In short
The word “audit” is used loosely in AI. Sometimes it means a discovery exercise: walking through how enquiries, bookings, quotes and admin flow through the business, and ranking where AI could help. Sometimes it means checking AI already in use: which tools staff rely on, what data they see, how outputs are checked and whether the tools are worth what they cost. Agree which one you are buying before it starts.
What an opportunity audit looks at
| Processes | How each key job runs today, step by step, including the exceptions and hand-offs. |
|---|---|
| Systems | The CRM, phone system, diary, accounts and other tools, and where data is re-typed between them. |
| Volumes and timings | Call and enquiry volumes, response times and hours spent on repetitive tasks. |
| People | Who does the work, who would own a new tool, and where skills are thin. |
| Output | A ranked list of opportunities by impact and effort, which can become a roadmap. |
What a governance audit looks at
An audit of AI already in use starts with an inventory: every AI tool in the business, including features built into software you already pay for and free tools staff have adopted on their own. For each, it records what data goes in, who the supplier is, what the contract says about storage and model training, and who is responsible for it.
It then checks controls. Is there a lawful basis under UK GDPR for any personal data involved, and has a data protection impact assessment been done where the risk calls for one? Are people told when AI is used? Is there a rule about when a person must check the output, and is anyone monitoring accuracy over time?
Frameworks can help structure this. The ICO publishes guidance on AI and data protection and an AI and data protection risk toolkit. ISO/IEC 42001, published in 2023, is an international standard for AI management systems, and the US National Institute of Standards and Technology (NIST) publishes an AI Risk Management Framework. A small business rarely needs formal certification, but these documents are useful checklists.
How an audit usually runs
Expect a mix of interviews with the people who do the work, a look at the systems themselves, and a review of whatever data exists, such as call logs or CRM reports. For a small business this can take a few days of the auditor’s time spread over two to four weeks, depending on how many teams and systems are involved.
The useful output is short: findings, a ranked list of actions and the risks that need attention first. A long report that nobody acts on is the most common way audits fail.
How to prepare
Decide what you most want from the audit before it starts: a list of opportunities, a check on risk, or both. Name one person on your side to arrange interviews and access to systems.
Gather a list of the software you pay for, rough monthly volumes of calls and enquiries, and any process notes that exist. Tell staff what the audit is for, so they describe the work as it really happens. Ask them which AI tools they already use, and make clear this is to understand the picture and not to catch anyone out.
When this matters
Relevant before a first AI investment, or when AI tools have spread through the business without a plan. New Era AI’s Discover stage is an opportunity audit with UK GDPR considerations built in, and it becomes the 12-month roadmap. This page is general guidance, not legal advice.
Questions
Is an AI audit a legal requirement?
Not as such for most UK businesses. UK GDPR does require you to assess and document certain processing, including a DPIA for high-risk processing, and an audit is a practical way to meet those duties. Take legal advice for your situation.
How is an AI audit different from a readiness assessment?
A readiness assessment is usually a quick self-scored questionnaire. An audit looks at your processes, systems and data directly, and produces specific findings and actions.
Do we need ISO/IEC 42001 certification?
Most small businesses do not. Some larger customers may ask about it in procurement. The standard is still a useful reference for structuring AI governance.