What does an EU AI Act audit look like?

The EU AI Act has no procedure called an audit: the nearest is the check under Article 43 that a high-risk AI system meets the Act's requirements before it is placed on the market or put into service. After that come a notified body's audits for some providers, authorities' requests for documentation and customers' contracts.

Written and last checked 9 October 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Does the EU AI Act require an audit?

Not under that name. It requires a conformity assessment of a high-risk AI system, "the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled" (Article 3, point (20)). The provider must "ensure that the high-risk AI system undergoes the relevant conformity assessment procedure as referred to in Article 43, prior to its being placed on the market or put into service" (Article 16, point (f)). Other systems have none.

The word audit appears in four operative provisions: a notified body's periodic audits (point 5.3 of Annex VII), "testing or auditing procedures" (Article 74(13), point (b)), the confidentiality of "inspections, investigations or audits" (Article 78(1), point (b)) and the auditors the AI Office may appoint (Article 75a(7), as inserted by Regulation (EU) 2026/1744).

How does a conformity assessment run?

Article 43 sets the procedure per system. For Annex III, points 2 to 8, it is internal control under Annex VI, "which does not provide for the involvement of a notified body" (Article 43(2)); a delegated act under Article 43(6) could move them to Annex VII, and none is in our pinned sources. A biometric system under point 1 may use either annex where harmonised standards or common specifications were applied, and must use Annex VII in the four cases Article 43(1) lists, with the market surveillance authority as notified body for some public-sector uses. A product under Section A of Annex I follows that legislation's procedure, with parts of Annex VII (Article 43(3), as replaced). The conformity assessment guide sets out each route in full.

Under internal control the provider checks its own quality management system against Article 17, its technical documentation against Section 2, and their consistency with design, development and post-market monitoring (Annex VI, points 2 to 4). Under Annex VII a notified body assesses both (points 3 and 4), with access to the data sets where relevant and necessary and, as a last resort on a reasoned request, to the trained models.

Article 43 sits in Chapter III, Section 5, which keeps 2 August 2026; the duty in Article 16, point (f) sits in Section 3, from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as replaced). How Section 5 operates before the classification rules apply is open.

Where are the audits?

Under Annex VII, the approved quality management system stays under the notified body's surveillance, "to make sure that the provider duly complies with the terms and conditions of the approved quality management system" (point 5.1). The provider gives it access to the premises of design, development and testing and all necessary information (point 5.2). Then: "The notified body shall carry out periodic audits to make sure that the provider maintains and applies the quality management system and shall provide the provider with an audit report. In the context of those audits, the notified body may carry out additional tests of the AI systems for which a Union technical documentation assessment certificate was issued." (point 5.3)

Article 43(3), as replaced, applies point 5 to systems under Section A of Annex I too; how, where that legislation lets the manufacturer opt out of a third-party assessment, it does not say.

Who can ask for your documentation once the system is in use?

Market surveillance authorities, under Regulation (EU) 2019/1020 (Article 74(1)). "[T]he market surveillance authorities shall be granted full access by providers to the documentation as well as the training, validation and testing data sets used for the development of high-risk AI systems", where relevant and limited to what is necessary (Article 74(12)). Source code needs "a reasoned request" and both conditions of Article 74(13): "access to source code is necessary to assess the conformity of a high-risk AI system with the requirements set out in Chapter III, Section 2", and "testing or auditing procedures and verifications based on the data and documentation provided by the provider have been exhausted or proved insufficient".

On a reasoned request a competent authority can ask the provider for "all the information and documentation necessary to demonstrate the conformity of the high-risk AI system with the requirements set out in Section 2", and for the logs under its control (Article 21(1) and (2)). Deployers "shall cooperate with the relevant competent authorities in any action those authorities take in relation to the high-risk AI system in order to implement this Regulation" (Article 26(12)).

Bodies enforcing fundamental rights law may request documentation from the market surveillance authority where access is necessary for their mandates, and the authority shall grant it, where necessary by requesting it from the provider or deployer (Article 77(1) and (1a), as replaced and inserted). For some systems, among them one built on a general-purpose AI model from the same provider or undertaking, the AI Office supervises the provider instead, and the deployer only where it is also the provider or part of the same undertaking, with the exceptions Article 75(1), as replaced, sets.

