Resources
What Is an AI Audit?
Two different jobs go by the name AI audit: checking the AI you already run, and finding the manual work worth automating. Here is how to tell which you need. This guide covers what it covers, what you get, and how to tell if your business needs one.
By Victor Xu, Founder · LinkedIn
Last updated · 2026-10-13
The short version
An AI audit is a structured assessment of where AI could save your business time and money: identifying the recurring manual workflows worth automating, estimating what each is costing you, and prioritizing them by return, all before anyone builds anything. It's the diagnosis step: instead of guessing where AI might help or buying tools on hope, you get a clear map of your highest-leverage opportunities. A business needs one when it knows AI should help but doesn't know where to start.
There are two kinds of AI audit, so which one do you need?
Two different jobs go by the name AI audit and they have almost nothing to do with each other. One of them examines the AI a company already runs. The other examines the company, looking for work a system could take over. Most of what has been written about AI audits describes the first. Most owners who type the phrase into a search box want the second.
The governance version asks whether a model behaves fairly, whether the data behind it was collected and held lawfully, and whether you could explain to somebody outside the company how a decision was reached. It gets commissioned because a regulator, a large customer's security review or a board asked for it, and the people who run it come from risk, legal and assurance.
The opportunity version asks where your operation is losing hours to manual work, what each of those hours costs, and which of that work a system could take off your people. Nothing obliges you to do it. It happens because an owner can tell that AI should be helping somewhere and cannot see where.
| AI governance audit | AI opportunity audit | |
|---|---|---|
| What it examines | The AI systems you already run | The work your people still do by hand |
| The question it answers | Is this model fair, lawful and explainable? | Where are the hours going, and what is each one worth? |
| What triggers it | A regulator, a customer's security review, a board | An owner who knows AI should help and cannot see where |
| Who runs it | Risk, legal, internal audit, assurance firms | Operations and automation people |
| What you walk away with | Findings against a standard and a list of fixes | A map of the manual work, a number on each leak, and an order to build in |
| Is this the one we do? | No | Yes |
This page describes the second one, and it is the only one we do. We do not review AI governance or certify models, so if a compliance questionnaire or a regulator is what sent you looking, a risk or assurance firm is who you want.
What standards is an AI governance audit run against?
A governance audit is run against a published standard or framework, and two of them cover most of the work. ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system, and it is certifiable: an accredited body can audit you against it and issue a certificate. It uses the same clause structure as ISO/IEC 27001, so a company already certified for information security will recognize the shape of it.
The other is the NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology in 2023. It is voluntary and there is no certificate at the end, so it tends to get used as a way to organize the work rather than as something to pass. Sector and state rules sit on top of both, and some of them reach ordinary operations rather than only AI companies: the Texas Responsible Artificial Intelligence Governance Act, effective 1 January 2026, is one we set out on the Houston consulting page.
If a customer's security questionnaire, a board or a regulator is what sent you looking for an AI audit, those are the words to take shopping, and a risk or assurance firm is who does that work. We do not do it. The rest of this page is about the other audit.
What does an AI audit actually cover?
The counting method behind it, which you can run yourself in an afternoon, is in how much of my business can actually be automated. A real AI audit looks at how work actually flows through your business and finds the leaks. It maps your recurring processes, identifies which ones consume skilled time on repetitive work, estimates the cost of each in hours and dollars, and assesses which are genuinely automatable with today's AI. The output isn't a vague "you should use more AI" but a specific, prioritized list of workflows worth automating, with the expected return on each. It answers "where exactly should we start, and what's it worth?"
What it does not cover is worth stating as well. An opportunity audit does not review your models for bias, certify anything against a standard, or produce a security assessment, and it does not reach above the level of the work itself into company strategy. It also does not need access to your systems. What it needs is somebody who can describe what arrives, who touches it, and where it ends up.
Why does diagnosis come before building?
