AI audit

AI governance audit · Auditing AI agents · Algorithmic audit

Definition

An AI audit is an assessment of an AI system, or of the governance around it, against defined criteria and based on evidence. Depending on its object it may look at a model, a use, a management system or, for agents, the decisions taken and the way they are controlled.

Four objects, four audits

These audits complement each other. The fourth is the one most often missing, because a model can pass its evaluations and a company can hold a certificate while nobody has checked what the agent decided last month.

ObjectTypical questionReference points
The modelIs it accurate, robust, free of unjustified bias?Technical tests, evaluations
The useWhich obligations apply to this use?AI Act, GDPR, sector rules
The management systemIs governance organized and improved over time?ISO/IEC 42001, NIST AI RMF
The delegated decisionsDid the agent stay within its mandate, and can it be shown?Mandates, register, tests of the stop device

What to check for an agent

  • Is the agent in the inventory, with a named owner?
  • Is there a signed mandate with figures, and does it match the agent's technical rights?
  • Take a sample of decisions from the audit trail: which rule was applied and was it the right one?
  • Did escalations occur, and were they handled in time?
  • When was the kill switch last tested, and did the test report show how long the stop took?
  • Has the model version changed since the last validation?

How ACF approaches it

The ACF governance audit rates the organization and not the agent, over 8 domains, in order to show where the structure holds and where it gives way. Maturity is read on a scale of 4 stages (initial, reactive, defined, mastered), which helps a company place itself and is not a mark for comparing with others. ACF Auditor offers a full assessment, and the free ACF Score gives a first reading.

Independence matters at this stage: whoever carries out the audit should not be the person who owns the agent. Bear in mind too that a completed audit form can produce a compliance facade, which may be more dangerous than having no framework at all.

Frequently asked questions

Is an AI audit mandatory?

It depends. The AI Act provides for conformity assessment of high-risk systems, and an ISO/IEC 42001 certificate requires an audit. Otherwise it is a choice, and often a requirement of customers or insurers.

How often should AI agents be audited?

At intervals that depend on criticality, with a more frequent light check and a less frequent full audit, plus an extra audit after any incident or major change of model or scope.

Where does your organization stand?

ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.

Take the ACF ScoreAI Act checkerACF Control

Related terms

Proof of governanceThe ability to show what was decided, by whom, under which rules and when, using five pieces of evidence rather than policy documents.AI audit trailThe preserved, verifiable record of the decisions an AI system or agent has taken, showing what was decided, by whom and under which rule.AI inventoryThe maintained list of the AI systems and agents an organization uses, with their purpose, data, owner and level of risk.AI governanceThe rules, roles and controls that decide how an organization builds, buys and uses AI, and who answers for the results.

See all 25 terms in the glossary

Primary sources

Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .