AI Audits and Third-Party Assurance

AI audits differ in who does them and what they examine. Internal audits are run by the organization itself, ideally by a team separate from the builders; Raji and colleagues' 2020 framework proposed an end-to-end internal audit process across a system's development. External audits come from outsiders. Some are cooperative, with access to data and code; others are adversarial, like journalists or researchers testing a system through its public interface. Regulatory audits are required or performed under law. Methods fall into three broad groups. Governance or process audits check policies, documentation, roles and risk management. Technical audits test the model: performance across subgroups, robustness, security, and behaviour on edge cases, sometimes including red teaming. Outcome audits look at real-world effects, for example comparing decisions across groups or using sock-puppet accounts to probe a recommendation system. Conformity assessment is a related legal concept. Under the EU AI Act, providers of high-risk systems must show compliance before placing them on the market. For most standalone high-risk uses this is an internal control procedure, while certain biometric systems and AI in products already covered by EU safety laws may involve a notified body. New York City's Local Law 144 requires independent bias audits for automated employment decision tools, and the EU Digital Services Act requires independent audits of very large online platforms. Independence is the persistent weakness. Auditors are usually paid by the company being audited, may receive limited access, and often work without agreed standards for what counts as passing. Critics warn of audit-washing, where a narrow audit is presented as a clean bill of health. A common misconception is that an audit certifies a system as safe or fair in general; it only speaks to the criteria, scope and time period examined.