Which brands does AI call SOC 2 or HIPAA compliant, and does it cite a source?

A compliance claim is an AI answer saying that a named brand holds, meets or is covered by SOC 2, HIPAA, GDPR, ISO 27001, PCI DSS or FedRAMP. Examples are "Shopify is Level 1 PCI DSS compliant" or "Doxy.me offers a BAA". A claim is backed when the same answer cites a page whose text names both the brand and the standard.

We could read every cited page for 705 claims. In those answers, 77.3% of compliance claims were backed. A second check used only the link inside the claim sentence itself. Where that linked page could be read (1,157 claims), it named the brand and the standard 72.8% of the time. The two methods agree within five points: about 3 in 4 claims are backed.

Across 24,029 answers to compliance prompts, the engines made 3,349 compliance claims about 790 brands. HIPAA accounts for 2,129 of them, almost two in three. SOC 2 follows with 671. GDPR claims were rare: 149, even though GDPR is named in 2,336 brand sentences.

Google AI Mode made slightly more claims than ChatGPT Search (1,728 vs 1,621), mostly because it made more HIPAA claims (1,152 vs 977). Claims appeared in 6.0% of answers.

Most sentences that name a standard describe what a product does for customers, such as "automates SOC 2 evidence collection". Only 3,349 of 13,882 brand-and-standard mentions (24.1%) were compliance claims.

The gap depends on the standard. HIPAA and FedRAMP mentions are claims about 40% of the time, because buyers ask whether a vendor signs a BAA or holds an authorization. GDPR and ISO 27001 mentions are claims only 6.4% and 5.0% of the time. Those standards mostly appear as the job a compliance tool does.

We sorted every claim by the best evidence in its answer. 69.2% had a backing page. 316 claims (9.4%) provably had none: in 156 the answer cited nothing, and in 160 every cited page could be read and none named both the brand and the standard. The remaining 21.3% could not be settled, because at least one cited page could not be read.

Google AI Mode claims were backed more often (73.3% vs 64.9%). ChatGPT Search cites more pages that could not be read, so more of its claims fall in the unsettled group. By standard, HIPAA claims were backed most often (74.0%) and FedRAMP claims least often (51.2%).

For 1,429 of the 2,318 backed claims, the backing page sits on the brand's own website. The rest rely on third-party pages only, mostly lists of compliant tools.

The engines differ. ChatGPT Search backs 81.4% of its backed claims with the brand's own page. Google AI Mode does so for 45.3% and leans on third-party lists. The pattern was clearest for SOC 2: 89.9% of ChatGPT Search SOC 2 claims cite a page on the brand's own site, against 51.6% for Google AI Mode.

A trust page is a page on the brand's own site whose address points to security, trust, compliance, privacy or legal content, or to a standard such as /hipaa or /soc-2. Engines cited such a page for 26.7% of claims (894).

Those claims were backed 90.9% of the time. Claims that cited another page on the brand's site were backed 73.6% of the time. Claims with no page from the brand's site were backed 53.5% of the time.

AWS received 148 compliance claims, Google Cloud 110 and Microsoft Azure 70, almost all for HIPAA. Behind them are healthcare and e-signature tools such as Caspio, Docusign, Atlantic.Net, Zoom for Healthcare and Doxy.me.

Backing varies. Sonix had all 27 of its claims backed, and Microsoft Power Apps 30 of 31. Microsoft Azure had 64.3% backed. We merged two index entries each for AWS and Google Cloud.

SOC 2 claims go mostly to security-rating vendors: UpGuard (36), SecurityScorecard (26) and BitSight (21). PCI DSS claims go to payment processors, and some are backed less often: 47.6% for Stripe and 20.0% for Square, against 63.2% for Adyen.

FedRAMP claims split sharply. Google Cloud's 12 were 83.3% backed, Microsoft Azure's 8 were 12.5% backed. GDPR and ISO 27001 leaders have fewer than 30 claims each, so treat those rows as examples.

A claim provably has no backing page when the answer cites nothing, or when every cited page could be read and none names the brand and the standard. UpGuard had 9 such SOC 2 claims. AWS and Google Cloud had 8 each, though both have far more claims overall.

No backing page does not mean the claim is false. We did not test whether any claim is true. It means the answer gave the reader nothing to check. SOC 2 claims are the most likely to provably lack a backing page: 119 of 671 (17.7%), against 144 of 2,129 HIPAA claims (6.8%).

A flat claim states the status with no condition, as in "Shopify is Level 1 PCI DSS compliant". A conditional claim limits it to some plans or setups, as in "signs a BAA on eligible plans". An attributed claim reports it as the vendor's or a source's word, as in "UpGuard states it is SOC 2 Type II".

Google AI Mode stated 78.2% of its claims flatly and attributed only 4.1%. ChatGPT Search stated 55.8% flatly and attributed 22.1%. Hedging does not track sourcing: attributed claims were backed 74.6% of the time, flat claims 69.0%.

For 92 prompts, both engines made at least one compliance claim. The average overlap between the two engines' sets of brands called compliant was 0.186 (Jaccard: shared brands divided by all brands named). Only 21.4% of brand and prompt pairs were called compliant by both engines.

Part of this is ordinary day-to-day change. The same engine, compared between the first and second half of the window, overlapped 0.23 (ChatGPT Search) and 0.20 (Google AI Mode). The cross-engine gap is a little larger than that change.

We compared compliance prompts with the other prompts in the same market. The shortlist did not shrink: the median answer named 5.33 brands for compliance prompts and 5.39 for the rest. The compliance shortlist was shorter in 80 of 166 market and engine pairs, about half.

Who is on it changes. Incumbents are a market's five most-named brands in other prompts during the first half of the window. In the second half, they took a median 15.8% of brand mentions in compliance answers, against 32.6% in other answers, across 46 market and engine pairs. Compliance answers bring in specialists.

The sample is every answer from ChatGPT Search and Google AI Mode between May 24 and October 6, 2026 to 1,337 prompts that name SOC 2, HIPAA, GDPR, ISO 27001, PCI DSS, FedRAMP or compliance. Each brand sentence was matched against the six standards. A business associate agreement (BAA) counts as HIPAA. A word-pattern classifier then separated claims about a brand's status from descriptions of what a product does. In a hand check, 89 of 99 flagged sentences were real claims. In a second check, 10 of 60 unflagged sentences were claims we missed, so the claim counts are a lower bound. We set aside 198 negative claims, such as "does not sign a BAA".

Backing was checked against the text of cited pages as crawled by Parse, plus page titles and addresses. We could read 44.0% of the 7,581 distinct cited pages. That is why 21.3% of claims could not be settled, and why the headline uses the answers where every page could be read. Brand names are the public index spelling. Pages from Parse itself were cited for 3.5% of claims and were left in. The figures cover two engines over 19 weeks, so they are a snapshot, not a trend.

Publish one trust page that names every standard you hold, in plain words, with the scope: which products, which plans, and whether you sign a BAA. When engines cite a brand's trust page, 9 in 10 of its compliance claims are backed.

Put the standard on the pages engines already cite for you, not only on the trust page. Claims backed only by third-party lists depend on those lists staying current. A one-line statement of the standard on your product and help pages gives the engine a page of your own to cite.

Check both engines. They agree on only about one in five brands they call compliant. For buyers, the practical test is whether AI answers HIPAA compliant software claims with a page that says so. Open the cited page before you rely on the claim.