice organization’s own SOC report.

### **Complementary User Entity Controls (CUECs) and Why They Matter**

CUECs are the controls the user entity is expected to implement for the overall control environment to work as intended. If the provider’s controls assume the customer will manage IAM,[encryption choices](https://axipro.co/soc-2-encryption-requirements), backups, or log review, those assumptions are documented here.

For organizations implementing[continuous monitoring for SOC 2](https://axipro.co/continuous-monitoring-for-soc-2-compliance/), understanding CUECs is essential because many of these complementary controls need ongoing attention, not just a one-time setup.

## **Common Misconceptions (and the Correct Terminology)**

### **“SSAE 18 Certification” vs “SOC 2 Report”**

There is **no formal thing called “SSAE 18 certification.”** The more accurate language is that a company has obtained a SOC 2 report resulting from an examination performed under the applicable attestation standards. The AICPA does not issue certifications—it publishes the standards that CPA firms use to perform and report on engagements.

### **“SSAE 18 SOC 2” as Shorthand vs Formal Naming**

People say it. Search engines love it. Procurement spreadsheets keep it alive. But formally, the better phrasing is simply **“SOC 2 report”** or **“SOC 2 Type 2 report.”**

### **“SOC 2 Compliant” vs Having an Issued SOC 2 Report**

This phrase is common, but slippery. “SOC 2 compliant” can mean almost anything—from *“we follow the spirit of the criteria”* to *“our report is in progress.”* The stronger, more credible statement is: **“We have an issued SOC 2 report.”** That tells the buyer there is a real deliverable from a real CPA firm, not just an internal claim.

## **Which One Do You Need?**

If a customer asks for “SSAE 18,” do not answer too quickly. **Ask what they want to evaluate.**

- If they care about your **impact on their financial reporting**, they likely want **SOC 1**.

- If they care about your **security controls, availability commitments, or handling of sensitive information**, they likely want **SOC 2**.

If customers ask for SOC 2, **Type 2 is usually what they really expect** once you are selling into mid-market or enterprise accounts, because that is the version showing operating effectiveness over time.

If you process transactions that affect customer financial statements, SOC 1 may be necessary—and SOC 2 may still be useful if security teams are also reviewing you.

## **Do You Ever Need Both SOC 1 and SOC 2?**

Yes, absolutely.

### **Typical Scenarios for Dual Reporting**

Organizations in **payroll, payments, claims processing, benefits administration, and some fintech categories** often need both. Finance wants SOC 1. Security and procurement want SOC 2.

### **How to Reduce Overlap**

The efficient path is not running two totally separate universes. Smart teams align control narratives, evidence collection, and testing calendars where possible. Shared controls around **access, change management, monitoring, and vendor management** can support both engagements, even though the report objectives differ.

If you’re weighing compliance tooling to manage that workload, our comparison of[Drata vs Vanta](https://axipro.co/drata-vs-vanta-which-compliance-tool-is-best/) is a good starting point.

## **How to Choose the Right Path: A Practical Decision Framework**

1. **Start with your services and system boundaries.** What do you actually do? What systems are in scope? Which data do you touch?
2. **Identify customer and regulatory requirements.** What are buyers asking for in security reviews, MSAs, and procurement portals?
3. **Select the applicable Trust Services Criteria categories for SOC 2.** Security is mandatory; the other categories depend on your commitments and risk profile.
4. **Decide Type 1 vs Type 2** based on your sales motion and buyer expectations. Early-stage companies sometimes begin with Type 1 to accelerate initial deals, then move to Type 2. More mature B2B SaaS companies are increasingly expected to present Type 2.

Not sure where you stand? A[gap analysis](https://axipro.co/services/gap-analysis/) can clarify whether you need SOC 1, SOC 2, or a coordinated path to both. If you’d like to talk it through,[click here to get in touch](https://axipro.co/contact/).

## **FAQ: SSAE 18 vs SOC 2**

Is SSAE 18 the same as SOC 2?

No. SSAE 18 is the attestation standard; SOC 2 is the report. They are related—SOC 2 examinations are performed under the SSAE 18 framework—but they are not the same thing.

Is SSAE 18 a SOC report?

No. It is the professional standard used to perform attestation engagements. The SOC report is the output of an engagement performed under that standard.

Does SSAE 18 apply to SOC 2 Type 2?

Yes. SOC 2 Type 2 examinations are performed under the applicable attestation standards, and SSAE 18 is the foundational reference point in this context.

What's the difference between SOC 1 and SOC 2 under SSAE 18?

SOC 1 addresses controls relevant to financial reporting. SOC 2 addresses controls relevant to the Trust Services Criteria. Both engagements are performed under the SSAE 18 framework, but they serve different audiences and evaluate different control objectives.

Which is better for SaaS vendors: SSAE 18 or SOC 2?

That is the wrong comparison. For most SaaS vendors, the relevant deliverable is SOC 2. SSAE 18 is the standard behind the engagement, not the thing you choose instead of SOC 2. To learn more about what to expect from a SOC 2 engagement, we’ve laid out the process step by step.

Can I say I'm "SSAE 18 certified" if I have a SOC 2?

That wording is not technically accurate. Say you have a SOC 2 report, ideally specifying Type 1 or Type 2. The AICPA does not issue “certifications”—it provides the standards under which CPA firms perform and report on examinations.

## **Final Thoughts**

The cleanest takeaway is this: **SSAE 18 is the standard. SOC 2 is the report.** Once you separate those ideas, the rest of the decision tree gets much easier.

If your buyers are asking for “SSAE 18,” clarify whether they really need SOC 1 or SOC 2. If you are a SaaS or cloud service organization, the answer is very often SOC 2 Type 2. If your services affect customer financial statements, you may need SOC 1, and in some cases both.

If you are planning your next move, now is the right time to book a SOC readiness assessment, request an audit scoping review, or a gap analysis so you can confirm whether you need SOC 1, SOC 2, or a coordinated path to both.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- March 14, 2026
- [All Blog](https://axipro.co/category/blog/), [SOC-2](https://axipro.co/category/soc-2-2/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us