Learn AI /AI Governance and UN Terminology /AI audit and assurance

AI audit and assurance

Intermediate
AI Governance and UN Terminology
Policy officers
Managers & front offices
Technical readers

Also called: AI audit, AI assurance, conformity assessment.

Detail

In five seconds

What it is

A structured check of how an AI system is governed, tested and used, producing evidence-based confidence that stated requirements are met and risks are controlled.

In plain words

These are ways of checking whether an AI system deserves trust for a particular use. 'Assurance' is the broad effort to build confidence. An 'audit' is one structured check of evidence. 'Conformity assessment' checks whether stated requirements have been fulfilled.

An everyday example

A relief team plans food for a distribution point and estimates that 8,000 people will arrive over three days. One colleague gathers the registration assumptions, stock lists, transport plans and last month's attendance figures. Another colleague checks whether the numbers were calculated consistently, whether the team has a backup plan if turnout is higher, and whether the process follows the organisation's approved guidance. At the end, the team does not only have a number; it has a documented basis for trusting the plan, plus a list of gaps to fix before distribution day.

Where the story stops working

A food estimate is mostly transparent and based on ordinary planning documents. Many AI systems add harder questions, such as model behaviour changing across contexts, hidden failure modes, data quality problems and technical tests that non-specialists cannot judge by inspection alone. Also, an AI audit may examine ongoing monitoring after deployment, not just a plan before use.

Remember thisAI assurance supports justified confidence, not a blanket seal of approval. Ask what criteria were used, what evidence was examined, who performed the check and which limitations remain.

This term is contested

The boundaries among 'AI audit', 'AI assurance' and 'conformity assessment' are not fully settled across jurisdictions, standards bodies and organisations; some use them narrowly, others use them interchangeably or hierarchically.

Understand it

Why it matters

Non-specialists often hear strong claims about an AI system being safe, fair, compliant or ready for deployment. Audit and assurance ask a practical question: what evidence supports that claim, checked against which requirements, by whom, and with what limits? That matters for procurement, oversight, risk management and public trust. It helps leaders distinguish marketing from substantiated assurance, decide whether a system should be used, restricted or corrected, and understand that a positive report is usually conditional on scope, criteria and evidence rather than a blanket guarantee.

How audit, assurance and conformity assessment relate

After viewing, the reader should be able to explain that assurance is the broad aim, audit is one checking activity, and conformity assessment is the formal check against specified requirements.

01
1. Set the requirements
Choose the criteria to check against, such as a law, internal policy, contract term or international standard.
Draw a box labelled 'Requirements' with small document icons named 'law', 'policy', 'standard' and arrows into the next box.
02
2. Gather evidence
Collect documentation, test results, logs, risk records, governance documents and records of human oversight.
Draw a box labelled 'Evidence' with stacked sheets and a checklist. Connect from step 1 with a solid arrow.
03
3. Examine and test
Reviewers inspect the evidence, sample outputs, interview staff, and check whether controls work in practice.
Draw a box labelled 'Audit activities' with a magnifying glass over documents and a small speech bubble for interviews.
04
4. Issue the result
The output may be an assurance statement, audit findings, corrective actions or a formal conformity decision.
Draw a box labelled 'Result' with three tagged outputs: 'assurance', 'audit report', 'conformity decision'. Add a note underneath: 'assurance = broad aim; audit = checking method; conformity assessment = formal conformance route'.

A four-step horizontal sequence. Read left to right. Each box shows one stage from setting requirements to producing an assurance output. A side note in the final box distinguishes three labels: assurance as the overall confidence-building process, audit as evidence review, and conformity assessment as the formal conformance check.

On hover or tap, each box expands to show examples of criteria, evidence and outputs; keyboard focus reveals the same text in a side panel.

