AI Audit: The Five Kinds and What Actually Gets Checked

“We need an AI audit.” That is how many enquiries that reach me begin. My first question back is always the same: what for? The word covers at least five different checks. They differ in who audits, what the yardstick is and what is on the table at the end. Order the wrong one and you pay for a result that your customer, your management or the authority will not accept.

What an AI audit is, and how to recognise one

According to ISO 19011:2026, an audit is a systematic, independent and documented process. It obtains objective evidence and evaluates it objectively to determine the extent to which audit criteria are fulfilled (3.1). An AI audit is an audit whose subject is the use of AI: the systems themselves, the processes around them, or both.

Three features are in this definition, the fourth comes from how every audit runs. You can measure any offer against all four:

• A defined criterion: a standard, a contract, a law or your own requirement. Without a yardstick there is nothing to fulfil.
• Objective evidence: documents, records, samples, observation on site. A self-declaration alone is not evidence.
• An independent auditor: whoever built the system does not audit it.
• A report with graded findings: conformity, nonconformity, opportunity for improvement. Certification bodies must classify findings (ISO/IEC 17021-1, 9.4.5.1); for every other audit it is good practice.

If one of these is missing, the result is an assessment or consulting. That can be very useful. It is not proof towards third parties. A completed questionnaire with a traffic-light chart is therefore not an AI audit, even if it is called one.

Five checks that are called an AI audit

The overview below separates what offers and tenders tend to mix up.

The internal audit is mandatory as soon as you run an AI management system under ISO/IEC 42001. Clause 9.2 requires audits at planned intervals and an audit programme. Auditors must be selected so that objectivity and impartiality are ensured (9.2.2 b). Your colleague from IT can therefore audit HR. The system she set up herself, she does not audit.

Small companies solve this in one of two ways. Either two departments audit each other, or an external auditor carries out the internal audit on the company’s behalf. Both work as long as the audit programme defines who audits what, and nobody assesses their own work. The external route costs more, but it brings the outside view that a team of five can hardly provide internally.

The certification audit is the only one of the five that ends with a certificate. For AI management systems, ISO/IEC 42006 has applied in addition to ISO/IEC 17021-1 since July 2025. It sets out the competence the body and its auditors need, and it governs audit time in a normative Annex A. How many audit days your company needs is therefore not purely a matter of negotiation.

Technical testing looks inside the system. How robust is the model, how does it react to manipulated input, do the promised figures hold? ISO/IEC 27090:2026 describes attacks on AI systems and countermeasures as guidance. Nothing can be certified against it. The report applies to exactly the system tested, in exactly the version tested.

The conformity assessment concerns providers of high-risk AI. Depending on the system, the provider carries it out itself or involves a notified body (Art. 43 AI Act). Under the amending Regulation (EU) 2026/1744, the obligations for high-risk systems under Annex III apply from 2 December 2027, and for products under Annex I from 2 August 2028. An ISO 42001 certificate does not replace this assessment.

A sixth meaning also turns up in search queries: AI in auditing. It means auditors who use AI tools to plan, analyse and draft reports. That is a tool in the audit, not an audit of the AI. Responsibility for every finding stays with the human. Standards texts do not belong in an AI tool; the licence terms of the standards bodies generally do not allow it.

Which AI audit you need, starting from the purpose

Start with whoever receives the result. Who is supposed to believe the report?

• A customer demands proof: ask which proof. A certificate under ISO/IEC 42001 is something different from a supplier audit by the customer itself. Clarify that before you commission anything.
• Management wants to know where you stand: an internal audit, if a management system exists. If there is none yet, a gap analysis is the more honest assignment. It measures the distance to the standard before there is anything to audit.
• You buy AI or have it developed: a supplier audit at the vendor, plus a technical incoming inspection of the model.
• You want to get certified: first an internal audit and a management review, then the certification audit in two stages. A missing internal audit is a nonconformity against 9.2 and holds up certification.
• You make high-risk AI: conformity assessment under Art. 43 AI Act. An audit of your management system helps you prepare and does not replace it.

