AI Governance Auditing Checklist for 2026

AI governance auditing tests whether the controls a company wrote down match what its AI systems do. The four checks below cover what an auditor opens and compares, the Three Lines Model shows who owns each part, and the evidence checklist lists what to log and keep.

What is AI governance auditing?

AI governance auditing is an independent test of whether an organization's AI controls work and are backed by evidence. It covers who owns each system, who can access it, what gets logged, and which framework each control maps to.

Superblocks' assessment covers 28 questions across 7 assessment domains, and it gives a control a 2 or a 3 only when a named artifact backs it up. Its AI governance guide covers the controls an audit would test.

An audit needs records to test. Superblocks' documentation guide describes an audit logs and access records artifact that shows who accessed what data, when, and under which policy decision. A policy document states intent, and the log shows what happened.

A technical AI audit is a different exercise. It validates that the model performs as designed, and the IIA framework places that pre-deployment testing with end users and AI or data science professionals.

A governance audit checks the organization around the model, meaning its ownership, access, evidence, and framework mapping. The IIA's AI Auditing Framework covers that work through its Governance, Management, and Internal Audit domains.

What separates an AI governance audit from a technical AI audit?

The main difference between an AI governance audit and a technical AI audit is what gets tested. A governance audit tests controls and evidence, and a technical audit tests model behavior.

Run both. If you don't have an inventory yet, start with the governance audit, because a model nobody registered doesn't reach a technical test.

Why AI governance auditing matters

Without logs, a written policy can't be shown to work, and for high-risk systems the EU AI Act makes logs a legal duty. Article 12 says they "shall technically allow for the automatic recording of events (logs) over the lifetime of the system."

Article 19 adds a retention period of at least six months, unless other Union or national law says otherwise.

The Commission's timeline applies the Annex III high-risk rules on 2 December 2027 and the Annex I rules on 2 August 2028.

The timeline also mentions the Digital Omnibus on AI, which amended parts of the Act. The Article 12 page now shows a consolidated version as of 27 July 2026, and marks changed passages “NEW” or “AMENDED.” Articles 12, 14, and 19 carry no such mark, so the logging, oversight, and retention duties cited here stand, but check the current text for your system before you rely on it.

Superblocks puts a first documentation set at 4 to 8 weeks, so the work starts before the audit date. Its AI risk management guide covers the risk side.

The 4 checks in an AI governance audit

The four checks below cover the controls an auditor can verify with a register, a log, an evidence file, or a mapping table.

1. AI inventory completeness

The IIA framework has the inventory name, who manages and oversees each AI in use, shadow tools included. It also asks the inventory to record each AI's goal and its users, plus the tools and risk considerations involved.

Superblocks' oversight guide adds a coverage metric, counting how many systems are registered and how many turned up outside intake. A difference between the two counts shows how much AI runs outside intake.

2. Access and identity controls

The access log should show who reached which AI system and data, and which policy decision allowed it. The user identity on each log record, covered in the evidence checklist below, ties that access to a person.

What that decision looks like depends on the access model. In NIST's definition, RBAC ties permitted actions to roles instead of individual identities, so the log would point to a role.

ABAC decides each request by checking attributes of the subject and the object against policies and environment conditions, so the log would point to attributes and conditions.

3. Policy versus evidence

An audit tests each commitment in the written policy against a matching artifact, such as a log export, an approval record, or a signed review.

To score that match, Superblocks' 28-question assessment uses a 0 to 3 scale (Not in place, Ad hoc, Defined, or Enforced and evidenced), and the audit applies it to each control. A 2 or a 3 needs a named artifact you could hand an auditor today, and a 0 or a 1 doesn't have one.

4. Framework mapping

In the audit file, each control is mapped to a named requirement in NIST AI RMF, ISO/IEC 42001, the IIA's AI Auditing Framework, or the EU AI Act.

To show that, the audit file needs one row per control, with the framework clause, the supporting artifact, and the owner side by side. A row with an empty clause has nothing to be measured against, and a requirement with no row has no control behind it.

Who owns what in an AI governance audit under the Three Lines Model

Under the IIA's Three Lines Model, management is the first line, the functions that provide expertise, monitoring, and challenge on risk are the second, and internal audit is the third.

The IIA's AI framework refers to this model. Under it, the governing body oversees management (first and second lines), and internal audit gives independent assurance and advice (third line).

Take a change to a model as an example. In Superblocks' oversight matrix, the system owner (first line) approves changes to their own system, and internal audit stays independent of that decision.

That independence is what lets internal audit do its own job, which is to test whether controls work the way the policy says they do.

