An AI audit is a structured, evidence-based assessment of an AI system or an AI program against defined criteria. Those criteria typically span performance and accuracy, bias and fairness, security and robustness, governance and documentation, and, where a law applies, regulatory conformance. The distinguishing feature of an audit is that it tests: it examines whether controls exist and whether they actually work, using evidence such as documentation, test results, risk assessments, and monitoring logs, then reports findings a leader can act on. An audit is not a one-time opinion or a demo. It measures a defined thing against a defined standard and produces a record of where controls meet the criteria and where they fall short. It is the activity that verifies an AI program, distinct from the program itself and from the policy the program is built on.

What is the difference between an AI audit and an AI risk assessment?

They are related but not the same, and confusing them wastes effort. An AI risk assessment identifies and rates risk: it asks what could go wrong with a given AI use, how likely and how serious each risk is, and which risks need controls. It happens early and it can happen before any controls exist. An AI audit comes later and does something different: it tests whether the controls that were put in place against those risks actually exist and operate, measured against defined criteria. Put simply, a risk assessment decides what to protect against and how much it matters; an audit checks whether the protection is real and working. A mature program runs both, and the risk assessment usually supplies the criteria the audit then tests against. The two reinforce each other rather than substituting for one another.

What types of AI audit are there?

AI audits vary along two axes: who conducts them and what they cover. On who conducts them, an internal audit is run by the organization itself using people independent of the team that built the system, while an independent or external audit is run by a third party for assurance a board, customer, or regulator can rely on. On what they cover, a model or system audit assesses a single AI system against technical criteria such as accuracy, bias, robustness, and security; a governance or AI-management-system audit assesses the program, including whether policies, risk assessments, oversight, and evidence are in place; and a regulatory conformity assessment is a legally defined type, required for high-risk systems under the EU AI Act before they reach the market. The right type depends on the goal: technical assurance on a model, program assurance on the governance, or legal conformance where a law applies.

Is an AI audit legally required?

There is no universal legal requirement to audit every AI system, and any claim that there is should be treated with caution. Requirements are specific and scoped. Under the EU AI Act, high-risk AI systems must pass a conformity assessment before they are placed on the EU market, and those obligations phase in over time; this is a legal requirement, but it applies to the high-risk tier, not to all AI. Separately, an organization that adopts or certifies to ISO/IEC 42001 must conduct internal audits of its AI management system, because internal audit is a requirement of that standard, but adopting the standard is itself voluntary. Outside these cases, an AI audit is voluntary best practice that an organization chooses because it wants assurance, not because a law compels it. The accurate way to state it is that some audits are required for defined systems and standards, and the rest are strong governance discipline.

How do you run an AI audit?

Run it as a repeatable process rather than an open-ended review. First, set the scope: one model, a set of systems, or the whole program. Second, define the criteria you will measure against, such as your own AI policy, the NIST AI Risk Management Framework, the requirements of ISO/IEC 42001, or an EU AI Act obligation. Third, gather evidence: model documentation, test results, risk assessments, approval records, and monitoring logs. Fourth, test the controls against each criterion, examining measured behavior and inspecting documentation rather than accepting a claim. Fifth, report findings that are specific and evidenced, rating the severity of each gap. Sixth, remediate: assign each finding to an owner, fix it, and re-test to confirm the control now works. The re-test matters, because the value of an audit is in the corrective action it drives, not in the report alone.

What standards anchor an AI audit?

Three reference points anchor most AI audits, and each plays a different role, so read them accurately. The NIST AI Risk Management Framework is voluntary US guidance; its Measure function covers analyzing, assessing, benchmarking, and monitoring AI risk, which is the assessment discipline an audit draws on. ISO/IEC 42001 is an international, certifiable management-system standard for AI; it requires internal audit of the AI management system and can be audited and certified by an accredited certification body. The EU AI Act is binding law; it requires a conformity assessment for high-risk systems, a legally defined type of audit, not a general mandate to audit all AI. Many programs use the NIST framework to structure the assessment, ISO/IEC 42001 to formalize and certify the management system, and the EU AI Act where its obligations apply. They reinforce one another rather than competing.

What is the difference between an AI audit, an AI policy, and an AI governance framework?