For most mid-sized companies that buy AI, their own certificate is not the first step. A robust supplier audit is. It is different for software houses that sell AI to industrial customers: there, expect the question about ISO/IEC 42001 in the purchasing questionnaire.

What an AI audit actually checks

Take the most common format, an audit against ISO/IEC 42001, internal or at a supplier. I pick a single AI system and follow its path through the company, from approval to ongoing monitoring. At every stop I ask for the evidence.

• Register: is the system listed, with purpose, responsible person and data sources?
• Risk assessment (6.1.2) and system impact assessment (6.1.4): do both exist, are they current, and has anyone derived actions from them?
• Data (Annex A.7): where do training and input data come from, and who checks their quality?
• Operation and monitoring (A.6.2.6): who notices when the system gets worse, and what happens then?
• Suppliers (A.10): what did the vendor commit to, and who checked it?
• Competence and oversight: do the people working with the system know when they have to step in?

This trail shows more than any document review. A register that looks clean but does not know the system accounting has been using for six months says everything about the process behind it.

The model itself is by-catch in a management system audit. Whether it is right nine times out of ten is answered by technical testing. The audit asks whether someone in the company asked that question, with what result, and who then decided. A missing question is a finding. A missing decision too.

A thought experiment shows how such a finding arises. A sales team uses a chat assistant for quotation texts. It is in the register, and there is a risk assessment. But it only covers data protection. That the assistant can invent delivery times or discounts that then end up in the quotation to the customer is not mentioned. Finding: risk assessment incomplete (6.1.2). As an isolated case in an otherwise working process, that would be a minor nonconformity. If the same gap exists for every system, a major is likely.

What an AI audit cannot do belongs on the table as well. It is a sample at a point in time. It does not find every error, and it says nothing about the system introduced next week. A passed audit means: in the sample examined, the management system worked. Anyone who turns that into a guarantee is selling more than an audit can deliver. That is exactly why the standard requires audits at planned intervals, not a single one.

Who may carry out an AI audit, and who may not

“AI auditor” is not a protected title. Anyone can use it. Three things still separate the auditor from the label:

• Independence: whoever advises you, builds your system or supports you as AI officer does not audit you. I keep to one role per company. The internal audit after my own build-out is done by another, independent party.
• Auditing and implementing kept apart: the audit team of a certification body may identify opportunities for improvement but must not recommend specific solutions (ISO/IEC 17021-1, 9.4.8.1). In a supplier audit, recommended actions are part of the report. Whoever then implements them at the audited company would be auditing their own work next time.
• Demonstrated competence: a personnel certification accredited under ISO/IEC 17024, for example as ISO/IEC 42001 Lead Auditor, plus documented audit practice. A certificate of attendance from a one-day seminar proves attendance.

For the certificate itself there is a hard line. A recognised certificate is issued only by an accredited certification body; in Germany, accreditation is done by DAkkS. An individual auditor does not issue certificates, however good. What an auditor can tell you is whether your system would stand up to certification.

Effort: what to expect

The audit day is the smallest part. Planning, document review, report and follow-up take more time than the conversation on site. Comparing audit days alone compares the tip of the iceberg.

• Internal audit: depends on the number of AI systems and sites. For half an audit day on site, I calculated around 20 hours of total effort, most of it before and after the visit.
• Supplier audit: often one to three audit days, depending on sites and depth, plus reviewing the documents beforehand. Remote works if the vendor can show evidence on screen.
• Certification audit: the body calculates audit time under ISO/IEC 42006, Annex A. The starting point is the number of persons involved in the AI life cycle, plus further factors. Ask for that calculation in the quotation.
• Technical testing: per system and version; the effort depends on the test scope.

What an internal audit or a supplier audit costs in euros, I have calculated in separate articles. The biggest item does not appear on any invoice: the time your own people spend gathering evidence. Keep the evidence up to date as you go, and you save exactly that part.