Supplier compliance rates

What percentage of SaaS vendors hold ISO 27001 and SOC2 certification? 2026 compliance benchmarks

Compliance certification varies dramatically by category, and not always in the direction you'd expect. Monitoring and CRM vendors remain almost universally certified, while Artificial Intelligence has fallen sharply in Q3 2026. Fewer than half of AI vendors now hold either ISO 27001 or SOC2 certification, and Security remains among the lowest-certified categories tracked.

• Less than half of AI spend  goes to ISO 27001-certified vendors. Artificial Intelligence fell from 62.0% to 46.4% (ISO 27001) and from 61.3% to 45.3% (SOC2), the largest shift of any category this year. With a steady stream of new, fast-growing AI vendors entering organizations' stacks, many of which haven't yet built formal compliance programs, buyers are now more likely than not to be onboarding an uncertified AI vendor.
• The "Security paradox" persists. Security vendors improved slightly, to 64.4% (ISO 27001) and 66.6% (SOC2), but still rank among the four least-certified categories on both measures. For a category built around protecting sensitive data, this remains a meaningful blind spot for buyers who assume the category name means the vendor is automatically well-vetted.
• "System of record" categories remain almost universally certified. Monitoring (99.8%), CRM (99.2%) and Project Management (97.5-97.6%) continue to show near-total certification, reflecting the scrutiny that comes with holding large volumes of sensitive operational and customer data.
• Collaboration & Productivity has slipped. Certification in the category fell by more than four points on both measures, to 85.9% (ISO 27001) and 86.3% (SOC2). ERP also dipped to 74.9% on both, a notable figure for platforms that sit at the core of financial operations.
• ISO 27001 and SOC2 rates still track closely within most categories. Vendors holding one certification are highly likely to hold the other, with Analytics Tools and IT Infrastructure again showing the largest gaps between the two.

Which types of SaaS vendors are actually the most compliant?

Artificial Intelligence is now the clear outlier. Fewer than half of AI vendors hold either certification, and the rate has fallen sharply in a single quarter. That's partly explained by how many AI vendors are newer companies without formal compliance programs, but it also means the risk is growing just as AI adoption accelerates across the business.

Security's position should give buyers equal pause. The category most people would expect to be the most rigorously vetted still sits near the bottom of the entire dataset.

A procurement team that skips verification because it assumes a vendor will be secure is operating on an assumption the data directly contradicts. The cost of getting this wrong isn't abstract: onboarding an uncertified vendor into a workflow that touches sensitive data can mean inheriting real security and compliance risk, often without anyone noticing until an audit, a breach or a customer contract review forces the question.

This is exactly why SaaS procurement software with robust third-party risk management (TPRM) capabilities matters, and why verification can't stop at onboarding. Certifications aren't permanent: a vendor can lose SOC2 accreditation after a failed audit, let ISO 27001 lapse on renewal, or change its risk profile entirely after an acquisition or infrastructure migration, none of which a one-time check at signing would catch.

Supplier risk management software verifies certification status directly during vendor onboarding rather than relying on category assumptions, and continuous vendor monitoring keeps checking after the contract is signed, flagging any change in a vendor's compliance status for the lifetime of the relationship.

Data source: These insights are derived from over $75bn of global processed spend managed by Vertice in 2026. Q3 2026 figures are preliminary and based on data processed to date.

‍