What an AI Audit Actually Checks

An AI audit sounds intimidating. It isn't. Strip away the jargon and an audit is one question asked three ways: what does this system do, how do you know, and can you prove it?

First, auditors look at the system itself. What is it supposed to do? What is it not supposed to do? If your chatbot gives medical advice when it was built for appointment scheduling, that's a finding. Write down the job description of your AI like you'd write one for a new hire.

Second, they look at the data. Where did the training data come from? Who touched it? If you can't answer that, neither can the auditor. You don't need a data warehouse; a simple list works.

Third, they look at decisions. Who approved putting this system live? What changed since? When something went wrong, what did you do? This is the part most teams skip, and it's the part auditors care about most.

Notice what's missing from that list: perfection. Auditors don't expect your AI to be flawless. They expect you to know what it does, watch what it does, and write down what you learn. That's it. An audit checks your discipline, not your genius.

I explain frameworks; I don't give legal counsel.