Skip to content

Prepare evidence for review

What is audit readiness

Audit readiness is the state in which an organization is prepared for a formal compliance audit — with documentation, processes, and evidence in order. The goal is not to “pass an audit” but to have governance that actually works.

Audit readiness checklist

This checklist is recommended preparation for the chosen audit criteria. Not every item is a statutory duty for every organisation or AI system.

1. Documentation (foundation from L1 — Align)

ItemStatusDescription
AI policy-Approved by management, distributed to employees
AI inventory-Complete list of AI systems with risk classification
Risk assessment-Risk assessment for each AI system
AI literacy-Evidence of chosen measures; training records where training forms part of those measures
Incident reporting-Process for reporting and resolving AI incidents
DPIA (where relevant)-Data Protection Impact Assessment for AI systems

2. Processes (foundation from L1 — Align + L3 — Innovate)

ItemStatusDescription
Approval process-How new AI tools are approved
Monitoring-How AI systems are continuously monitored
Review cycle-Regular review of AI policies and processes
Escalation paths-Who resolves issues and how
Change management-How changes in AI systems are managed

3. Evidence

ItemStatusDescription
Meeting minutes-Documentation of management decisions about AI
Training records-Attendance sheets, certificates, test results
Incident log-Records of AI incidents and their resolution
Audit trail-Who, when, and what was approved/changed
Metrics-Data on adoption, incidents, compliance

Preparation process

Agree the audit criteria, legal role, system/organisation scope and evidence first. The following durations are planning examples, not a guarantee of readiness or audit acceptance.

What the auditor asks

Typical questions during an AI governance audit:

  1. “How do you identify AI systems in your organization?” — you need an AI inventory
  2. “How do you classify AI system risks?” — you need a risk assessment methodology
  3. “How do you support AI literacy among employees?” — prepare evidence of chosen measures, such as training
  4. “What happens when an AI system fails?” — you need an incident response plan
  5. “Who is responsible for AI governance?” — you need clear roles and responsibilities

Regulatory context

Assess scope by legal role, system and applicability of the relevant provision, including the AI Act transitional rules in Articles 111 and 113.

RegulationRegulatory contextArticle
AI ActApplicable conformity procedure for high-risk providers; external notified body only where the route requires itArt. 43-49
AI ActMeasures supporting role-appropriate AI literacy; evidence of them is recommended preparation, with no mandatory certificateArt. 4
NIS2Evaluate effectiveness of measures; audit scope/frequency follows the applicable regime, not a universal external-audit duty in Art. 21Arts. 21, 32–33 and national implementation
GDPRDPIA for processing likely to result in high risk; not every automated useArt. 35

Next steps

Content reviewed: 6 September 2026. Primary sources: ISO/IEC 42001, Commission — standardisation and AI Act, AI Act, GDPR — Art. 35.