They are three connected but distinct things, and keeping them straight avoids duplicated work. An AI policy is the artifact: the written statement of what the organization will and will not do with AI, and the standard against which controls are judged. An AI governance framework is the program: the full set of policies, roles, processes, and controls that direct and oversee AI across its lifecycle. An AI audit is the activity: the assessment that tests whether the program's controls exist and work, measured against the policy and any applicable standard. In sequence, the policy sets the rules, the framework operates them, and the audit verifies them, then feeds findings back so the framework improves. Lightbridge Labs treats the three as one loop rather than separate exercises, which is how an AI program stays defensible over time.

RL Written by Robert LabardeeFounder and CEO

Last updated July 2026.

What is an AI audit?

Lightbridge Labs defines an AI audit as a structured, evidence-based assessment of an AI system or an AI program against defined criteria: performance and accuracy, bias and fairness, security and robustness, governance and documentation, and regulatory conformance. An audit tests whether controls exist and work, and produces findings a leader can act on.

Scope an AI audit See the governance program

An AI audit is the activity that tests an AI system or program against criteria.

An AI audit is a structured assessment that examines whether the controls around an AI system exist and actually work. It measures a defined thing against a defined standard, using evidence such as model documentation, test results, risk assessments, and monitoring logs, then reports findings. The word that separates an audit from an opinion is test: an audit does not take a claim on trust, it checks the claim against evidence.

Three related terms are easy to blur, so keep them distinct. An AI audit is the activity. The written rules it measures against are the AI policy, the artifact. The full set of policies, roles, and controls the audit examines is the AI governance framework, the program. This page owns the activity: what an audit assesses, the types, how it differs from a risk assessment, how to run one, and the standards that anchor it. Lightbridge Labs runs audits and the governance work behind them through its AI governance practice.

An AI audit tests controls; an AI risk assessment identifies and rates risk.

The two are often confused, and the difference is practical. An AI risk assessment comes first and asks what could go wrong with a given AI use, how likely and how serious each risk is, and which risks need controls. It can run before any control exists. An AI audit comes later and asks a different question: do the controls put in place against those risks actually exist and operate, measured against defined criteria. The risk assessment decides what to protect against and how much it matters; the audit checks whether the protection is real.

The two connect: a risk assessment usually supplies the criteria an audit then tests against. Risk assessment is the discipline the NIST AI Risk Management Framework anchors, where the Map function identifies context and risk and the Measure function analyzes, assesses, benchmarks, and monitors it. An audit draws on that assessment work rather than repeating it. A mature program runs both, in sequence, so that findings from one feed the other.

AI audits come in several types, by who runs them and what they cover.

Not every AI audit is the same. Audits differ along two axes: who conducts them, internal or independent, and what they cover, a single model, the governance program, or a legal obligation. Naming the type you need is the first decision, because a technical model audit and a program-level governance audit answer different questions.

Internal audit

Conducted by the organization itself, by people independent of the team that built or runs the system. Internal audit is how a program checks its own controls before an outside party does, and under ISO/IEC 42001 it is a requirement of the standard for organizations that adopt an AI management system.

Independent or external audit

Conducted by a third party the organization does not control, for assurance a customer, board, or regulator can rely on. Independence is the point: an external reviewer has no stake in the result, so the findings carry weight that a self-assessment cannot.

Model or system audit

Assesses one AI system against technical criteria: accuracy on representative data, bias and fairness across groups, robustness under adversarial or unexpected input, security, and the documentation that explains how the system behaves. This is the audit most people picture when they say AI audit.

Governance or AIMS audit

Assesses the program rather than a single model: are policies in place, are risks assessed and owned, is oversight defined, is evidence retained. This is the type ISO/IEC 42001 formalizes as internal audit of an AI management system.

Regulatory conformity assessment

A specific, legally defined type. Under the EU AI Act, high-risk AI systems must pass a conformity assessment before market entry. It is one kind of AI audit, scoped to a law, and it is not a synonym for AI audits in general.

The regulatory conformity assessment is the one type set by law rather than choice, and it is scoped tightly: under the EU AI Act it applies to high-risk systems before market entry, not to all AI. The Lightbridge Labs EU AI Act compliance guide covers who falls in the high-risk tier and what the conformity route requires.

An AI audit measures against five recurring criteria areas.

An audit is only as good as the criteria it tests against. Across model audits and program audits, the same five areas recur, because together they cover whether a system performs, treats people fairly, holds up under stress, is governed, and meets any law that applies.

