What Is an AI Audit? What It Covers and What You Get

"AI audit" is used for two different jobs. One checks a specific AI system for bias, safety or legal compliance. The other looks at how a company runs and where AI can help it, and also goes by AI readiness assessment or AI opportunity assessment. A business owner deciding where AI fits usually wants the second kind. Anyone who needs the first kind should start with the regulators' and standards bodies' own pages, linked below.

Two kinds of AI audit

Auditing an AI system

An audit of this kind checks one system against a law or a standard. It matters when a business builds AI, sells it, or uses it to make decisions about people.

• New York City Local Law 144. Employers and employment agencies in New York City may not use an automated employment decision tool unless it has had a bias audit within one year of its use, information about that audit is publicly available, and notices have gone to candidates or employees. The city's Department of Consumer and Worker Protection began enforcing the law on July 5, 2023.
• The EU AI Act. The European Commission lists high-risk uses such as CV-sorting software for recruitment and credit scoring, and says these systems face strict obligations before they can be put on the market, including risk assessment, activity logging, detailed documentation and human oversight. Rules for those high-risk areas apply from 2 December 2027, per the Commission's AI Act page. Under Article 43, the provider of a high-risk system carries out a conformity assessment, by internal control for most high-risk categories and with a notified body in some biometric cases.
• ISO/IEC 42001. Published on 18 December 2023, the standard sets requirements for establishing, implementing, maintaining and continually improving an AI management system, and it applies to any organization that provides or uses products or services that use AI systems.
• The NIST AI Risk Management Framework. NIST released AI RMF 1.0 on January 26, 2023, for voluntary use, and added a Generative AI Profile (NIST-AI-600-1) on July 26, 2024. A U.S. company building its own review process can start from the NIST framework page.

Where one of these carries legal consequences, bring in a lawyer who knows that rule.

Auditing how the business uses AI

The business kind is about the company. It covers where time and money go today, which of that work AI tools can take on, what has to be in place for that to work, and what each change is worth.

What a business AI audit covers

Tools in use, including the unofficial ones

The first job is a list of every AI tool the company touches: paid subscriptions, AI features switched on inside software the business already pays for, and personal accounts people use for work. In Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 people in 31 countries published May 8, 2024, 78% of AI users were bringing their own AI tools to work, and the figure was 80% at small and medium-sized companies.

That use shows where people already find AI worth their time, which is often where the first opportunities are. The auditor records which accounts are on business terms, which are on personal ones, and what kind of information has gone through each. NIST's framework treats this list as part of governance: "Mechanisms are in place to inventory AI systems" (GOVERN 1.6).

Workflows and where time goes

Most of the findings come from interviews with the people who do the work. A good auditor walks through a normal week with each role: what comes in, what they produce, what they wait on, what they redo. How many quotes went out last month? How long does each one take from site visit to sent? How many emails a day ask one of the same few questions? Answers get checked against system records where those exist.

The target is work that is mostly reading, writing, sorting, summarizing or copying between systems, done often, by people whose time is expensive or scarce.

Data and systems

For each workflow, the auditor finds out where the information is kept (the CRM, the accounting system, shared drives, email, a spreadsheet on someone's desktop), whether it is current, whether two sources disagree, and whether it can be exported or connected to another tool.

They also check who can open what, because built-in AI assistants follow those permissions. Microsoft says Microsoft 365 Copilot only surfaces organizational data to which a user has at least view permission. Google's Workspace privacy hub says that if you don't have permission to see a file, Gemini can't see or use it either. A shared drive where everyone can open the payroll folder is worth fixing before either assistant goes live across the company.

Risk, policy and compliance

The auditor checks what data is allowed into which tool under each vendor's terms. Vendors publish training commitments for their business plans. Anthropic says that by default it does not use inputs or outputs from its commercial products to train its models. Microsoft says Copilot prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. Google says Workspace content isn't used for model training outside your domain without permission. Personal and free plans can work differently, which is the subject of what is safe to put into ChatGPT.

