October 20, 2026
Assessing an organization against technologies based on artificial intelligence involves either evaluating internal processes, verifying technical models, or formally attesting compliance. For a management team, what matters most is allocating resources and procuring services that are connected to the real state of operations.
The Natural Sequence of Assessments
Before choosing a type of audit, a company has an interest in following a logical sequence of stages.
- Readiness Audit: Performed first, before any major purchase or internal development.
- Governance & Security Audit: Carried out in the design and integration phase, establishing access rules, data owners, and control barriers.
- Model & AI Systems Audit: Performed in a test environment and at the production launch, verifying accuracy, performance, and technical resilience.
- Formal Compliance Assessment or Certification (ISO 42001 / EU AI Act): Takes place last, on a system that is already stable, documented, and supervised.
Attempting a certification audit or a formal compliance assessment without a readiness audit and without functioning governance may force the organization to rebuild its data architecture from the ground up during the external verification.
Readiness Audit versus AI Systems Audit
The object, timing, and legal purpose separate the readiness assessment from the systems audit.
The Readiness Audit is forward-looking. Its analysis covers the organization as a whole: the quality of data sources, the maturity of business processes, the level of employee literacy, and the clarity of internal roles and responsibilities. Conducted before massive investments are committed, this audit determines whether the company has the infrastructure needed to adopt generative or predictive systems. The result is a staged action plan, designed to remove process bottlenecks and identify integration priorities.
The AI Systems Audit is anchored in the present. Its object is the models, applications, and automated flows that are in production or ready for launch. Its purpose is the rigorous verification of technical performance, cybersecurity, and the capacity for human oversight. The result is a register of findings classified by severity, accompanied by remediation measures and designated owners.
Specialized Types of Audit
As the use of technology advances, assessment divides into specific functional areas.
- Security Audit: Analyzes infrastructure configurations, data access permissions, API exposure, and the system's resistance to prompt injection attacks or data exfiltration.
- Model Audit: Evaluates the algorithmic parameters of the system. It includes verifying bias, the explainability of decisions, and the model's robustness against incomplete data.
- Governance Audit: Examines decision-making structures, internal policies, data flows, and the existence of real human approval points (human-in-the-loop).
- ISO/IEC 42001:2023 Certification Audit: Verifies whether the Artificial Intelligence Management System (AIMS) meets the requirements of the international standard.
Conformity Assessment under the EU AI Act: The Regulatory Framework
Regulation (EU) 2024/1689 imposes conformity assessment procedures for systems classified as high-risk. Understanding this framework requires integrating the legislative and technical updates adopted in 2026.
The Application Calendar and Regulation (EU) 2026/1744
The simplification package adopted through Regulation (EU) 2026/1744 (Digital Omnibus on AI) amended the initial calendars. The compliance obligations for stand-alone high-risk systems listed in Annex III become applicable from December 2, 2027, providing an additional sixteen months to prepare documentation and quality systems.
Conformity Assessment
- Internal control: The provider assesses conformity itself, based on the legal requirements and harmonised standards. This is the route that applies to most stand-alone systems in Annex III.
- Assessment by a notified body (Annex VII): An independent third-party auditor verifies the system and the processes. For the biometric systems in Annex III point 1, the provider may choose between internal control and this route if it has applied the harmonised standards; assessment by a notified body becomes mandatory if the standards do not exist, have not been applied, or have been applied only in part.
- Systems embedded in regulated products (Annex I): Medical devices follow the procedure in their sectoral legislation (the Medical Devices Regulation), and Article 43(3) adds an assessment of the quality management system under Article 17 and the application of certain points of Annex VII. Machinery (Regulation (EU) 2023/1230) was moved by Regulation (EU) 2026/1744 to Section B of Annex I: Article 43 no longer applies to it, and the requirements for AI are to be integrated into the machinery regulation.
The First Harmonised Standard: EN 18286:2026
The standard EN 18286:2026 (Artificial intelligence – Quality management system for EU AI Act regulatory purposes) was cited in the Official Journal of the European Union through Commission Implementing Decision (EU) 2026/2274 of October 12, 2026, published in the Official Journal on October 14, 2026. It is the first harmonised standard that details how a provider of high-risk systems builds the Quality Management System required by Article 17 of the Regulation.