Describe this without the diagram

The diagram is a left-to-right four-step sequence explaining the relationship among three related terms. Step 1 is 'Set the requirements': decide what the AI system will be checked against, such as a law, policy or standard. Step 2 is 'Gather evidence': collect documents, logs, test results, risk records and oversight records. Step 3 is 'Examine and test': reviewers inspect the evidence, sample outputs and staff practices to see whether controls work. Step 4 is 'Issue the result': produce an assurance statement, audit report, corrective-action list or conformity decision. The key message is that assurance is the broad confidence-building process, audit is one of the checking activities within it, and conformity assessment is the more formal process for showing conformance to specified requirements.

With reduced motion: A static four-box horizontal diagram with arrows from requirements to evidence to audit activities to result, plus a text note under the final box distinguishing assurance, audit and conformity assessment without animation.

These related terms sit in the same family, but they are not identical. An AI audit usually means a systematic examination of evidence: documents, logs, test results, controls and records about an AI system and its use. AI assurance is broader. It means the activities and evidence used to build justified confidence that the system meets certain requirements, such as safety, fairness, security or legal compliance. Conformity assessment is a process for showing whether specified requirements have been met, often under a law, standard or certification scheme.

What goes in? Typically: the system description, its purpose, risk classification, data and model documentation, human oversight arrangements, incident records, performance tests and governance policies. What happens? Reviewers compare the evidence against defined criteria. They may inspect processes, sample outputs, interview staff, repeat tests or check whether controls actually operate in practice. What comes out? Usually a finding, opinion, report, certification decision or list of non-conformities that need correction.

A useful way to separate them is this: assurance is the umbrella, audit is one kind of assurance activity, and conformity assessment shows whether specified requirements have been fulfilled. In some organisations, the terms overlap heavily. In others, they mark different roles: internal audit, external assurance provider, regulator or certification body.

This term is often confused with impact assessment and red teaming. An impact assessment asks before or during use what harms or effects may arise and how to reduce them. Red teaming stress-tests a system by trying to make it fail or reveal weaknesses. Audit and assurance may use those outputs as evidence, but they are not the same thing. Their question is different: given the evidence, can we justify confidence that the system and its governance meet the chosen requirements?

How “Checking a food distribution estimate before deliveries start” maps onto the real thing

In the story	In the AI system
registration assumptions, stock lists and attendance figures	documentation, logs, test results and operational evidence
checking calculations and backup plans	auditing controls, performance claims and risk mitigations
approved guidance for planning	laws, standards, internal policies or certification criteria
documented basis for trusting the plan	assurance report, findings or conformity decision

A worked example

Before renewing an AI service used to draft background notes from public documents, an internal audit function examines its operation in a regional bureau.

Starting from: The office requires source traceability, human clearance, controlled access, recorded changes and a procedure for handling inaccurate or unsupported output.

The auditors collect system and data documentation, validation results, user instructions, access logs, change records, oversight records and the incident register.
They map each requirement to evidence showing how the control was designed, tested and applied in practice.
They repeat representative tests using public documents and check whether summaries preserve qualifications, cite the correct sources and avoid unsupported claims.
They observe the desk officer’s workflow and verify that edits, rejected output and final clearance remain attributable to a human reviewer.
They record a gap where source links can be lost in longer drafts and require corrective testing, updated instructions and evidence of resolution before renewal.

Result: The assurance conclusion is qualified rather than absolute: most controls are operating, but the source-traceability requirement is not consistently met. The file records the evidence, limitation, responsible action and condition for closing the finding.

In a United Nations workplace

During clearance of a statement for delivery, an ICT officer in a UN Country Team working group sees a sentence claiming that a shared AI tool is “fully assured”. Before close of business, the officer asks for the test results, access records, incident procedure, oversight arrangements and the criteria against which the claim was made.

Assurance turns a broad claim into one supported by evidence. An audit can examine whether the tool was governed, tested and operated against defined requirements, identify gaps and record any corrective action needed before the statement is cleared.

Before you try thisDo not submit personal, protection-sensitive, security-sensitive or other confidential material to a tool that has not been approved for it. Doing so can expose people, breach handling requirements and invalidate the assurance claim itself. Approval, data minimisation and accountable human review remain necessary.