They also read client contracts for confidentiality terms, check industry rules that apply to the data, and look at whether any planned use touches decisions about people, such as hiring, where the system-audit rules above apply. A missing written AI use policy gets noted as a gap to close.

People and skills

Who already uses AI and for what, who wants training, and who has time to own the work afterward. NIST's framework includes AI risk management training for personnel and partners as part of governance, so they can do their jobs consistent with the organization's policies (GOVERN 2.2). In a small company this is usually a few interview questions about comfort with the tools and useful training.

What you get at the end

A business AI audit should end in documents a company can act on without the auditor in the room.

• A ranked list of opportunities. Each entry names the task, who does it, how often, the time or cost today, what would change, the estimated value, the effort, and the risk. Each value estimate shows its inputs (hours, people, cost per hour, rework) so you can change an assumption and see the result.
• A roadmap. What to do first, second and later, who owns each step, and what has to be in place before it starts, such as cleaning up a customer list or fixing drive permissions.
• An AI use policy. Approved tools and plans, what data can go where, who reviews output before it reaches a customer, and who approves new tools. A page or two that staff will read.
• Tool recommendations. Specific products and settings for the top opportunities, starting with AI features in software the company already pays for, plus any subscriptions to cancel or combine.
• Often, a pilot plan. One or two first projects, each with a start date, an owner, a before number and the measure that decides whether it continues.

How long it takes

The calendar depends on how many people need interviews, how many workflows and locations are in scope, and how quickly documents and system access arrive. The usual stages are a kickoff and document request, interviews, a review of tools, data and permissions, analysis and value estimates, and a readout.

For a small or mid-sized company with a few core workflows, a well-scoped audit is usually measured in weeks. Several sites, custom software or regulated data make it longer. Ask for the calendar before signing. A provider who can't say when the readout happens hasn't scoped the work.

Who in the company gets involved

• The owner or an executive sponsor, to set goals at the kickoff and decide on the roadmap at the readout.
• The people who do the daily work: front desk, operations, sales, bookkeeping, dispatch. They know where the time goes.
• Whoever runs IT, in-house or an outside provider, for accounts, permissions, security settings and integrations.
• Finance or the bookkeeper, for the cost figures behind the value estimates.
• Anyone who handles compliance, HR or contracts, plus outside counsel if the business is regulated.

How to judge one

• It's specific to your company. Put a competitor's name on the report. If it still reads true, it's generic.
• The value estimates are traceable. Each one goes back to inputs you recognize, many from your own staff and systems.
• It ranks, and it says what to skip. A list of twenty equal ideas leaves the hard part to you.
• It covers the unofficial AI use, with a policy and approved tools in place of a ban.
• The tool advice starts with what you already pay for, and any new purchase comes with a reason.
• Every next step has an owner inside the company and a date.
• Conflicts are disclosed. If the auditor resells software or takes referral fees, that should appear next to the recommendation it affects.

Questions to ask before hiring someone

1. What will be handed over at the end, and can you show a redacted example from a past audit?
2. Who will you interview, and how much time will each person need to set aside?
3. How do you estimate value, and will each estimate show its inputs?
4. Do you resell software or receive referral fees from vendors you might recommend?
5. What access to systems and data do you need, how will you protect it, and what will you delete when the work ends? Will you sign an NDA?
6. Who reviews the policy and compliance findings for this industry, and what qualifies them to?
7. When does the work start, when is the readout, and what happens if it slips?
8. After the readout, can the roadmap be carried out in-house, with you, or with another firm?

Some firms offer this as a local, in-person service. An AI readiness assessment in Milwaukee is one example.

Getting ready for one

Bring a list of the software the business pays for, a rough org chart, last month's numbers for the work you suspect is slow, and the names of people already using AI tools. The AI readiness checklist has the questions an audit will ask, grouped by area, and answering them is worth doing even if you run the first projects yourself.