The International Panel on the Information Environment, an independent science body, defines an AI audit as an evaluation of "an AI system and its interaction with people, communities, and organizations." According to the IPIE's Scientific Panel on Global Standards for AI Audits, auditors assess whether a system is properly developed, deployed, operated and managed. They also check whether the system follows ethical and legal norms such as fairness and data privacy.
Scientific auditing of AI systems has grown quickly, with methods that involve researchers probing a system from the outside to detect inaccurate information and bias. Auditors now examine models, data, governance structures, and outcomes across the AI life cycle and supply chain, since AI systems operate inside organizations and communities. The authors of AI Auditing (MIT Press) argue that regular audits of AI systems both protect the public, improve performance, and build confidence within the organization using the systems.
The EU AI Act (Regulation (EU) 2024/1689) sorts AI systems by risk. It bans social scoring and other practices classed as unacceptable risk. High-risk systems, including those used in employment and credit, must pass a conformity assessment before they reach the market. Limited-risk systems carry transparency duties.
The UK government expected AI audit and related services to become an industry worth billions of pounds. Large audit firms and specialist AI audit firms now sell these services under the rubric of AI assurance, though with wide variety in quality. Frameworks such as those offered by the ISO, IPIE, and NIST, set out what an audit should examine. None is mandatory, and auditors apply them unevenly. Some commercial auditors assess clients against the clients' own goals rather than third party, independent, scientific standards. Self-audits without scientific standards are a common route to "audit-washing". Evaluators of frontier models describe tight time limits and restrictions on what they may say publicly. Journalists have documented personal ties between evaluators and AI company staff. A California legislator reports hearing evaluators say they must be careful in order to keep their access.
For an AI audit to be trustworthy, an effective audit is defined by seven features: scope, auditor role, context and stakeholders, criteria, evidence, methodology, and post-audit activities. The audit report must state its scope, who pays, what evidence the auditor can see, and whether the findings can be published. The auditor must be allowed to run independent tests and consult the people affected, then publish findings.