Who Audits AI?

In the previous article, we examined the transition from AI governance principles to implementation.

That transition creates a difficult question.

If governments establish rules for artificial intelligence, who determines whether an AI system actually follows them?

A company may claim that its model is safe.

A developer may report that a system is fair.

A provider may publish a transparency report.

An organisation may say that it has implemented responsible AI practices.

But governance cannot depend entirely on claims made by the organisations being governed.

At some point, someone needs to examine the evidence.

That is where AI auditing, evaluation and assurance enter the picture.

The question “Who audits AI?” may therefore become one of the defining governance questions of the next decade.

What Does It Mean to Audit AI?

AI auditing is often used as a broad term for examining whether an AI system, organisation or AI-management process satisfies specified requirements.

But several different activities can sit under this umbrella.

An organisation might test a model internally.

An independent laboratory might evaluate its performance.

An auditor might examine an organisation’s governance processes.

A conformity-assessment body might assess whether a regulated AI system meets legal requirements.

A regulator might investigate an incident.

A standards organisation might establish the methodology used by all of them.

These activities are related, but they are not identical.

This distinction is important because “AI audit” can otherwise become an overly broad label.

Testing asks whether a system behaves in a particular way.

Evaluation asks whether its performance or risks meet defined criteria.

Audit examines processes, controls, evidence and compliance against specified requirements.

Certification provides a formal statement of conformity to a defined standard or scheme.

Regulatory enforcement determines whether legal obligations have been met and what action should follow.

Assurance is the broader concept connecting these activities: generating justified confidence that an AI system or organisation meets specified expectations.

The Emerging AI Assurance Ecosystem

This means the future AI governance ecosystem is unlikely to contain one universal “AI auditor.”

Instead, multiple institutions are likely to coexist.

Developers will perform internal evaluations.

Independent testing organisations will conduct technical assessments.

Certification bodies will audit management systems.

Conformity-assessment bodies will assess regulated products or systems where required.

Accreditation bodies will assess whether certification organisations are competent.

Regulators will supervise the overall legal framework.

Universities and research institutions will develop new evaluation methodologies.

Civil society and independent researchers will conduct external scrutiny.

This resembles other mature governance ecosystems.

Financial systems have auditors, regulators, rating agencies and accounting standards.

Cybersecurity has penetration testers, certification schemes, standards bodies and regulators.

Medical devices have testing laboratories, conformity-assessment organisations and regulatory authorities.

AI is beginning to develop a comparable institutional architecture.

The European Union: Conformity Assessment Becomes Part of AI Regulation

The European Union provides one of the clearest examples.

Under the AI Act, Member States must designate notifying authorities responsible for assessing, designating and monitoring conformity-assessment bodies.

These bodies can then become notified bodies authorised to conduct certain conformity-assessment activities. The framework requires attention to competence, impartiality, organisational capacity and conflicts of interest.

This is an important institutional development.

The EU is not simply saying that high-risk AI must comply with certain requirements.

It is also creating an institutional mechanism through which compliance can be assessed.

That creates several layers of responsibility.

The provider develops and documents the system.

The conformity-assessment body may independently assess relevant requirements.

The notifying authority supervises the conformity-assessment bodies.

National market-surveillance authorities supervise AI systems in the market.

The European Commission and AI Office coordinate and exercise responsibilities at EU level.

This is governance through an institutional chain rather than through a single regulator.

Independence Becomes Critical

One of the most difficult questions in AI auditing is independence.

Suppose an organisation develops an AI system and also pays an auditor to evaluate it.

There is nothing inherently wrong with that arrangement.

Many forms of professional auditing work this way.

But independence must be protected.

If the auditor is financially dependent on the client, has participated in developing the system, or has incentives to produce favourable results, the credibility of the assessment can be weakened.

The EU AI Act explicitly addresses this issue.

