AI system audit: a checklist to prepare

When the day of the audit of an AI system arrives, it is already too late to improvise. The audit invents nothing: it only checks whether the governance you claim to have really exists and is documented. In the regulated environments where I work, arriving prepared for that appointment is the result of months of discipline, not a final sprint.

A governance audit, not just a model audit

It is worth distinguishing two things. One is the technical evaluation of the model (its accuracy, its robustness), which I address in the evaluation of AI models. The other, distinct and complementary, is the conformity and governance audit: checking that the system meets the regulatory requirements and that there is traceability of decisions. This article focuses on the second.

Checklist to prepare for the audit

Inventory and classification

Is the system inventoried and correctly classified by risk level? An auditor starts here. Without a clear inventory of AI assets, the audit gets off on the wrong foot.

Documentation and evidence

Is there technical documentation, activity logs and evidence of the controls applied? The audit of an AI system lives on evidence: what is not documented, in practical terms, does not exist.

Risk management and human oversight

Is there a living risk management process and human oversight mechanisms? The auditor will want to see not only that they exist, but that they are used and reviewed. The consistency between what you say and what you do is what they value most.

Traceability of decisions

Can you reconstruct who approved what, with what data and under what criteria? Traceability is the heart of any audit in regulated environments, and the piece hardest to improvise.

How I approach it in practice

I keep all that evidence alive continuously, not for the audit but for the good governance of the system. That permanent management of conformity is what underpins the tool I develop, because gathering the documentation at the last minute always leaves gaps. When governance is real, the audit becomes a calm confirmation.

Internal audit versus external audit

It is worth distinguishing two moments. The internal audit is the one I carry out to discover my own failings before anyone else does; it is preventive and must be relentless, because its value lies precisely in finding what fails. The external audit, on the other hand, is carried out by an independent third party and usually has regulatory or contractual consequences. My recommendation is not to wait for the external one to take the internal one seriously: whoever audits well internally arrives at the external one without unpleasant surprises.

In regulated environments, moreover, it is advisable for the audit to rely on a recognised framework. A certified AI management system makes the work enormously easier, because much of the evidence is already organised. That is why I connect the audit with the implementation of the ISO 42001 standard, which provides the structure on which you then audit in an orderly way.

The mistake of auditing only once

The most expensive failure I see is treating the audit as an isolated event: you pass it once and no one looks again until the next one, two years later. AI systems change fast, so conformity demonstrated in January may not hold in December if the model is retrained or its use changes. That is why I advocate light, periodic audits over the single big audit that arrives late and badly.

This regular cadence has an added advantage: it turns conformity into a cheap habit instead of an enormous one-off effort. When auditing is part of the routine, each review is small and manageable, and the organisation lives much more calmly in the face of any surprise inspection.

My conclusion is that a good audit should not be frightening, but reassuring. If you have governed your AI system well throughout its life cycle, the audit only confirms in writing what you already knew. The problem is never the audit itself: it is arriving at it without having done your homework.

For anyone facing their first audit, my advice is to start with inventory and traceability, which are the two points where most organisations fall short. If you know exactly what AI systems you have and can explain why each one made a specific decision, you have covered more than half the way. It is also advisable to keep the evidence of each review in an orderly and accessible manner, not scattered across emails: when an inspection arrives, being able to retrieve the risk analysis and decision logs in minutes conveys control and saves a great deal of time. In sectors such as banking or public administration, that ability to demonstrate conformity in an orderly way has also become a requirement to compete for the most demanding contracts.

If the system is high-risk, this internal audit is the step before the conformity assessment of high-risk AI systems required by the AI Act.

Conclusion: auditing what is already well done

The audit of an AI system is only frightening when governance is weak. If you have done your homework (inventory, documentation, risks and traceability), the audit confirms your good work instead of exposing it. That is the goal: for auditing to be verification, not discovery.

Frequently asked questions about the audit of an AI system