As for its legal effects, although the Commission Decision has been adopted, the exact scope of the presumption of conformity offered by EN 18286 remains open to interpretation: Article 40(1) grants the presumption of conformity for the essential requirements in Section 2 of Chapter III (Articles 8–15), while Article 17 sits in Section 3. The European Commission and CEN-CENELEC nevertheless communicate that the standard offers a presumption of conformity for the requirements of Article 17 that it covers. The application of harmonised standards remains at the organizations' discretion.
The Independence Rule in Consulting and Auditing
An essential rule when procuring assessment services is the strict separation between consulting and certification auditing.
Under ISO/IEC 17021-1 (clause 5.2.5), a certification body and the entities under its organizational control may not offer management system consultancy. A provider that designs a company's governance architecture cannot be, for the same organization, the body that certifies it.
For an organization, this means the path is split into two distinct roles: the governance consultant who helps with mapping, design, and preparation, and the accredited body that comes afterwards to carry out the independent assessment.
A Practical Guide for SMEs: Which Audit to Use, When, and Why
For an SME with limited resources, going through every type of audit may be a waste. The selection must strictly follow the development phase and the real exposure.
Operational Maturity Axes for SMEs
| Phase | Type of assessment |
|---|---|
| Decision Phase | Readiness Audit |
| Integration Phase | Governance & Security Audit |
| Production Phase | AI Systems Audit |
| Tender / Requirements | ISO 42001 or Conformity Assessment |
1. The Starting Phase: The Readiness Audit
- Why it is done: A small company risks buying licenses or developing a tool on top of uncleaned data and without clear permissions.
- How it helps: It identifies whether internal sources contain unprotected personal data and determines whether the desired solution has a real ROI before a contract is signed.
- The risk of ignoring it: Capital allocated to software that stays unused or that exposes commercial data to public models.
2. The Adoption Phase: The Governance and Security Audit
- Why it is done: Most SMEs already have AI applications used informally by employees (Shadow AI).
- How it helps: It sets a simple usage policy, blocks the entry of trade secrets into public chats, and creates a minimal register of active tools.
- The risk of ignoring it: Unintentional exfiltration of intellectual property and possible breach of the security obligations under Article 32 of the GDPR, where unmanaged applications process personal data without measures appropriate to the risk.
3. The Phase of Provider or User of High-Risk Systems: Conformity Assessment
- Why it is done: If an SME uses a recruitment platform that automatically filters CVs, or develops such a system, it falls under the legal requirements of the EU AI Act for high-risk systems.
- How it helps: It allows the company to ask the software provider for proof of conformity or, if it develops its own system, to structure its Quality Management System according to EN 18286 (Article 17) and to build its Technical Documentation according to the requirements of Article 11 and Annex IV.
- The risk of ignoring it: Being shut out of enterprise tenders where large clients ask for proof of conformity, and exposure to inspections by the authorities once national legislation enters into force.
Choosing the right moment and the right type of assessment allows companies to protect their information assets and meet market requirements without burdening daily operations.
References and Regulatory Framework
- ISO/IEC 42001:2023: Information technology — Artificial intelligence — Management system (Clauses 4-10 and Annex A with its 38 controls grouped into 9 areas).
- Commission Implementing Decision (EU) 2026/2274 of October 12, 2026: Citation of the harmonised standard EN 18286:2026 in the Official Journal of the European Union (published on October 14, 2026).
- Regulation (EU) 2024/1689 (EU AI Act): Article 11 (Technical documentation), Article 17 (Quality management system), Article 40, Article 43, Annex IV, Annex VI and Annex VII.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI): Postponement of the Annex III deadlines to December 2, 2027; transfer of Regulation (EU) 2023/1230 on machinery to Annex I Section B.
- ISO/IEC 17021-1: Requirements for bodies providing audit and certification of management systems (the independence rule, clause 5.2.5).