AI Audit
An AI audit is a structured review of how an organisation actually uses AI: every tool, model and workflow is inventoried, then tested for accuracy, data exposure, cost and compliance, with findings ranked by risk and a remediation plan attached.
No jargon, no math
In plain words, what is it?
Most companies discover their real AI usage during an audit, not before. The auditor starts with an inventory: every chatbot, copilot, embedded model and spreadsheet macro that calls an API, mapped to an owner, a vendor and the data it touches. Each entry is then classified by risk tier: a public drafting assistant and a system that reads patient records do not get the same scrutiny. The core of the audit is testing, not paperwork: sample the outputs for accuracy, probe for prompt injection, check whether the tool leaks private data into its answers, read the vendor contract. Findings are ranked by likelihood and impact, and the report ends with a remediation plan: fix, restrict or retire, each with an owner and a date. An audit that only lists tools without testing them is a census, not an audit.
- 01
Inventory. List every AI tool, model and integration in real use, with an owner for each.
- 02
Classify. Tag each system by the data it touches and a risk tier.
- 03
Test. Sample outputs for accuracy and probe for injection and data leakage.
- 04
Rank. Score findings by likelihood and impact.
- 05
Remediate. Assign each finding a fix, an owner and a deadline.
Terms that live nearby.
AI Governance
AI governance is the set of policies, roles and controls that decide how an organisation may build, buy and use AI: who approves a use case, what data a model may see, how incidents are handled, and who is accountable when something goes wrong.
ReadAI Readiness
AI readiness measures how prepared an organisation's data, processes, people and governance are to run AI in production, and it is assessed before any model is deployed.
ReadGuardrails
Guardrails are the checks and limits wrapped around an AI model so its behaviour stays inside your rules: they screen what goes in, constrain what the model can do, and verify what comes out before it reaches a person or a system.
Read§ 04
Want this running in your stack?
We design and ship AI systems with permissions, logs and human approval. It starts with a 30-minute scoping call.