PaperlayerView exact revision on arXiv

Source-linked AI summary

Auditing of AI: Legal, Ethical and Technical Approaches

Jakob Mokander

arXiv:2407.06235v1cs.CYcs.AI

TL;DR

AI auditing is growing, but shared definitions and standards remain unsettled, and empirical study of audit feasibility and effectiveness is limited. This review synthesizes prior work and concludes that complementary approaches should be linked in structured procedures.

  • Problem

    AI auditing lacks a shared understanding and widely used standards, making claims that systems have been audited difficult to verify.

    Source: §2 · p. 4

  • Method

    The article reviews previous work on AI auditing and distinguishes technology-oriented assessments from process-oriented assessments of providers’ quality management systems.

    Source: §1 · p. 4, §6 · p. 21

  • Results

    The review identifies lessons from established audit fields, a need for research on feasibility and effectiveness, and complementary multidisciplinary approaches to AI auditing.

    Source: §6 · p. 21

  • Takeaways & Limitations

    The next step should be to interlink available technology- and process-oriented tools into structured, independent audit procedures.

    Source: §1 · p. 4

    Independent auditors may struggle to hold technology providers accountable where sector-specific legislation is absent, because providers can refuse access to data and models.

    Source: §4.4 · p. 18

Abstract

from arXiv · show

AI auditing is a rapidly growing field of research and practice. This review article, which doubles as an editorial to Digital Societys topical collection on Auditing of AI, provides an overview of previous work in the field. Three key points emerge from the review. First, contemporary attempts to audit AI systems have much to learn from how audits have historically been structured and conducted in areas like financial accounting, safety engineering and the social sciences. Second, both policymakers and technology providers have an interest in promoting auditing as an AI governance mechanism. Academic researchers can thus fill an important role by studying the feasibility and effectiveness of different AI auditing procedures. Third, AI auditing is an inherently multidisciplinary undertaking, to which substantial contributions have been made by computer scientists and engineers as well as social scientists, philosophers, legal scholars and industry practitioners. Reflecting this diversity of perspectives, different approaches to AI auditing have different affordances and constraints. Specifically, a distinction can be made between technology-oriented audits, which focus on the properties and capabilities of AI systems, and process oriented audits, which focus on technology providers governance structures and quality management systems. The next step in the evolution of auditing as an AI governance mechanism, this article concludes, should be the interlinking of these available (and complementary) approaches into structured and holistic procedures to audit not only how AI systems are designed and used but also how they impact users, societies and the natural environment in applied settings over time.

1 Introduction

This review frames AI auditing as a growing but conceptually diverse field, and argues that its development can draw on established audit practice, empirical research, and complementary approaches. It distinguishes assessments of AI systems from assessments of providers’ governance processes.

1 Introduction

  • Auditing can examine AI systems’ technical performance and their alignment with organisational policies and regulations, but the financial-audit analogy has limits.The article calls for a more precise account of AI auditing’s functional and operational components.Source: §1 · p. 2
  • AI auditing is a recent but multidisciplinary field with links to software development, product testing, verification, and several academic disciplines.The literature is described as relatively scarce in explicit empirical study but rich in its connections across domains.Source: §1 · p. 3
  • Contemporary AI audits have much to learn from how audits have been structured and conducted in financial accounting, safety engineering, and the social sciences.The review presents this as one of three general points, rather than a summary of the topical collection’s individual articles.Source: §1 · p. 3
  • Policymakers and technology providers both have interests in promoting AI auditing, leaving researchers to study the feasibility and effectiveness of procedures in practice.Regulatory pressures and voluntary initiatives reflect different needs, including managing social challenges and reputational or technology-related risks.Source: §1 · pp. 2–3
  • Technology-oriented audits assess AI outputs for different inputs, while process-oriented audits assess providers’ quality management systems; the approaches seldom engage with each other.The article argues that effective procedures need elements of both and should interlink existing tools and methods.Source: §1 · p. 4

2 The evolution of auditing as a governance mechanism

The section traces auditing across governance contexts and draws lessons for AI auditing: established procedures can inform practice, but their purposes, institutional supports, and limitations differ.

