Building AI that survives an audit

Auditors want evidence, not assurances

'The model is reliable' is an assurance; a record of exactly what was decided, on what data, that provably has not changed is evidence. Audits are settled with the second, and systems designed only to demo well rarely have it.

If you cannot show it, you cannot claim it.

Honest scope passes; overclaiming fails

Auditors are trained to find the gap between claim and reality. Stating clearly what the system does not do and what its numbers do not prove turns that gap into a documented boundary rather than a discovered failure.

Design for the audit before it is scheduled

The systems that pass are the ones where every material decision was recorded verifiably as it happened. You cannot reconstruct that credibly the week before an auditor arrives.

Preparing before the auditor arrives

A system passes an audit because of choices made long before it was scheduled: every material decision recorded verifiably as it happened. You cannot credibly reconstruct that trail in the week before an auditor arrives, and attempting to is itself a finding.

The organisations that sail through are the ones for whom the audit is simply a request to show records that already exist, in a form designed to be checked by someone who does not trust them.