Auditing AI systems
Who it binds
The 2 roles that carry a duty under Auditing AI systems, and the provisions that fall on each. A duty follows the capacity you are acting in, which is not always the one you think of yourself as occupying.
§ 1 — How to read this
One organisation frequently occupies more than one of these roles at once, and the duties are owed separately for each. The roles below are kept distinct because the instruments keep them distinct: where two look alike, the sentence explaining the difference is the reason both are listed. Counts are of obligations in this collection only.
§ 2 — By role
The duty, by capacity
Internal audit functions
7 obligations
The function performing the audit, bound by the standards that govern how internal auditing is conducted rather than by any position in a supply chain.
- IIA Standard 13.3 — Engagement Objectives and Scope
- IIA Standard 13.4 — Evaluation Criteria
- IIA Standard 14.1 — Gathering Information for Analyses and Evaluation
- IIA Standard 14.6 — Engagement Documentation
- IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings
- ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel
- NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)
Certification bodies
One obligation
A body auditing and certifying a management system, bound by the competence and impartiality requirements that let its certificate mean anything.
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The free AI Literacy Certificate is open to any adult today, and the register lists what is open for enrolment.