Auditing an AI system is a defined process, not a vague review. This guide walks the whole sequence — from scoping and gathering evidence to testing, gap analysis and reporting. Part of our guide to the AI audit.
Two decisions frame every AI audit: the scope (which system or systems, and which of their components) and the standard you'll audit against — ISO/IEC 42001, the EU AI Act's high-risk requirements, the NIST AI RMF, or your own AI policy. Fix both before you begin, because they determine what “good” looks like.
An audit examines the system across dimensions: performance against intended use, bias and fairness across affected groups, data quality and lawful basis, robustness and security, explainability, human oversight, and the governance around it. Use the AI audit checklist to make sure nothing is missed.
The gaps auditors see most often: no documented risk or impact assessment, training data with no lawful basis, bias never tested for, no monitoring for drift in production, unclear ownership, and no evidence trail. Most are governance failures, not model failures.
The benchmark drives the work: an ISO/IEC 42001 audit focuses on the management system and Annex A controls; an EU AI Act audit focuses on the high-risk requirements and conformity. Structure it with an AI audit framework.
AramGRC runs independent AI audits end to end — scoping, testing, gap analysis and an actionable report — against ISO/IEC 42001, the EU AI Act and your own policy.
Define the scope and standard, gather evidence (data lineage, model cards, test results, governance records), test for bias, performance and robustness, analyse gaps against the standard, and report findings with a remediation roadmap.
Performance, bias and fairness, data quality and lawful basis, robustness and security, explainability, human oversight, and governance.
Commonly ISO/IEC 42001, the EU AI Act's high-risk requirements, the NIST AI RMF, or an internal AI policy — the choice defines the audit criteria.
It depends on scope and complexity — a single system against a defined standard is faster than an organisation-wide governance audit. A prior gap assessment shortens it.
What an AI audit is, the types, the process, and what a good report contains.
The step-by-step process for auditing an AI system.
You're here
A practical checklist for auditing an AI system.
How an AI audit framework maps to ISO 42001, the EU AI Act and NIST.
What an AI auditor does, the skills, and how to become one.
The tools and software used to audit AI systems, and how to choose.
Why independent, third-party AI audits matter and when you need one.