Performance and accuracy

Does the system do what it is meant to do on representative data, and do the results hold up over time. The audit tests measured behavior against a stated standard, not against a demo.

Bias and fairness

Are outcomes examined across relevant groups, and is harmful bias identified and managed. Fairness is contextual, so an audit checks that the organization defined what fairness means for this use and can show it measured against that definition.

Security and robustness

Can the system withstand adversarial input and unexpected conditions, and does it fail safely. The audit looks for evidence of testing, not a claim that the system is secure.

Governance and documentation

Is there a named owner, a risk assessment, defined oversight, an audit trail, and documentation that explains the system. This is where a model audit meets the program: controls are only real if they are evidenced.

Regulatory conformance

Where a law applies, does the system meet it. For a high-risk system under the EU AI Act, that means the conformity assessment and the obligations behind it. For most systems, no such mandate applies and conformance criteria are set by policy.

These areas map onto the trustworthiness characteristics the NIST framework defines and onto the controls an ISO/IEC 42001 management system runs. For how those standards fit together, see the Lightbridge Labs AI governance framework guide.

Running an AI audit is a six-step process, from scope to re-test.

An AI audit runs as a repeatable sequence, not an open-ended review. Scope the audit, define the criteria, gather evidence, test the controls, report the findings, then remediate and re-test. The last step is the one teams skip and the one that matters most: an audit earns its keep through the corrective action its findings drive, confirmed by a re-test.

Set the scope

Decide what is being audited: one model, a set of systems, or the whole AI program. Scope fixes the boundary, so the audit tests a defined thing against defined criteria rather than drifting into an open-ended review.

Define the criteria

State the standard the audit measures against: the organization's own AI policy, a reference framework such as the NIST AI RMF, the requirements of ISO/IEC 42001, or a legal obligation such as an EU AI Act conformity assessment. Without stated criteria there is no audit, only an opinion.

Gather evidence

Collect the artifacts that show whether controls exist and operate: model documentation, test results, risk assessments, approval records, monitoring logs, and incident history. An audit runs on evidence, so absent evidence is itself a finding.

Test the controls

Examine each control against its criterion. Test the system's measured behavior, inspect the documentation, and check that oversight and monitoring operate as described. Testing is what separates an audit from a questionnaire.

Report the findings

Record where controls meet the criteria, where they fall short, and how serious each gap is. Findings are specific and evidenced, so an owner can act on them and a later audit can confirm they were closed.

Remediate and re-test

Assign each finding to an owner, fix the gap, and re-test to confirm the control now works. An audit is not finished at the report: the value is in the remediation the findings drive and the re-test that proves it.

The criteria step is where standards enter. An audit can measure against an organization's own AI policy, the NIST AI Risk Management Framework, the requirements of ISO/IEC 42001, or a legal obligation such as an EU AI Act conformity assessment. Choosing the criteria deliberately is what turns an audit from a checklist into evidence a board or regulator will accept.

Note on Lightbridge Labs' own posture: Lightbridge Labs is pursuing ISO 42001 certification and operates to ISO 42001 controls in its own work; those audits are in progress. AI standards and regulations are updated over time, so confirm current requirements at nist.gov and the official EUR-Lex text before relying on a specific detail.