Where you may hear it

An ICT governance board reviewing a pilot before wider rollout
A procurement meeting examining a vendor’s evidence before contract renewal
An internal audit opening meeting on the use of automated tools
A front-office briefing before a claim about an AI system is cleared

Avoid confusion

Often confused with

Common misconceptions

Common misconception: If a system has passed an AI audit, it is safe and compliant in every situation.
Correction: An audit only supports conclusions within a defined scope, time and set of criteria. A system can pass one audit and still fail in a new context, after an update, or against a different legal or ethical requirement. Results depend on what was checked and what evidence was available.
Common misconception: AI assurance is just another name for technical testing.
Correction: Technical testing is only one part. Assurance may also include governance checks, documentation review, human oversight arrangements, incident handling, procurement controls and ongoing monitoring. It is about justified confidence, not only model accuracy.
Common misconception: Conformity assessment always means a government has officially approved the system.
Correction: Not necessarily. Conformity assessment can be done in different schemes and by different bodies, including internal, supplier or third-party arrangements. In some settings it supports legal compliance; in others it supports certification or contractual trust.
Common misconception: Audit and assurance replace human responsibility for using the system.
Correction: They do not. They provide evidence for human judgement and accountability. Leaders, operators, regulators and procuring organisations still need to decide whether the system should be used, under what conditions, and with what safeguards.

Quick check

Which statement best captures the relationship among these terms?

Go deeper

The simple version

The technical version

AI assurance refers to the set of governance, testing, evaluation and evidentiary activities used to support justified confidence claims about an AI system's properties and controls. An AI audit is a systematic, documented examination of artefacts and practices such as data and model documentation, logs, validation results, oversight records, incident handling, access control and operational procedures, measured against defined criteria. Conformity assessment is the process of demonstrating that specified requirements have been fulfilled, often within a regulatory, standards or certification framework. Depending on the scheme, this may involve first-party, second-party or third-party assessment, and outputs may include findings, non-conformities, attestations or certification decisions. The boundaries among these terms vary by jurisdiction and institution, so scope, criteria, assessor independence and evidentiary limits should always be stated explicitly.

Reviewed external resources

Primary sourceITU-T work on artificial intelligence (opens in a new tab)ITU
This official ISO/IEC resource helps readers who want a standards-based view of AI management systems and is most useful for policy, compliance and implementation teams.
Deeperlink checked 2026-07-31
Primary sourceGlobal Digital Compact (opens in a new tab)United Nations
This official UN resource helps readers see how AI governance is framed in a broader multilateral agenda and suits policy and leadership audiences.
Intermediatelink checked 2026-07-31
Primary sourceGoverning AI for Humanity (opens in a new tab)UN Secretary-General's High-level Advisory Body on AI
This UN advisory resource helps readers connect assurance questions to wider AI governance issues and suits leadership, policy and technical readers.
Intermediatelink checked 2026-07-31
EncyclopaediaWikipedia search: AI audit and assurance (opens in a new tab)Wikipedia
This Wikipedia search results page helps beginners scan how the topic is described across related pages, but it is a search page rather than a single curated article.
search results, not one pagelink checked 2026-07-31
VideoVideo explanations: AI audit and assurance (opens in a new tab)YouTube search
This YouTube search results page helps readers find varied video explainers for different learning styles, but it is a search page rather than one authoritative lesson.
search results, not one pagelink checked 2026-07-31
DiscussionCommunity discussion: AI audit and assurance (opens in a new tab)Reddit search
This Reddit search results page helps readers see common questions and practitioner discussions, and suits readers who want informal perspectives with careful fact-checking.
search results, not one pagelink checked 2026-07-31

Where this came from

Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.

The one thing to remember

AI assurance supports justified confidence, not a blanket seal of approval. Ask what criteria were used, what evidence was examined, who performed the check and which limitations remain.