AI adoption in organizations is running ahead of its assurance, and the distance is growing. A recent global survey of internal audit leaders confirms it: auditing AI systems remains a relatively low priority in audit plans, precisely as corporate adoption accelerates — something the study itself expects to change as organizations need more assurance over these new risks.
Meanwhile, two things have happened that make that gap unsustainable.
Shadow AI: the adoption that never went through the committee
The first is shadow AI: the use of AI tools and agents by employees and business areas without the technology function's sanction. The study already warned about it — many employees are likely using AI independently, raising data security and privacy risks and bringing unreliable information into the organization — and called for stronger governance and guardrails in response.
With agentic AI the problem changes category: an agent does not just generate text, it acts — sends emails, queries systems, chains operations with valid credentials. A shadow agent with excessive permissions is a privileged user with no owner, no inventory and no log.
The regulatory calendar: August 2026
The second is regulatory. The EU AI Act obligations for high-risk systems take effect on 2 August 2026; prohibitions and AI literacy duties have applied since 2025, and obligations for general-purpose models since August 2025. In financial services, DORA has required since January 2025 an ICT risk management regime that reaches AI systems: risk classification, access controls, audit logs and third-party assessment.
The question "do we need to audit AI?" is no longer answered by risk appetite: it is answered by a calendar.
Criteria that already exist: from principles to work program
There is no need to invent the framework from scratch. The trusted AI principles used by reference frameworks — fairness, transparency, explainability, accountability, data integrity, reliability, security, privacy — are audit criteria in waiting: each translates into verifiable control questions. And the NIST AI RMF organizes AI risk management into four functions — govern, map, measure, manage — that map naturally onto the internal audit work cycle.
Agents are not audited with screenshots. They are audited with an inventory, verifiable limits and a record of every run: context, instructions, tools invoked and actions taken.
The auditor's agenda for the next two quarters
- Inventory of agents and AI usage — including the unauthorized. Without a census there is no auditable universe; shadow AI is governed first by making it visible.
- Risk classification aligned with the AI Act: which systems touch decisions about people, money or critical infrastructure.
- Verifiable limits: action budgets, allowed tools, human approval for irreversible operations — enforced technically, not just written in a policy.
- Audit-proof records of every run, retained and protected like any other critical record.
On the underlying risk map — effective authorization, traceability of reasoning, behavioural drift, the cognitive supply chain — we wrote in detail in The technology risks of AI agents. This is its practical continuation: the time to turn that map into a work program is before August.