What must you keep ready?

The provider keeps at the disposal of the national competent authorities, "for a period ending 10 years after the high-risk AI system has been placed on the market or put into service", the technical documentation, the quality management system documentation, where applicable the changes approved by notified bodies and their decisions and other documents, and the EU declaration of conformity (Article 18(1)). Financial institutions keep the technical documentation with their financial services records (Article 18(3)).

Logs under your control are kept "for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in the applicable Union or national law, in particular in Union law on the protection of personal data" by providers (Article 19(1)), and on the same terms by deployers (Article 26(6)). The Annex IV checklist lists its contents. These duties, in Chapter III, Sections 2 and 3, take the dates in Article 113, third paragraph, point (c), as replaced.

What does a customer's audit ask?

Whatever its contract says: the Act sets no customer questionnaire, but it does require a written agreement between a high-risk system's provider and its suppliers. The provider of a high-risk AI system and a third party that supplies "an AI system, AI model, tools, services, components, or processes that are used or integrated in a high-risk AI system" agree in writing on "the necessary information, capabilities, technical access and other assistance" the provider needs to comply (Article 25(4), as replaced), except for tools, services, processes or components, other than general-purpose AI models, made public under a free and open-source licence. The supplier questionnaire guide covers answering.

What does Complipath do here, and what does it not?

Complipath does not run a conformity assessment. Its full EU AI Act audit report marks each system's requirements Met, Partly, Not met or n/a from your own records, and calls itself a self-assessment, not a certification or a legal opinion. The audit pack is one file for a customer's security review or an auditor: every system with its classification and article, the requirements and their evidence, the AI literacy record and the audit log, with a fingerprint. For a customer's questionnaire, Audits marks each question Ready, Needs proof or Gap; a locked version carries only answers a person confirmed. All three are in Starter and the trial. Everything Complipath does today is listed; how the tools compare is separate.

What this means for you

If you're a provider: find each system's procedure: a biometric system under point 1 of Annex III or a product under Section A of Annex I can bring a notified body and its periodic audits. Either way, keep the Article 18(1) documents and logs ready.

If you're a deployer: no conformity assessment is yours unless Article 25(1) makes you the provider; an authority can ask for your cooperation (Article 26(12)), and you keep the logs under your control for at least six months, unless other law provides otherwise (Article 26(6)).

FAQ

Is there an official EU AI Act audit? No procedure has that name. A high-risk system goes through a conformity assessment under Article 43 before it is placed on the market or put into service. Where a notified body is involved under Annex VII, it then audits the provider's approved quality management system periodically and gives the provider an audit report (point 5.3).

Who can inspect our AI documentation? Market surveillance authorities get full access to a provider's documentation and its training, validation and testing data sets where relevant and limited to what is necessary (Article 74(12)), and to source code only on a reasoned request under the two conditions of Article 74(13). Any competent authority can ask on a reasoned request (Article 21(1)).

How long must we keep AI Act documentation? A provider keeps its technical documentation, quality management system documentation, notified body decisions and approved changes where applicable, and EU declaration of conformity until ten years after the system is placed on the market or put into service (Article 18(1)). Logs under your control: at least six months, unless other law provides otherwise (Articles 19(1) and 26(6)).

Does a customer's AI audit follow the Act? No. Its questions and any audit right come from your contract. The Act requires a contract of its own here: a high-risk system's provider and a third party supplying an AI system, AI model, tools, services, components or processes used or integrated in it agree in writing on the information and assistance the provider needs (Article 25(4), as replaced).

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Article 3, point (20), Article 16, Article 18, Article 19, Article 21, Article 25, Article 26, Article 43, Article 74, Article 75, Article 77, Article 78, Article 113, Annex I, Annex III, Annex VI and Annex VII; as amended by Regulation (EU) 2026/1744 (EUR-Lex), which replaced Article 25(4), first subparagraph, Article 43(3), Article 75(1), Article 77(1) and Article 113, third paragraph, point (c); it also inserted Article 75a and Article 77(1a).

Where this question meets the product: the AI Act audit report. Answering it in a customer's questionnaire: how to answer AI questions in a supplier questionnaire. The feature that does this in the app: AI Act technical documentation software. Tools ranked on it: Best Annex IV documentation software. Everything else: every live Complipath feature.