How do you audit AI systems?

The five dimensions of an AI system audit

A thorough AI system audit addresses five dimensions. Inputs: review the data the AI system uses, including its quality, sources, and potential for bias. Is the training data representative? Are there gaps or distortions that could lead to systematically wrong or discriminatory outputs? Outputs: review what the AI system produces; its accuracy, consistency, appropriateness for its stated purpose, and whether it is behaving as expected. Decisions: review how AI outputs are used in decision-making. Is human oversight operating as designed? Are AI recommendations being accepted uncritically or being properly reviewed? Documentation: review the governance documentation; the AI use policy, the risk assessment, training records for staff who use the system, and vendor contracts. Is the documentation current, complete, and adequate? Compliance: review whether the AI system's operation complies with applicable requirements; the EU AI Act, GDPR, sectoral regulations, and the organisation's own policies.

EU AI Act audit requirements

The EU AI Act assigns different records and review duties to providers and deployers. High-risk providers prepare technical documentation and the applicable conformity evidence. Deployers monitor use and keep relevant automatically generated logs under their control, subject to the legal conditions. That does not mean every user must commission an external audit or maintain the supplier's entire technical file. Define the audit objective, applicable provisions and dates, then record findings, corrective actions and who is responsible for closing them.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.