Auditing AI systems
Who it binds
The 5 roles that carry a duty under Auditing AI systems, and the provisions that fall on each. A duty follows the capacity you are acting in, which is not always the one you think of yourself as occupying.
§ 1How to read this
One organisation frequently occupies more than one of these roles at once, and the duties are owed separately for each. The roles below are kept distinct because the instruments keep them distinct: where two look alike, the sentence explaining the difference is the reason both are listed. Counts are of obligations in this collection only.
§ 2By role
The duty, by capacity
Internal audit functions
10 obligations
The function performing the audit, bound by the standards that govern how internal auditing is conducted rather than by any position in a supply chain.
- IIA Standard 13.3 — Engagement Objectives and Scope
- IIA Standard 13.4 — Evaluation Criteria
- IIA Standard 14.1 — Gathering Information for Analyses and Evaluation
- IIA Standard 14.6 — Engagement Documentation
- IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings
- ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel
- ISO 19011:2026, clause 5 — Managing an audit programme
- ISO 19011:2026, clause 6 — Conducting an audit
- NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)
- Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans
Certification bodies
2 obligations
A body auditing and certifying a management system, bound by the competence and impartiality requirements that let its certificate mean anything.
Audited organisations
One obligation
The organisation being audited — the party that must produce the evidence, whoever built the system.
Notified bodies
One obligation
A conformity assessment body designated under the Act to carry out third-party assessment, and itself subject to obligations for doing so.
Providers
One obligation
Whoever develops the system, or places it on the market under their own name — including a deployer who rebrands one or modifies it substantially.
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.