What is an AI audit?

    Scope, criteria, evidence and the different kinds of assurance available, from internal audit to ISO/IEC 42001 certification and EU AI Act conformity assessment.

    An AI audit is an independent, evidence-based examination of whether an AI system and the governance around it meet defined criteria for security, reliability, fairness and legal compliance, and whether the organization can prove those claims to a third party. The final element, evidence that a third party can test, is what distinguishes an audit from an assertion.

    Why AI audits matter now

    AI systems now make or shape decisions about credit, hiring, benefits, medical notes and fraud. They fail differently from ordinary software. They learn from data rather than following written rules, their behaviour can drift after deployment, and they can be confidently wrong. A control environment built for deterministic applications will not catch those failures unless someone tests for them on purpose.

    An AI audit gives boards, regulators and customers one thing self-assessment cannot: an independent view backed by evidence. It also requires the organization to establish which AI systems it actually runs.

    The emergence of AI risks

    The risks an AI audit looks for fall into four groups:

    • Data and privacy risk. Personal or confidential information used in training, entered in prompts or exposed through outputs. The March 2023 ChatGPT incident, in which some users could see other users' chat titles, showed how quickly a software bug becomes a privacy event. See AI and privacy.
    • Security and reliability risk. Prompt injection, data poisoning, model theft and supply chain compromise, mapped in MITRE ATLAS and the OWASP Top 10 for LLM applications.
    • Performance and quality risk. Inaccurate, unstable or biased outputs, including hallucinated facts presented as fact.
    • Social and ethical risk. Discriminatory outcomes, loss of meaningful human review and harm to people who never agreed to be assessed by a model.

    Regulatory compliance and ethical considerations

    AI is no longer governed by principles alone. The EU AI Act (Regulation (EU) 2024/1689) imposes legal obligations, with fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices and up to €15 million or 3% for most other breaches. Privacy law (GDPR, PIPEDA, Quebec's Law 25, US state laws) applies to AI that processes personal information. Sector rules apply too. In Canada, OSFI's Guideline E-23 (final September 2025) brings AI and machine-learning models into model risk management for federally regulated financial institutions from 1 May 2027.

    A common misstatement concerns the US Algorithmic Accountability Act. As of October 2026 it is a bill that has been introduced several times in Congress. It is not law, and nothing in it is mandatory. Ethics frameworks such as the OECD AI Principles still matter. Many internal AI policies draw their values from them, but they are not legal obligations.

    Transparency and accountability in AI systems

    Auditing makes transparency and accountability testable:

    • Transparency. Can the organization show what a system is for, what data it uses, and what users and affected people are told?
    • Explainability. Can it explain an individual output well enough for someone to challenge it?
    • Accountability. Does each system have a named owner who has the authority to pause, change or retire it, and is there a record of that happening?

    Types of AI audit

    The term covers engagements with very different scope, independence and output. The engagement type determines what assurance the result can support.

    Type Who performs it Criteria Output
    Internal audit engagement Internal audit function IIA Global Internal Audit Standards, the IIA AI Auditing Framework, internal policy Findings and an opinion on governance, risk management and controls, reported to the audit committee
    Management system certification Accredited certification body ISO/IEC 42001, audited under ISO/IEC 17021-1 and ISO/IEC 42006:2025 A three-year certificate with annual surveillance audits. It covers the management system, not each model
    EU AI Act conformity assessment The provider (internal control) or a notified body Articles 8–17 and Annexes VI/VII of the AI Act EU declaration of conformity and CE marking for high-risk AI
    Statutory bias audit Independent auditor e.g. NYC Local Law 144 impact ratios A published summary of selection rates and impact ratios
    Independent attestation Public accounting firm Attestation standards (e.g. CSAE 3000, ISAE 3000, AICPA AT-C) against stated criteria A reasonable or limited assurance report over AI controls or claims
    Model validation Independent second-line validators OSFI E-23, US SR 11-7, internal model risk policy A validation report and approval or restriction of model use

    Public-sector audits form a seventh category. Legislative auditors such as the Auditor General of Ontario now audit government AI use directly (see the example below). Canadian federal institutions also need peer review of higher-impact systems under the Treasury Board's Directive on Automated Decision-Making.