Diagnosis comes before building because the abandonment rate on AI work that skipped it is documented and high. S&P Global Market Intelligence's 2025 survey of more than 1,000 enterprises across North America and Europe found that 42% of companies had abandoned most of their AI initiatives, against 17% the year before, and that organizations were discarding an average of 46% of their AI proofs of concept before they reached production. Cost, data privacy and security came up as the barriers.
For a smaller operation the lesson is narrower than the headline. Almost none of that work stopped because the technology could not do the job. It stopped because nobody had established what the work was worth before it started, so there was no figure to defend when the bill arrived. An audit produces that figure first, and it also produces the decision not to build, which is worth having early rather than after a pilot.
Measure first, build second. The audit is what makes the building worth it, and it is why we quantify the opportunity before anyone agrees to build anything.
What do you get from an AI audit?
A useful audit leaves you with three things: a map of where your business is losing time to manual work, a prioritized list of the highest-return automation opportunities, and an estimate of what each is costing and what automating it would save. With that, you can make an informed decision about what to build, or decide the return isn't there yet, which is also valuable. Either way, you're no longer guessing.
The form of the output matters as much as the content. A useful audit hands back a shortlist with a figure against each line, in the order it makes sense to build them, with a note on what each system would have to connect to. A weak one hands back a list of technologies and a phase diagram. The test is whether you could take the output to a second firm and get a comparable quote out of it.
How do you run an AI opportunity audit yourself?
You can run a rough version of the opportunity audit yourself in an afternoon, and it is worth doing before you speak to anybody. Four steps, and the order matters, because each one narrows the list the step before produced.
| Step | What you do | What it produces |
|---|---|---|
| 1. List the recurring work | Write down every task somebody does weekly or more often that involves reading, typing or moving information | A list, usually longer than expected |
| 2. Time it honestly | Ask the person who does the task, not the person who describes it | Hours a week against each line |
| 3. Cost it | Multiply the hours by what an hour of that person actually costs you, then by fifty-two | A yearly figure against each line |
| 4. Score what a system could reach | Mark each line on whether the input already sits in a system, whether the steps are written down, and whether the exceptions are few and known | A shortlist of what is worth building |
That shortlist with a figure beside each line is most of what an audit is. Arrive at a conversation holding one and the conversation starts at what to build rather than at what is expensive.
Two things are easy to get wrong. The loaded cost of an hour runs well above the wage on the payslip, so a figure built on salary alone understates every line, and the method with the figures behind it is in how much time and money AI automation actually saves. And the task that annoys people most is rarely the task with the highest volume, which is the one worth building.
What actually happens during an AI audit?
An AI audit with us starts as a thirty-minute strategy call. We go through how your business actually runs and find where the hours and the money leak out, put a number on each one, and you leave knowing what to fix first, what it is worth in hours or revenue, and roughly how long it would take to build.
The call goes better when the person on it is the one who actually does the task rather than the person who describes it. What we want to know is what arrives, who touches it, what gets retyped and where it ends up. That level of detail is the difference between a leak you can put a number on and a hunch.
Putting the number on it is arithmetic rather than judgement: hours a week, multiplied by what an hour really costs you, multiplied by fifty-two. An hour costs more than the wage on the payslip, and the gap is wider than most owners expect, so the method and the figures behind it are worth reading in how much time and money AI automation actually saves.
Nothing gets built during the audit and nothing gets bought. The build only starts once the audit has said what is worth building, and its timeline is agreed in the roadmap rather than quoted before anyone has looked at the workflow. Week by week, from this first call to a workflow actually running, is set out in how long AI automation takes to implement.
Does your business need an AI audit?
Your business needs an AI audit if any of these are true: you know AI should be helping but don't know where to start; you've bought AI tools that nobody really uses; your team spends visible time on repetitive manual work; or you're about to invest in automation and want to make sure it's aimed at the right thing. You probably don't need one if you already know exactly which workflow to automate and its value. In that case, you can go straight to building.