AI audit: frequently asked questions

What is an AI audit?: An AI audit is a structured, evidence-based assessment of an AI system or an AI program against defined criteria. Those criteria typically span performance and accuracy, bias and fairness, security and robustness, governance and documentation, and, where a law applies, regulatory conformance. The distinguishing feature of an audit is that it tests: it examines whether controls exist and whether they actually work, using evidence such as documentation, test results, risk assessments, and monitoring logs, then reports findings a leader can act on. An audit is not a one-time opinion or a demo. It measures a defined thing against a defined standard and produces a record of where controls meet the criteria and where they fall short. It is the activity that verifies an AI program, distinct from the program itself and from the policy the program is built on.
What is the difference between an AI audit and an AI risk assessment?: They are related but not the same, and confusing them wastes effort. An AI risk assessment identifies and rates risk: it asks what could go wrong with a given AI use, how likely and how serious each risk is, and which risks need controls. It happens early and it can happen before any controls exist. An AI audit comes later and does something different: it tests whether the controls that were put in place against those risks actually exist and operate, measured against defined criteria. Put simply, a risk assessment decides what to protect against and how much it matters; an audit checks whether the protection is real and working. A mature program runs both, and the risk assessment usually supplies the criteria the audit then tests against. The two reinforce each other rather than substituting for one another.
What types of AI audit are there?: AI audits vary along two axes: who conducts them and what they cover. On who conducts them, an internal audit is run by the organization itself using people independent of the team that built the system, while an independent or external audit is run by a third party for assurance a board, customer, or regulator can rely on. On what they cover, a model or system audit assesses a single AI system against technical criteria such as accuracy, bias, robustness, and security; a governance or AI-management-system audit assesses the program, including whether policies, risk assessments, oversight, and evidence are in place; and a regulatory conformity assessment is a legally defined type, required for high-risk systems under the EU AI Act before they reach the market. The right type depends on the goal: technical assurance on a model, program assurance on the governance, or legal conformance where a law applies.
Is an AI audit legally required?: There is no universal legal requirement to audit every AI system, and any claim that there is should be treated with caution. Requirements are specific and scoped. Under the EU AI Act, high-risk AI systems must pass a conformity assessment before they are placed on the EU market, and those obligations phase in over time; this is a legal requirement, but it applies to the high-risk tier, not to all AI. Separately, an organization that adopts or certifies to ISO/IEC 42001 must conduct internal audits of its AI management system, because internal audit is a requirement of that standard, but adopting the standard is itself voluntary. Outside these cases, an AI audit is voluntary best practice that an organization chooses because it wants assurance, not because a law compels it. The accurate way to state it is that some audits are required for defined systems and standards, and the rest are strong governance discipline.
How do you run an AI audit?: Run it as a repeatable process rather than an open-ended review. First, set the scope: one model, a set of systems, or the whole program. Second, define the criteria you will measure against, such as your own AI policy, the NIST AI Risk Management Framework, the requirements of ISO/IEC 42001, or an EU AI Act obligation. Third, gather evidence: model documentation, test results, risk assessments, approval records, and monitoring logs. Fourth, test the controls against each criterion, examining measured behavior and inspecting documentation rather than accepting a claim. Fifth, report findings that are specific and evidenced, rating the severity of each gap. Sixth, remediate: assign each finding to an owner, fix it, and re-test to confirm the control now works. The re-test matters, because the value of an audit is in the corrective action it drives, not in the report alone.
What standards anchor an AI audit?: Three reference points anchor most AI audits, and each plays a different role, so read them accurately. The NIST AI Risk Management Framework is voluntary US guidance; its Measure function covers analyzing, assessing, benchmarking, and monitoring AI risk, which is the assessment discipline an audit draws on. ISO/IEC 42001 is an international, certifiable management-system standard for AI; it requires internal audit of the AI management system and can be audited and certified by an accredited certification body. The EU AI Act is binding law; it requires a conformity assessment for high-risk systems, a legally defined type of audit, not a general mandate to audit all AI. Many programs use the NIST framework to structure the assessment, ISO/IEC 42001 to formalize and certify the management system, and the EU AI Act where its obligations apply. They reinforce one another rather than competing.
What is the difference between an AI audit, an AI policy, and an AI governance framework?: They are three connected but distinct things, and keeping them straight avoids duplicated work. An AI policy is the artifact: the written statement of what the organization will and will not do with AI, and the standard against which controls are judged. An AI governance framework is the program: the full set of policies, roles, processes, and controls that direct and oversee AI across its lifecycle. An AI audit is the activity: the assessment that tests whether the program's controls exist and work, measured against the policy and any applicable standard. In sequence, the policy sets the rules, the framework operates them, and the audit verifies them, then feeds findings back so the framework improves. Lightbridge Labs treats the three as one loop rather than separate exercises, which is how an AI program stays defensible over time.

This guide is independent, general educational information published by Lightbridge Labs. It is not legal or compliance advice and it is not affiliated with or endorsed by the National Institute of Standards and Technology, the International Organization for Standardization, or the European Union. References to NIST AI 100-1, ISO/IEC 42001, and the EU AI Act are for identification only; verify current requirements against the controlling sources. Lightbridge Labs is pursuing ISO 42001, ISO 27001, and SOC 2 certifications, all currently in progress.

From understanding an AI audit to running one that holds up.

When the question shifts from what an AI audit is to how to scope, run, and evidence one across your systems, Lightbridge Labs sets the criteria, tests the controls, and turns findings into remediation your leadership can defend.

Talk to Lightbridge Labs See AI governance