    Red-teaming and technical evaluations are valuable evidence, but they are not audits in themselves. They test what a model can be made to do, not whether the organization governs it.

    Components of an effective AI audit

    An AI audit covers the whole lifecycle, from data collection and design through deployment, monitoring and retirement. Six areas carry most of the weight.

    Data management and usage

    • Provenance. Where training, fine-tuning and retrieval data came from, the legal basis or licence for using it, and who owns it.
    • Quality. Accuracy, completeness and representativeness, especially for the groups the system will make decisions about.
    • Security. Access controls, encryption and de-identification for training data, prompts and logs.
    • Governance. Lineage records, retention rules and a documented approval before new data sources are used.

    Algorithmic fairness and bias

    • Identification. Defined protected groups and metrics, chosen before testing rather than after.
    • Measurement. Disaggregated performance and selection rates, impact ratios and error-rate differences across groups.
    • Mitigation. What was changed when a gap was found, and evidence that the change worked.

    See bias in AI systems for the metrics and their limits.

    Security and vulnerability

    • Threat modelling. AI-specific threats mapped to a recognized catalogue such as MITRE ATLAS.
    • Testing. Adversarial and red-team testing against the attacks relevant to the use case, including prompt injection for LLM applications.
    • Controls. Least-privilege access for models and agents, secrets management, output filtering and logging.

    Performance measurement and continuous monitoring

    • Indicators. Accuracy, error rates and business KPIs defined at approval, with thresholds that trigger action.
    • Drift monitoring. Detection of changes in input data and output quality after deployment.
    • Incident handling. A route from a monitoring alert to an owner, a decision and, for high-risk systems in the EU, serious-incident reporting under Article 73 of the AI Act.

    Human oversight

    Who reviews outputs, what they can override, how often they actually do, and whether they have the time and information to disagree with the system. See human-in-the-loop.

    Third parties and the AI supply chain

    Vendor models, APIs and embedded AI features in SaaS products. The audit question is whether the organization knows which suppliers use AI on its data, and what contractual and technical controls apply.

    Audit criteria: what an AI system is measured against

    An audit without criteria is an opinion. The usual criteria sets are:

    • ISO/IEC 42001:2023. The certifiable AI management system standard, with Annex A controls covering policy, impact assessment, data, lifecycle and third parties.
    • ISO/IEC 42005:2025. Guidance on AI system impact assessment, published May 2025. It is a useful benchmark for testing whether an impact assessment is real or a form.
    • NIST AI RMF 1.0 and its Generative AI Profile, NIST AI 600-1 (July 2024). These are voluntary, but they carry more weight since Texas's TRAIGA (in force 1 January 2026) gave a defence to organizations that substantially comply with the GenAI Profile or another recognized framework. As of October 2026, NIST is revising the AI RMF under the July 2025 US AI Action Plan. See the NIST AI RMF guide.
    • EU AI Act. Legal requirements for risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and a quality management system.
    • Professional frameworks. The IIA's Artificial Intelligence Auditing Framework, organized around governance, management and internal audit roles, and ISACA's COBIT-based guidance.
    • Internal policies. The organization's AI policy, acceptable use policy and risk appetite. They are legitimate criteria, provided they were approved before the audit started.

    Conducting an AI audit: methodology and best practice

    Establishing an AI governance framework

    Governance that does not exist cannot be audited. Before a first AI audit, the organization needs a minimum set: an AI policy, an inventory of systems with owners, a risk classification method and a record of approvals. If any of these is missing, the first engagement should be an advisory readiness review, not an assurance audit. See what AI governance is.

    Scoping and planning

    1. Inventory and classify. List every AI system in scope, including vendor features, with its purpose, owner, data and risk tier.
    2. Select systems. Prioritize by impact on people, regulatory exposure, materiality and how autonomous the system is.
    3. Agree criteria and assurance level. Decide which framework applies and whether the output is an internal opinion, a certificate or an attestation report.
    4. Plan the evidence. List the artefacts the auditor needs and confirm they exist before fieldwork starts.

