What is a customer audit of your AI, and how do you get ready for one?

How an audit differs from a questionnaire

• A questionnaire asks what you do. You answer it once, usually in the customer's own Excel or Word file.
• An audit checks that the answers hold. The customer asks for the proof: the classification, the requirement and the document behind an answer, with who confirmed it and when.
• In Complipath both start from the same record: the answer you confirmed in the questionnaire is the answer the audit checks.

How do you prepare for a customer's AI audit?

Make every answer you have already given traceable to a record before the customer asks. A customer's audit checks that what you told the customer holds, and its scope comes from the audit clause in your contract, not from the Act.

• What the customer asks for: in practice, the questionnaire you returned or the list in the contract, with a request for the proof behind each answer.
• Expect follow-up on the answers the purchase rested on: which systems use AI, how each is classified, what people are told and who reviews outputs.

Which evidence, for each answer:

• The system it covers, its classification, the article the class rests on, and the date a person confirmed it.
• The document behind the control, such as a policy, a procedure, a screenshot or a log extract, each with its date.
• Who confirmed the answer, and when.
• For a transparency answer, where the notice appears, because Article 50(5) requires the information to reach the person in a clear and distinguishable manner at the latest at the time of the first interaction or exposure.
• For a high-risk system, the instructions for use that Article 13(2) requires to accompany it, and the logs under your control, kept "for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in the applicable Union or national law" (Article 19(1)).

What changes between the questionnaire and the audit?

• A questionnaire accepts a statement; an audit asks for the record behind it.
• An answer marked Implemented with nothing to attach is the first one to fall.
• The audit also reads old answers against today: a control may have changed, a system may have been added, and the law may have moved.
• Article 4 was replaced with effect from 27 July 2026, so a literacy answer written earlier was written against wording that no longer applies.
• Re-read every answer before you send evidence, and correct an outdated one yourself.

Articles 13 and 19 apply from 2 December 2027 for a system high-risk under Annex III and from 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)), and not to high-risk AI systems related to products under Section B of Annex I (Article 2(2), as replaced).

• What the Act adds: where your customer is the provider of a high-risk system and you supply an AI system, AI model, tools, services, components or processes used or integrated in it, Article 25(4), as replaced, requires a written agreement on the necessary information, capabilities, technical access and other assistance, so that the provider can fully comply with the Regulation.
• It does not apply to third parties making tools, services, processes or components, other than general-purpose AI models, accessible to the public under a free and open-source licence.
• Read what you agreed before the audit starts.

What Complipath does when the audit arrives

• The audit room, on Starter and up: drop the customer's file and name the customer. Complipath answers what it already knows from your earlier audits, your data answers and your register, each answer with its source, and only short questions are left for you.
• Answers from your connections, on Starter and up: questions about which AI vendors and models you use, whether people are told it is AI or whether personal data reaches a model are drafted from what your connections read, labelled with the tool and the day, and stay drafts until a person confirms them.
• The answer library, on Starter and up: every answer you confirm is kept with the customer and the date, the next audit starts with it, and an answer that no longer matches your data answers is marked as changed.
• Their format, on Starter and up: your confirmed answers written into the customer's own Excel or Word file, keeping their layout, beside the report and a ZIP of the evidence.

What you hand over

• The audit report: every answer, its source and who confirmed it, as PDF or Word, with a part for management and what changed since the last signed version.
• The audit pack: one file with every classification, citation and confirmation, for someone outside your company.
• The audit log: who did what in the workspace, and when, as a list you can read and export.

With the customer, on Growth

• A shared audit room: one link per person with an end date and Revoke, what they may see, a code by email if you want one, what they opened and their questions answered under the audit.
• A gap plan from their requirements: the customer's questionnaire turned into their requirements, marked Met, Partial or Gap from your confirmed answers, and each gap a step on your plan when you press it.
• Your Trust Center: a page your customers can open any time, with files they ask for released only after your yes, on a seven-day link.

What it does not do

• It does not decide whether a customer is satisfied. The customer decides; Complipath gives you the record and the proof.
• It is not a certification, and not a conformity assessment under Article 43.
• A question outside what you have confirmed is marked Needs your answer, never guessed.