Frameworks an AI governance audit maps to

An audit takes its criteria from three frameworks, NIST AI RMF, ISO/IEC 42001, and the IIA's AI Auditing Framework, and from one law, the EU AI Act.

The EU AI Act is the one binding source. Its Articles 12 and 19 set the logging and retention rules for high-risk systems.

What to log and retain for an AI governance audit

Superblocks' AI audit trail guide lists 7 log items. Each row pairs one with the reason an auditor asks for it.

Keep high-risk system logs for at least six months, per Article 19, unless other Union or national law sets a different period.

The documentation guide lists 7 artifacts to keep around the logs. They are a governance policy, an AI system inventory, risk and impact assessments, data and model provenance, audit logs and access records, review and update procedures, and one central system of record.

Review the set at least quarterly, so the records stay current with the systems they describe.

How to run an AI governance audit in 6 steps

Each step below feeds the next, so the order matters. The inventory decides what gets ranked, the framework mapping decides what evidence to request, and that evidence decides each score. 

1. Create the inventory. List each AI system with its goal, users, manager, tools, risks, and overseer, and keep the list current, as the IIA framework advises.
2. Rank systems by risk, as Superblocks' assessment does in its risk classification domain. Put the systems that fall under the EU AI Act's high-risk categories first, then the ones that handle sensitive data or affect people.
3. Map controls to a framework. Write one row per control with the clause and the owner.
4. Request the evidence. Pull the 7 log categories and the policy artifacts for each ranked system, and add the artifact to each control's row.
5. Score every control from 0 to 3, using the scale from Superblocks' assessment. Require a named artifact for a 2 or a 3.
6. Report open issues with an owner and a date, then schedule the next review.

Run these steps first on the system at the top of that ranking. Superblocks' AI governance guide makes starting small step 3 of its 4 steps, ahead of tooling for scale.

How Superblocks supports AI governance auditing

Superblocks is a platform where business teams generate AI apps that run on company data, and IT and Security set the integrations and permissions.

The plan decides which of these controls you get. Teams costs $125 per month, billed monthly, with RBAC and up to 15 builders included. Audit Logs, SSO / SAML / OIDC, Hybrid / VPC Deployment, and the Admin MCP are Enterprise features.

• Audit Logs (Enterprise) record builder and end-user activity plus integration and platform changes. The docs group events into five types, account change, authentication, entity management, user access, and app lifecycle.

• The Admin MCP (Enterprise) lets administrators work with builders, applications, integrations, permissions, audit logs, queries, and usage events from AI coding agents. Building or editing apps from Claude is a different feature, Superblocks in Claude.
  
  Through that access, Superblocks says a suspicious query can be traced to the app it came from, the integration it hit, and the builder who last modified that app.

• RBAC (Teams) works at two levels. Organization roles control which platform features members can access, and resource roles grant permissions on a specific resource such as an application or integration.

• With Hybrid / VPC Deployment (Enterprise), Superblocks can run inside your AWS virtual private cloud. Its launch post says your data, code, applications, and model processing stay within your existing security perimeter.
  
  Its pricing page lists "Deploy in your VPC (Hybrid or Cloud Prem)" without naming a cloud.

The Clark AI agent generates apps on the platform. Superblocks' GDPR guide says the platform restricts it to your existing user permissions, so an app reaches data the person running it could already see.

If you want to check these features against your own audit scope, Superblocks offers a demo.

Frequently asked questions

What is AI governance auditing?

AI governance auditing is an independent test of whether an organization's AI controls work and are backed by evidence. Auditors check the inventory, access logs, written policies, and supporting evidence against a framework such as NIST AI RMF or ISO/IEC 42001.

What are the four pillars of AI governance?

The four pillars in Superblocks' AI governance guide are fairness and bias control, transparency and explainability, accountability, and privacy and security-first design.

Its AI governance principles guide goes wider, listing 9 principles that it says recur across OECD, NIST, ISO, and UNESCO. Pillar counts vary by source, and the next answer covers a separate six-pillar set for apps generated with AI.

What are the six pillars of vibe coding governance?

The six pillars vary by source. For AI-generated apps, Superblocks’ vibe coding governance guide lists six pillars: clear ownership for every app, centralized visibility and an audit trail, safeguards during development, data classification before generation, review and governed deployment, and automatic standards enforcement.

How is AI being used in auditing?

Internal auditors use AI to draft scoping memos and audit announcements, turn walkthrough transcripts into documents, summarize questionnaire responses, and produce first drafts of reports, according to the IIA. Auditing AI systems, the subject of this guide, is a separate job.

Which Superblocks features support AI governance auditing?

Superblocks documents Audit Logs and RBAC as platform features. RBAC is included in Teams, while Audit Logs and the Admin MCP are in the Enterprise plan.