    Engaging cross-disciplinary expertise

    An AI audit needs auditors who understand controls and evidence, data scientists who can read validation results, security testers, and legal or privacy specialists for the regulatory mapping. Auditors may rely on specialists, but they still own the conclusion. Independence matters too. The people who built or bought the system should not be the ones assuring it.

    Tools and frameworks for automated auditing

    Automated tools can compute fairness metrics, scan models and dependencies, run adversarial test suites, and pull monitoring and access logs continuously. Their output is evidence that itself needs testing: the auditor has to know what the tool measured, on what data, and with what configuration.

    Documenting and reporting findings

    A good AI audit report states:

    • The scope, the criteria, the assurance level and the methods used.
    • The systems examined, their data sources and their risk classification.
    • Findings rated by severity, each tied to the criterion it breaches and the evidence behind it.
    • Root causes, not just symptoms. For example: "No drift monitoring because no owner was assigned at deployment."
    • Management responses with owners and dates.
    • Limitations, including evidence that was not available.

    What evidence an auditor will ask for

    Area Typical evidence
    Governance AI policy, committee terms of reference and minutes, RACI, risk appetite statement
    Inventory System register with owner, purpose, risk tier, vendor and deployment date
    Impact and risk Impact assessments (ISO/IEC 42005 style), risk register entries, EU fundamental rights impact assessments where Article 27 applies
    Data Data sheets, lineage, licences and consent basis, quality checks
    Development and validation Model cards, test plans and results, fairness and robustness tests, independent validation reports
    Change management Version history, retraining approvals, rollback records
    Operations Monitoring dashboards and alert history, incident tickets, logs retained to the required period
    Human oversight Override and escalation records, reviewer training, sampling of reviewed decisions
    Third parties Vendor due diligence, contract clauses on data use and model changes, SOC reports

    Where AI audits are legally required

    Mandate What it requires Status (October 2026)
    EU AI Act, Article 43 Conformity assessment for high-risk AI. Most Annex III systems (points 2–8) use internal control under Annex VI. Biometrics under Annex III point 1 need a notified body unless harmonized standards or common specifications are fully applied. Annex I products follow their sectoral procedure. Under the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026), Annex III obligations apply from 2 December 2027 and Annex I from 2 August 2028
    EU AI Act, Article 72 Post-market monitoring system and plan for high-risk AI The Commission must now issue guidance and a template by 2 September 2027 instead of an implementing act
    NYC Local Law 144 Annual independent bias audit of automated employment decision tools, with a published summary and candidate notices Enforced since 5 July 2023. A December 2025 State Comptroller audit found enforcement ineffective. See AI in risk, audit and compliance
    Canada, Directive on Automated Decision-Making Algorithmic Impact Assessment and, for higher impact levels, peer review, with results published before launch Amended effective 24 June 2025. Existing systems had until 24 June 2026 to comply (TBS)
    OSFI Guideline E-23 Independent model validation and enterprise model risk management covering AI/ML Final September 2025, effective 1 May 2027

    Two points are often misreported. First, the EU AI Act does not require a notified-body audit for most high-risk AI. Planning for a notified-body audit that is not required wastes budget, and omitting the required self-assessment is a breach. Second, as of October 2026, AI Act notified bodies remain scarce. Designation runs through national notifying authorities and listing in the Commission's NANDO database, and NANDO is the reference for current designations before any plan relies on a third-party assessment date.

    Worked example: Ontario Auditor General AI audit (2026)

    On 12 May 2026 the Auditor General of Ontario published a performance audit of AI use in the Ontario government. It shows what an AI audit finds in practice:

    • Testing of outputs. In the auditors' evaluation of AI medical scribes, 12 of 20 systems recorded a different drug from the one the doctor prescribed, and 17 of 20 missed important details about patients' mental health.
    • Shadow AI. Staff were using unsecured public AI websites, without guardrails to stop personal or sensitive data being uploaded. The approved, secure tool accounted for about 6% of generative AI use.
    • Training. About 3% of staff had completed the voluntary responsible-use training.
    • Procurement. Vendor testing was rarely validated, and security assessments, bias testing and live demonstrations were used sparingly.

    None of these findings required specialized techniques. The auditors tested outputs against a known answer, compared policy with actual use, and checked whether procurement controls were applied.

