audit
Technical and procedural review for governance compliance.
How the laws define this
Both instruments agree that an audit is a review or evaluation process designed to verify compliance by determining whether specified criteria or requirements are fulfilled. However, they diverge in their operational focus and scope. Portaria CNJ nº 270/2025 (Portaria designating the members of the National Committee on Artificial Intelligence of the Judiciary - Comitê Nacional de Inteligência Artificial do Judiciário) defines an audit as a technical and procedural review focused directly on an individual AI system, examining its data, model behavior, documentation, and operational controls to verify compliance with governance, privacy, security, and fairness rules, either periodically or triggered by incidents or reclassification. In contrast, ISO/IEC 42006:2025 — Information technology — Artificial intelligence — Requirements for bodies providing audit and certification of artificial intelligence management systems frames the audit as a systematic, independent, and documented process for obtaining objective evidence, concentrating on evaluating an organization's adherence to overall AI management system requirements.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
What it triggers
Definitions (2)
A technical and procedural review conducted to verify an AI system's compliance with governance, privacy, security, and fairness requirements, including examination of data, model behavior, documentation and operational controls; audits may be periodic or triggered by reclassification or incidents.
An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. For AIMS, this involves assessing an organization's adherence to AI management system requirements.
Not to be confused with
AI auditing refers to processes examining AI systems for ethics, accuracy, and compliance, while audit here is a specific technical and procedural review or systematic process for compliance verification.
Auditability of the AI system is the capacity to evaluate algorithms, data, and design or undergo audits, whereas audit is the actual review process itself.
Questions and answers
What triggers an AI audit under Brazilian rules?
Audits may be periodic or triggered by reclassification or incidents. They verify compliance with governance, privacy, security, and fairness requirements.
How do AI audits differ in focus between Brazil and ISO?
The Brazilian definition emphasizes examination of data, models, documentation, and controls for various requirements, while ISO focuses on evidence evaluation for management system adherence.
Related Terms
AI Auditing
Processes for examining AI systems for ethics, accuracy, and compliance....
AI Impact Assessment (AIA)
Pre‑deployment assessment of risks and mitigation measures....
Auditability of the AI system
Capacity to evaluate algorithms, data, and design or undergo audits....
AI Impact Assessment
Documented risk and harms analysis before AI deployment....
third‑party AI assurance
Independent evaluation services by external organisations....