Its requirements for notified bodies include independence from providers and other economically interested parties, organisational safeguards and professional competence. Personnel responsible for conformity assessment cannot be directly involved in the design, development, marketing or use of the high-risk systems they assess.

This illustrates an important principle:

AI assurance is not credible simply because someone performs a test.

The institutional conditions under which the test is performed also matter.

Who selected the methodology?

Who controls the data?

Who paid for the assessment?

Who has access to the model?

Who can challenge the findings?

Who supervises the evaluator?

Who is liable if the assessment is wrong?

These questions are part of AI governance.

Self-Assessment vs Independent Assessment

Not every AI system necessarily requires an external auditor.

The appropriate level of assessment depends on the risk, regulatory framework and type of system.

The EU AI Act itself reflects this distinction.

For certain high-risk AI systems, providers can conduct conformity assessment through internal controls under specified conditions.

For some systems, particularly certain biometric applications or situations where harmonised standards or common specifications are not applied, involvement of a notified body can be required.

This creates a spectrum.

At one end is internal self-assessment.

In the middle are independent technical evaluations and audits.

At the stronger end are formal third-party conformity assessments under regulatory frameworks.

The important governance question is therefore not:

Should every AI system be externally audited?

It is:

Which risks justify which level of independence and scrutiny?

This is a risk-based assurance question.

Why Internal Testing Still Matters

Independent auditing does not eliminate the need for internal evaluation.

In fact, organisations developing AI systems often have access to information that external auditors do not.

They know how the model was trained.

They know which datasets were used.

They know what changes have been made.

They know where known limitations exist.

They can run large numbers of tests during development.

Internal testing can therefore be continuous and deeply integrated into the development lifecycle.

The problem arises when internal testing becomes the only source of evidence.

An effective governance system may therefore combine internal and external assessment.

Internal teams can identify problems early.

External evaluators can provide additional scrutiny.

Regulators can intervene where legal obligations are involved.

Researchers can identify risks that formal testing frameworks may overlook.

This creates a layered assurance system.

The ISO Layer: AI Management Systems

Another important development is occurring through international standards.

ISO/IEC 42001:2023 establishes requirements for an Artificial Intelligence Management System.

It is designed to help organisations establish, implement, maintain and continually improve processes for responsible AI management.

This is different from testing whether a particular model is accurate.

ISO/IEC 42001 focuses on the organisation’s management system.

Does the organisation have appropriate governance?

Does it identify AI-related risks?

Does it establish responsibilities?

Does it maintain relevant processes?

Does it monitor and improve its AI management system?

This is an important distinction.

An organisation can have a technically capable model but weak governance processes.

Another organisation may have strong governance processes while individual models still require additional technical evaluation.

AI governance therefore operates at multiple levels.

Model-level assurance is not the same as organisational-level assurance.

ISO/IEC 42006: Auditing the Auditors

The governance ecosystem becomes even more interesting with ISO/IEC 42006:2025.

This standard specifies requirements for bodies that audit and certify AI management systems against ISO/IEC 42001.

In other words, it is not only about the organisation being audited.

It also establishes requirements for the organisations performing the audit and certification.

This creates a second-order governance problem.

If AI governance depends on auditors, who governs the auditors?

And if certification bodies provide assurance, who ensures that the certification bodies themselves are competent?

This is not unique to AI.

Mature certification ecosystems use accreditation and oversight mechanisms precisely because assurance itself must be trustworthy.

But AI makes this problem more complicated because technical competence is evolving rapidly.

An auditor who understands conventional software governance may not necessarily understand foundation models.

A cybersecurity specialist may not understand fairness evaluation.

A machine-learning researcher may not understand regulatory conformity assessment.

AI assurance therefore requires multidisciplinary competence.

The Rise of AI Assurance as a Profession

This could create a new professional field.

AI auditors may need knowledge of:

machine learning,

statistics,

software engineering,

cybersecurity,

data governance,

risk management,

human rights,

privacy,

sector-specific regulation,

and audit methodology.