There is also a case against doing one right now. If the process you have in mind is still changing every month, or the volume is too low for the arithmetic to work, the audit will tell you so and you will have spent the time to hear it. That is a better outcome than a build you abandon, but it is worth knowing that answer is on the table before you book anything.
What did an audit find in a real operation?
The audit found a leak nobody had put a number on. Before we built anything for the 3D-scanning lab at Universidad Maimonides, we diagnosed it: a recurring manual data workflow consuming about fifteen hours a week of skilled research time. That diagnosis is what made the build worth it: we knew exactly what the cost was and what removing it would return before writing a line of code. The audit-first approach is why the system delivered a clear, measurable result rather than being AI for its own sake.
What the diagnosis measured was narrow on purpose: how many files arrived, how long one of them took to handle by hand, and how much of that a system could reach. Fifteen hours a week of skilled research time, against a workflow that was reachable because the data already arrived as files rather than on paper. That is the shape of a first system worth building.
Frequently asked questions
Is an AI audit the same as an AI compliance or governance audit?
No. A governance audit examines AI systems a company already runs and asks whether they behave fairly, whether the data behind them was collected and held lawfully, and whether a decision can be explained to somebody outside the company. It is usually commissioned because a regulator, a large customer's security review or a board asked for it. The audit described on this page looks at your operation instead, to find the manual work worth automating. If a compliance questionnaire is what sent you looking, a risk or assurance firm is who you want rather than us.
How long does an AI audit take?
Ours starts as a thirty-minute strategy call. You leave knowing which parts of your operation a system could carry, what each one is worth in hours or revenue, and roughly how long each would take to build. Nothing gets built or bought during it, and the timeline for the build that follows is agreed in the roadmap rather than quoted in advance.
What standards is an AI governance audit run against?
Mostly two. ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system and it is certifiable, so an accredited body can audit you against it and issue a certificate. The NIST AI Risk Management Framework, published in 2023, is voluntary and carries no certificate, so it gets used to organize the work rather than to pass an assessment. State and sector rules sit on top of both. That work belongs to a risk or assurance firm rather than to us.
How do I run an AI audit myself?
In four steps. List every task somebody does weekly or more often that involves reading, typing or moving information. Ask the person who does each one how long it actually takes. Multiply those hours by what an hour of that person costs you, then by fifty-two. Then mark each line on whether the input already sits in a system, whether the steps are written down, and whether the exceptions are few. What you are left with is a shortlist with a figure beside each line, which is most of what an audit produces.
What is an AI audit for a business?
A structured assessment of where AI could save your business time and money: mapping your recurring workflows, finding the ones worth automating, estimating their cost, and prioritizing by return. It's the diagnosis step that happens before any building, so effort goes to the highest-value opportunities.
What does an AI audit include?
A map of where your business loses time to manual work, a prioritized list of the highest-return automation opportunities, and an estimate of what each costs and what automating it would save. The output is specific and actionable, not a vague recommendation to "use more AI."
Does my business need an AI audit?
Likely yes if you know AI should help but don't know where to start, you've bought AI tools nobody uses, your team does visible repetitive manual work, or you're about to invest in automation. You may not need one if you already know exactly which workflow to automate and what it's worth.
Why do an AI audit before building or buying AI?
Because the most expensive AI mistake is building or buying before knowing where the value is. An audit ensures budget and effort go to workflows with real return rather than exciting-but-pointless experiments. Measure first, build second.
How is an AI audit different from just trying AI tools?
Trying tools is guessing; an audit is diagnosis. Tools show you features; an audit shows you where those features would actually create value in your specific operation, prioritized by return. It's the difference between hoping AI helps and knowing where it will.
Related resources
Want to know where AI would actually help you?
We start every engagement by finding and quantifying the leak, then turn it into a roadmap of what to build and in what order. Our engineering team builds it, it lives on our infrastructure, and we own the result from there.