    The road ahead for AI audits

    • Certification is professionalizing. ISO/IEC 42006:2025 (published July 2025) adds AI-specific competence requirements and audit-time rules for certification bodies. As of October 2026, the Standards Council of Canada requires new applicants to be assessed against it, and ANAB and UKAS run comparable programs. Buyers of ISO/IEC 42001 certification can confirm which accreditation body accredits the certifier for AI management systems (AIMS).
    • Harmonized standards are arriving. EN 18286:2026, the quality management system standard for the AI Act, was as of October 2026 the first CEN-CENELEC AI Act standard to be published. It gives a presumption of conformity only once it is cited in the Official Journal.
    • Audits are becoming continuous. Point-in-time audits of systems that retrain weekly will give way to continuous control monitoring, with auditors testing the monitoring itself.
    • Agents change the scope. When AI systems take actions rather than produce text, the audit shifts toward permissions, action logs and the ability to stop the system.

    AI auditing is a recurring discipline rather than a one-off exercise, and its scope follows how the organization uses AI. The practitioner work program is in AI audit for IT auditors.

    Sources and references

    Frequently asked questions

    What is an AI audit?

    An AI audit is an independent, evidence-based examination of whether an AI system and its governance meet defined criteria for security, reliability, fairness and legal compliance. It can be performed by internal audit, an accredited certification body (for ISO/IEC 42001), a notified body or the provider itself (for EU AI Act conformity assessment), an independent bias auditor, or a public accounting firm issuing an assurance report.

    Why is an AI audit important for businesses?

    Because AI fails in ways ordinary IT controls do not catch: biased outcomes, drift after deployment, hallucinated outputs and new attack paths such as prompt injection. An audit tells the board whether those risks are controlled. It also produces the evidence that regulators, customers and insurers increasingly ask for, and it usually uncovers AI the organization did not know it was running.

    What are the key areas that an AI audit covers?

    Governance and accountability, the AI inventory, data provenance and quality, fairness and bias testing, security and adversarial resilience, performance and drift monitoring, human oversight, third-party AI, transparency to users and affected people, and compliance with applicable law such as the EU AI Act, privacy law and sector rules.

    How can a business benefit from conducting an AI audit?

    It gets an independent view of which AI risks are actually controlled. It finds gaps before a regulator, litigant or journalist does, and it builds an evidence file that shortens customer due diligence and certification. An audit also gives management a prioritized remediation plan rather than a general sense of unease.

    What tools can be used for conducting an AI audit?

    Frameworks first: ISO/IEC 42001 and 42005, the NIST AI RMF and its Generative AI Profile, the EU AI Act and the IIA AI Auditing Framework. Technical tools include fairness-metric libraries, model and dependency scanners, adversarial and red-team test harnesses, and monitoring platforms that track drift and incidents. Treat tool output as evidence that also needs testing.

    Who can perform an AI audit?

    It depends on the type. Internal audit can audit AI under the IIA Standards. ISO/IEC 42001 certificates should come from a certification body accredited for AI management systems under ISO/IEC 42006. EU AI Act third-party assessments must come from a designated notified body. NYC bias audits must come from an auditor independent of the employer and the tool vendor.

    Is ISO/IEC 42001 certification the same as an AI audit?

    No. ISO/IEC 42001 certification audits the management system: policies, roles, risk and impact assessment processes, and controls. It does not certify that any individual model is accurate or fair. Many organizations pair certification with system-level testing or validation of their highest-risk models.

    Does the EU AI Act require a third-party AI audit?

    Usually not. Most high-risk systems listed in Annex III use internal-control conformity assessment by the provider. A notified body is required for remote biometric systems where harmonized standards or common specifications are not fully applied, and for AI in products whose sectoral law already requires third-party assessment. After the Digital Omnibus, those obligations apply from 2 December 2027 and 2 August 2028 respectively.

    How often should AI systems be audited?

    High-risk or high-impact systems warrant at least an annual review, with continuous monitoring in between and a fresh review after any material change, such as retraining, a new data source or a new use. Lower-risk systems can be covered on a rotating cycle driven by the AI inventory and risk tier.

    Share on LinkedIn