The profession may eventually resemble cybersecurity auditing, financial auditing or medical-device conformity assessment in one respect:

technical expertise alone will not be sufficient.

The auditor must also understand the governance framework against which the system is being assessed.

This creates a potential skills gap.

There may be many AI engineers but relatively few professionals who understand both AI systems and regulatory assurance.

That gap could become strategically important.

Singapore and the Move Toward Practical Testing

Singapore provides another useful example.

Its AI Verify initiative was designed to help organisations conduct technical tests and process checks against AI governance principles.

The framework is intended to make responsible-AI claims more objective and verifiable, while recognising that testing does not guarantee that an AI system is completely safe or free from bias.

This distinction is important.

A testing framework does not magically transform a complex AI system into a safe system.

Instead, it creates evidence about specified properties.

That evidence can then support governance decisions.

Singapore has continued developing this ecosystem.

The AI Verify Foundation brings together organisations and researchers around AI testing frameworks, tools, standards and practices. The initiative has also expanded toward generative-AI testing and assurance.

The Global AI Assurance Pilot and Global AI Assurance Sandbox are particularly relevant because they move the concept from policy discussion toward a practical assurance ecosystem.

The Sandbox aims to provide access to specialist technical testing partners and contribute to emerging technical standards while supporting development of an AI assurance market.

That last point deserves attention.

An AI assurance market is emerging.

AI Assurance as an Economic Sector

If governments require evidence that AI systems meet certain standards, organisations will need services capable of generating that evidence.

This creates demand for:

AI testing laboratories,

model evaluation firms,

red-teaming services,

AI audit firms,

certification bodies,

risk-assessment specialists,

AI governance consultants,

technical standards organisations,

and specialised legal and regulatory services.

The AI governance ecosystem can therefore create an economic sector of its own.

But this also creates risks.

If the market grows quickly, the quality of assurance providers may vary.

Some firms may offer superficial compliance assessments.

Some may rely heavily on automated testing without sufficient contextual analysis.

Some may have conflicts of interest.

Some may certify organisational processes without adequately examining actual model behaviour.

This means that the assurance market itself requires governance.

The Assurance Paradox

This produces what could be called the assurance paradox.

The more society relies on AI audits to create trust, the more important it becomes to ensure that the audits themselves are trustworthy.

A weak AI audit can create false confidence.

And false confidence may be worse than openly acknowledged uncertainty.

This is particularly important for high-impact AI.

Imagine a system used in healthcare, financial services, education, employment or public administration.

If an organisation receives an “AI compliant” certificate, decision-makers and users may assume that the system has been comprehensively validated.

But what exactly was tested?

Which version of the system?

Under what conditions?

Using which datasets?

Against which benchmarks?

For which populations?

With what error rates?

Was adversarial testing performed?

Was human oversight assessed?

Was post-deployment behaviour examined?

Was the assessment independent?

A meaningful assurance system must make these questions visible.

A Certificate Is Not the Same as Safety

This is one of the most important distinctions in AI governance.

Certification against a standard does not necessarily mean that an AI system is safe in every context.

ISO itself distinguishes between implementing ISO/IEC 42001 and certification.

Certification is voluntary and provides independent confirmation that an organisation’s AI management system meets the standard’s requirements; it does not mean that ISO itself certifies the organisation.

Similarly, a technical benchmark result does not prove that a model will behave safely in every real-world environment.

An audit is evidence.

It is not omniscience.

This distinction should become central to AI governance communication.

What Exactly Should an AI Audit Examine?

There is no single answer.

The scope depends on the system.

A technical audit might examine model performance, robustness, security or bias.

A governance audit might examine organisational controls, accountability and documentation.

A privacy assessment might examine data processing.

A cybersecurity assessment might examine vulnerabilities and attack surfaces.

An impact assessment might examine consequences for individuals or communities.