2 The evolution of auditing as a governance mechanism

  • AI auditing’s ambiguous meaning and lack of widely used standards make claims that a system has been audited difficult to verify and may potentially exacerbate harms.The review turns to historical uses of auditing to clarify the term’s different meanings and practices.Source: §2 · p. 4

2.1 Financial audits

  • Financial auditing shifted from checking past transactions against baselines toward risk-based assessment of organisational processes, while systematised audits can promote trust through transparency and regularity.Auditing is also described as a “ritual of verification” whose primary function is to produce comfort, rather than solely to examine potential fraud.Source: §2.1 · p. 5

2.2 Safety audits

  • Safety audits use complementary tools and methods, depend on institutional backing, and highlight how organisational culture and nontechnical factors matter to system safety.They can reduce but not eliminate incident risk, may become box-ticking exercises, and often depend on auditees’ cooperation for evidence access.Source: §2.2 · pp. 6–7

2.3 Audit studies in the social sciences

  • Social-science audit studies use randomized field experiments to examine behaviour and social processes, including discrimination associated with AI systems.The review also notes contrasting motivations: activist research may seek to expose inequality, while industry audits aim to produce comfort.Source: §2.3 · pp. 7–8

3 The need to audit AI systems – a confluence of top-down and bottom-up pressures

AI auditing responds to intersecting regulatory and normative pressures from outside and voluntary risk-management incentives within technology providers. The section argues that audits can support legal compliance and corporate governance, while their practical effectiveness remains a question for academic research.

3 The need to audit AI systems – a confluence of top-down and bottom-up pressures

  • Regulatory mandates and normative expectations combine with providers’ voluntary risk-management measures to increase the need for AI audits.Policymakers seek to manage AI’s ethical and social challenges while preserving innovation; providers seek to address reputational and technology-related risks.Source: §3 · p. 8, §3.1 · p. 11

3.1 Auditing as a mechanism to implement legislation

  • Audits give regulators a structured way to assess whether AI systems meet legal requirements, including technical robustness and legal compliance.The section cites the EU AI Act’s conformity assessments for high-risk systems and New York City’s independent audit requirement for certain employment-related systems.Source: §3.1 · pp. 10–11

3.2 The role of AI auditing in corporate governance

  • By assessing capabilities and limitations before deployment, audits can help providers identify risks early and provide a basis for accountability.The cited estimate says fixing an AI-system bug during testing can cost up to 15 times more than fixing it during deployment.Source: §3.2 · p. 12
  • Providers also face reputational and financial incentives to audit ethical aspects, although provider-commissioned audits raise independence and verification concerns.The section notes voluntary ethics audits and concerns that provider claims are hard to verify without agreed standards.Source: §3.2 · pp. 12–13
  • Whether AI audits are feasible and effective in practice remains a question for academic researchers.The section says its purpose is to identify stakeholders’ interests in promoting audits, not to assess their merits as a governance mechanism.Source: §3.2 · p. 13

4 Auditing of AI’s multidisciplinary foundations

The review presents AI auditing as a heterogeneous, multidisciplinary field with distinct but complementary ways to define and conduct audits. It distinguishes impact-oriented from process-oriented approaches, technical, legal and ethics-based baselines, and research that proposes, applies or evaluates audit procedures.

4.1 The AI auditing literature

  • AI auditing is a structured assessment of an entity’s behavior against predefined standards, and its literature spans varied contributions and academic disciplines.The reviewed work includes academic publications, commercial tools, industry standards and policy documents, with contributions from fields including computer science, engineering, law, social science and philosophy.Source: §4.1 · pp. 13–14

4.2 Narrow vs broad conceptions of auditing of AI systems

  • Narrow audits probe system outputs, while broad audits assess providers’ development processes; the approaches are compatible and can reinforce one another.Narrow testing can proceed without provider cooperation, whereas broad audits can examine how procedures affect system design and deployment.Source: §4.2 · pp. 14–16

4.3 Technical, legal and ethics-based approaches

  • Technical, legal and ethics-based audits use different baselines and focal points, but are best understood as complementary approaches on a continuum.The section describes technical audits of system properties, legal audits of regulatory compliance and ethics-based audits against voluntary principles.Source: §4.3 · pp. 16–17

