Internal AI audit: how to start with a simple, useful review
An internal AI audit does not need a large team: it is an independent review of whether what you say you do with your AI systems is what you actually do. This guide proposes a realistic scope and a checklist to start.
What it is and what it is for
It is like servicing the car before a long trip: you do not wait for it to break down. It uncovers gaps while they are still cheap to fix and shows your governance is real, not just a document.
Set the scope
- Start with 2–3 systems of different risk.
- Set criteria: your internal policies and applicable requirements (AI Act, GDPR, ISO/IEC 42001 if you use it).
- Decide who audits, and make them independent.
Six areas to review
- Inventory and owner: is the system registered and does it have an owner?
- Risk classification: done, documented and current?
- Data: origin, quality, permissions and retention.
- Human oversight: does it exist and is it effective, not just formal?
- Logs and traceability: can you reconstruct what the system did?
- Incidents and changes: handled through a procedure?
How to report
- Finding: what was found, with evidence.
- Risk: why it matters.
- Action and deadline: who fixes it and when.
Track actions until closed; an audit without follow-up changes nothing.
Common mistakes
- Auditing yourself without independence.
- Reviewing only documents and not real operation.
- Not closing actions.
Frequently asked questions
What is an internal AI audit?
An independent review that your policies and applicable requirements are being met.
How often?
At least yearly and after major changes.
Informational content, not legal advice.
What's your Data Governance maturity?
Free assessment with your priority gaps, plus the self-assessment quiz and savings calculator on the Data Governance path.