A regulatory conformity assessment might examine whether legally defined requirements have been met.

A mature AI governance system therefore needs different assessment layers.

Trying to compress all of them into one “AI audit” can create confusion.

Foundation Models Make Auditing Harder

The challenge becomes greater with foundation models.

A general-purpose model can be used in many downstream applications.

The original developer may not know every deployment context.

A downstream deployer may modify the system.

A user may connect it to external tools.

An agent may act autonomously.

A model may be updated after an evaluation.

This means that assurance must potentially operate at several levels.

The foundation model may need evaluation.

The application may need evaluation.

The deployment environment may need evaluation.

The organisation’s governance processes may need evaluation.

And significant changes may require reassessment.

This creates a lifecycle assurance problem.

Agentic AI Makes the Problem More Complex

Agentic AI could make this even more difficult.

A conventional model can be evaluated primarily through inputs and outputs.

An agent can take actions.

That means assurance must examine not only what the system generates but what it can do.

An agent might access files.

It might call APIs.

It might execute code.

It might communicate externally.

It might make decisions across multiple steps.

A useful assurance framework therefore needs to consider permissions, tool access, action boundaries, human approval and reversibility.

This suggests that AI auditing will increasingly overlap with cybersecurity and systems engineering.

The Technical Evidence Problem

Another difficult issue is reproducibility.

AI evaluations can depend on:

model version,

system prompts,

sampling settings,

tools,

datasets,

evaluation benchmarks,

environment,

user behaviour,

and time.

Two evaluators may therefore produce different results.

This is why standardised testing methodologies are becoming important.

In April 2026, Singapore proposed ISO/IEC 42119-8, a new international standardisation effort focused on testing methodologies for generative AI, including benchmarking and red-teaming approaches intended to improve reproducibility and comparability.

This is an important development.

If AI assurance is to become a credible governance function, evaluation results need to become sufficiently reproducible and comparable to support decision-making.

That does not mean every AI system can be reduced to one universal score.

It means evaluation methodologies need enough consistency that evidence can be interpreted meaningfully.

The Global South Assurance Gap

There is another issue that receives less attention.

Where will AI assurance capacity exist?

Large technology economies are developing evaluation institutions.

But many developing countries do not yet have large pools of AI auditors, testing laboratories or regulatory technology specialists.

This could create an assurance dependency.

A country may purchase an AI system developed abroad.

The vendor may provide its own evaluation report.

An international certification body may provide additional documentation.

But the importing country may have little domestic capacity to independently verify the claims.

This creates a governance asymmetry.

The country has the authority to regulate AI but not necessarily the technical capability to evaluate it.

That is a serious institutional challenge.

Bangladesh and the AI Audit Question

For Bangladesh, AI auditing should therefore be viewed as a potential national capability rather than merely a compliance service.

Universities could develop AI evaluation research.

Independent institutes could study algorithmic impact.

Technical organisations could develop local-language testing datasets.

Cybersecurity researchers could test AI systems for vulnerabilities.

Legal researchers could connect technical findings with regulatory requirements.

Public agencies could develop procurement and evaluation standards.

Accreditation institutions could eventually examine the competence of AI assurance providers.

This does not require Bangladesh to immediately create a complex EU-style certification system.

It does suggest that the country should begin building expertise before demand becomes urgent.

That is precisely why university AI readiness matters.

A university capable of teaching AI governance, evaluation, cybersecurity, statistics and responsible AI could become part of the country’s future assurance infrastructure.

Atlas AI Institute could potentially contribute to this field through research rather than attempting to position itself prematurely as a formal certification authority.

Potential research areas include AI audit methodologies, AI assurance for developing countries, evaluation of Bangla-language models, public-sector AI procurement assurance and comparative study of AI conformity-assessment systems.

The Strategic Question: Who Controls Trust?

There is a deeper geopolitical dimension.

AI assurance is not only about technical quality.

