Auditing AI systems
ISO 19011:2026, clause 6 — Conducting an audit
ISO 19011:2026 sets out the audit itself as six steps: initiating, preparing, conducting the auditing activities, reporting, completing, and the follow-up. None of them is AI-specific, and one of them is where AI engagements come apart — preparation, because that is where you find out whether the evidence you intend to rely on still exists.
§ 1 — When it applies
Which edition, and why there is no deadline
27 May 2026
BSI publication of ISO 19011:2026. This is the current-edition date for voluntary guidance, not a compliance deadline; the standard imposes no dated duty on anyone.
§ 2 — In practice
Six steps, and the one that decides the engagement
Clause 6 is a sequence, and its sub-clauses name the steps: 6.2 initiating, 6.3 preparing, 6.4 conducting auditing activities, 6.5 preparing and distributing the audit report, 6.6 completing, and 6.7 conducting the audit follow-up. On a conventional engagement 6.3 is administrative — confirm the plan, allocate the work, arrange access. On an AI engagement it decides whether the audit is possible at all. Inference logs have retention periods. Model versions are overwritten by deployment pipelines. The environment that produced a vendor’s figures may no longer be reconstructible. Every one of those is discoverable during preparation and expensive during fieldwork, and the difference between a function that checks and one that does not is a fortnight.
The current edition sets out eight principles of auditing, and two of them do most of the work here: 4.7 evidence-based approach and 4.8 risk-based approach. The first is the harder to honour, because an evidence-based conclusion about a probabilistic system needs evidence that reperforms, and reperformance needs the model version, the parameters and the date attached to every result — the argument set out in evidence sufficiency for AI controls. It is also worth saying plainly that 2026 is a new edition: material written against ISO 19011:2018 may cite clause numbers that no longer point where it says they do, which for a standard read mostly through other people’s summaries is a practical problem rather than a pedantic one.
Two steps are routinely collapsed into one another and should not be. Clause 6.5 covers preparing and distributing the audit report, 6.6 completes the audit, and 6.7 is the follow-up, which the standard treats as an activity conducted after the audit rather than as its tail. For AI systems that separation is load-bearing, because remediation of a model control is frequently a change to the model, and a change to the model invalidates the evidence the original conclusion rested on. What has to be verified at 6.7 is not that the change was made but that the behaviour moved — the point taken up in grading and following up AI findings.
§ 3 — Who it binds
Who the guidance is written for
Internal audit functionAudited organisation
Any organisation that needs to plan and conduct audits of management systems or manage an audit programme — the standard’s own statement of applicability, and it is drafted as guidance rather than as requirement. It does not state what a certification body must do; requirements for bodies certifying AI management systems sit in a separate standard, and an internal function is bound by neither.
§ 4 — What discharges it
What the engagement file has to hold
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The audit plan issued to the auditee, with the access it assumes
Not only scope and dates. Which systems, which environments, which periods of log data, and who has to grant each — so that a refusal or a retention limit surfaces during preparation rather than halfway through the work.
02
Opening and closing meeting records
Who attended, what was agreed about access and constraints, and what was said about the results before the report was written. On contested engagements this establishes what the auditee knew and when.
03
The audit report as clause 6.5 describes it
Scope, criteria, conclusions and the basis for them, distributed to a defined list. For an AI engagement the criteria section works hardest, because it is where a reader learns what the system was measured against.
04
The follow-up verification file under 6.7
Kept apart from the engagement file, because it is a separate activity with its own evidence date. Where remediation altered the model, it must also record that the original procedure was re-run rather than reasoned about.
§ 5 — Worked example
Worked example — logs that roll off at thirty days
A fintech’s internal audit function plans a four-week review of the controls over its underwriting model. The plan is issued, the opening meeting is held, and the team asks for six months of inference logs to test the human-override control. The platform team explains that inference logs roll off after thirty days and that the underwriting model has been redeployed twice in the period under review.
Which step of clause 6 failed, and what does the function do now?
Clause 6.3 failed, not 6.4. Preparation is where the availability of evidence is established, and both facts were knowable before anyone was in the room: retention is a documented platform setting and the deployment history is in the release record. The engagement as scoped cannot now be performed, and every honest option is worse than having asked earlier. Re-scope to the thirty days that exist and state the limitation in the report. Or hold the engagement, arrange forward collection, and review a period that will exist. What the function must not do is test the last thirty days and report a conclusion about six months. There is also a second finding sitting in the facts, and it belongs in the report whichever option is taken: a control whose operation cannot be evidenced beyond thirty days is a control the organisation cannot demonstrate it operates.
§ 6 — What a weak answer looks like
Fieldwork before access
Fieldwork that started before access was settled. The plan was issued, the opening meeting held, and three weeks in the team discovers that inference logs are retained for thirty days, that the model in production is two versions ahead of the one documented, and that the vendor’s evaluation harness is not available to the client at all. Everything after that is negotiation dressed as testing. The standard puts a preparation step before the conducting step for exactly this reason, and on AI engagements it is the step most often treated as paperwork.
§ 7 — Elsewhere
What has to exist before you can audit it
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Article 12 requires high-risk systems to allow the automatic recording of events over their lifetime. Whether those records exist, and for how long, is what preparation under clause 6.3 has to establish before an engagement is committed to.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 9 — Also read
Also read
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.