It's great to see SOC2 going in this direction. I've had to set up all kinds of compliance automation over the past decade (mainly Drata, Vanta, Oneleet), but at the end of the day it's a huge pain grabbing screenshots for what feels like a very performative process.

I asked a SOC2 auditor a while back about why they don't just make their own compliance automation dashboard, so we can pre-fill all their specific requests. They mentioned that certain rules are in place to separate evidence preparation from the actual auditing firms. However, after doing some armchair ChatGPT research, it seems like an audit firm could potentially be permitted to provide evidence management software, as long as you're not guaranteeing an audit result or preventing people from taking the evidence elsewhere. Perhaps you could shed light on the legal aspects and AICPA guidance here for providing evidence collection as AI skills to the companies you audit?