It is also about institutional authority.

If one jurisdiction defines the standards, another performs certification and a third controls the underlying testing infrastructure, then trust in AI becomes partly dependent on transnational institutions.

This raises questions about standards diplomacy.

Which testing methods become internationally recognised?

Which certification schemes become widely accepted?

Which organisations are considered credible?

Which countries train the auditors?

Which datasets are used for evaluation?

Whose languages and populations are represented in testing?

The governance of AI assurance may therefore influence the governance of AI itself.

Testing Can Shape What Gets Built

This is another important point.

Evaluation is not neutral in its effects.

What gets measured tends to influence what developers optimise for.

If a benchmark measures toxicity, developers may improve toxicity performance.

If a standard measures robustness, developers may allocate resources toward robustness.

If regulators require documentation, organisations may build systems with stronger traceability.

If governments require human oversight, developers may design systems with clearer intervention mechanisms.

Evaluation therefore does more than measure AI.

It can influence AI development.

That gives standards and evaluators significant indirect power.

The Need for Independent Research

This is why independent research institutions matter.

Commercial AI developers have legitimate incentives to evaluate their systems.

Governments have legitimate regulatory responsibilities.

Standards bodies have legitimate coordination functions.

But independent research can provide another perspective.

Universities and research institutes can test systems without being responsible for selling them.

They can investigate unexpected behaviours.

They can reproduce published findings.

They can develop alternative evaluation methods.

They can examine impacts on populations that may be underrepresented in commercial benchmarks.

For the Global South, independent research may be particularly important because many international evaluation datasets do not adequately reflect local languages, institutions or social contexts.

The Future of AI Auditing

The emerging AI assurance ecosystem is likely to become increasingly layered.

Internal testing will remain important.

Third-party evaluation will expand.

Management-system certification will become more common.

Regulated conformity assessment will develop where laws require it.

AI safety institutes will contribute advanced testing methodologies.

Standards organisations will formalise evaluation practices.

Regulators will supervise and investigate.

Universities and civil society will provide external scrutiny.

No single institution will control AI assurance.

That fragmentation may create challenges.

Different jurisdictions may use different standards.

Different auditors may apply different methodologies.

Companies may face overlapping requirements.

But it may also create resilience.

Multiple independent sources of evidence can be stronger than a single central authority.

The Governance Question Behind the Audit Question

The question “Who audits AI?” therefore has a deeper meaning.

It is really asking:

Who has the authority to decide whether an AI system is acceptable?

Who has the technical ability to produce evidence?

Who is independent enough to be trusted?

Who supervises the evaluators?

Who decides what should be measured?

Who determines which risks matter?

And who represents people affected by AI systems?

These are governance questions, not merely technical questions.

AI assurance therefore sits directly at the intersection of technology, regulation, standards, markets and public institutions.

From Trust as a Claim to Trust as Evidence

The broader transformation can now be seen clearly.

The first phase of responsible AI relied heavily on principles and commitments.

The implementation phase is creating a demand for evidence.

Evidence requires evaluation.

Evaluation requires methodology.

Methodology requires standards.

Standards require competent institutions.

Competent institutions require skilled people.

And credible assurance requires independence.

This produces a new governance chain:

Principles → Requirements → Standards → Testing → Evaluation → Audit → Assurance → Monitoring → Enforcement.

The ability to build this chain may become a critical indicator of AI governance capacity.

For countries such as Bangladesh, the strategic question is therefore not simply whether an AI regulation exists.

It is whether the country has, or is developing, the ability to independently understand and assess the AI systems operating within its society.

That is a much more demanding question.

And it leads naturally to the next major issue in the global AI governance debate:

If governments increasingly depend on testing, evaluation and assurance, can they actually control frontier AI systems whose capabilities may evolve faster than regulatory institutions?

That is the question of frontier AI control.

And that is where the next stage of AI governance becomes considerably more difficult.