4.4 Who audits the auditors?

  • Research spans arguments for audits, procedure and tool development, empirical use of audits, and investigation of their feasibility and effectiveness.The review notes that claims about auditing’s limitations, like claims about its affordances, have yet to be substantiated by empirical research.Source: §4.4 · pp. 17–19

5 In this topical collection

The collection addresses the gap between AI-auditing principles and practice by highlighting contributions that document audit challenges and best practices. It responds to a field lacking established standards and empirical evidence on the feasibility and effectiveness of auditing procedures.

Collection overview

  • The collection frames three contributions as practice-facing responses to the principles-practice gap, documenting challenges and best practices in designing and conducting AI audits.Source: §5 · p. 19

Algorithmic bias and risk assessments

  • Hasan et al. (2022) use four years of cross-industry audit experience to frame AI within socio-technical systems and pair broad ethical-risk with narrow technical-bias assessments.They identify combining available methods into holistic, structured procedures as a future research avenue.Source: §5 · p. 19

DRESS-eAI

  • Felländer et al. (2022) propose DRESS-eAI, an ISO 31000:2009-based, six-phase risk methodology, and provide detailed implementation guidance for organizations assessing ethical AI.The guidance covers activities in each phase and is intended to help organizations ensure and demonstrate adherence to predefined principles.Source: §5 · p. 19

Z-Inspection

  • Z-Inspection evaluates trustworthiness across an AI system’s lifecycle through expert deliberation on ethical issues in socio-technical scenarios, though it is time-consuming and requires subject-matter expertise.It gives developers and users a structured way to address specific ethical issues in applied settings.Source: §5 · pp. 19–20

Continuous auditing

  • Minkkinen et al. (2022) define continuous AI auditing as near-real-time, automated auditor support for checking norm compliance, suited to risks from autonomous or learning systems in dynamic environments.Source: §5 · p. 20

Self-synchronisation of ethical principles

  • Light and Panai (2022) argue that independent, structured audits can support self-synchronisation among diverse AI ethics principles while preserving plural ethical approaches.They connect procedural transparency, regularity, and verifiability with an infrastructure of trust among providers, users, and society.Source: §5 · p. 20

Railway technology

  • Gesmann-Nuissl and Kunitz (2022) propose extensive testing rather than analytical verification for railway AI, auditing design and deployment processes to address opacity and functional-safety requirements.They argue the procedure is consistent with EU AIA conformity assessments and existing software-development standards.Source: §5 · pp. 20–21

6 Concluding remarks

The review concludes that AI audits should draw on established audit practices, that researchers should study their feasibility and effectiveness, and that auditing approaches are complementary. It calls for structured, holistic procedures while cautioning that AI auditing has intrinsic and addressable limitations.

6 Concluding remarks

  • AI audits have much to learn from established audit practice; translational research has adapted continuous-audit practices from financial and IT auditing to AI.Minkkinen et al. (2022) provide an example of this translational approach.Source: §6 · p. 21
  • Researchers should study the feasibility and effectiveness of audit procedures, including their affordances, constraints, and applied implementation challenges.Hasan et al. (2022), Felländer et al. (2022), and Vetter et al. (2023) document these considerations.Source: §6 · p. 21
  • Legal, ethical, and technical approaches to AI auditing are complementary; legal compliance audits can rely on technical methods to gather evidence.Technical robustness and legal compliance may also be prerequisites for considering an AI system trustworthy.Source: §6 · p. 21
  • Effective procedures should be structured and transparent, define material scope and a normative baseline, combine technology and process assessments, monitor continuously, and use independent third-party auditors.The recommendations cover both assessments of AI decision-making systems and assessments of the organizations that design and deploy them.Source: §6 · p. 22
  • Even when following best practices, AI auditing faces conceptual, technical, economic, and institutional limitations, some addressable and others intrinsic.The review urges policymakers, researchers, and auditors to remain cautious and realistic about what auditing can achieve.Source: §6 · p. 22
Loading 2407.06235v1…