AI adoption in organizations is running ahead of its assurance, and the distance is growing. A recent global survey of internal audit leaders confirms it. Auditing AI systems remains a relatively low priority in audit plans, precisely as corporate adoption accelerates. The study itself expects this to change as organizations need more assurance over these new risks.
Meanwhile, two things have happened that make that gap unsustainable.
Shadow AI, the adoption that never went through the committee
The first is shadow AI, the use of AI tools and agents by employees and business areas without the technology function's sanction. The study already warned about it. Many employees are likely using AI independently, raising data security and privacy risks and bringing unreliable information into the organization, and in response it called for stronger governance and guardrails.
With agentic AI the problem changes category. An agent does not just generate text, it acts. It sends emails, queries systems and chains operations with valid credentials. A shadow agent with excessive permissions is a privileged user with no owner, no inventory and no log.
The regulatory calendar is delayed, not gone
The second is regulatory, with a recent twist. On 29 June 2026 the Council of the EU approved the Digital Omnibus package, postponing the EU AI Act obligations for stand-alone high-risk systems from 2 August 2026 to 2 December 2027 (August 2028 for AI embedded in products). One thing does not move. The Article 50 transparency obligations, which cover informing people when they interact with an AI and labelling generated content, still apply from 2 August 2026. And in financial services, DORA has required since January 2025 an ICT risk management regime that reaches AI systems, covering risk classification, access controls, audit logs and third-party assessment.
The question "do we need to audit AI?" still has a calendar answer. The delay buys compliance time, but it does not reduce the risk, which is being deployed today.
Criteria that already exist, from principles to work program
There is no need to invent the framework from scratch. The trusted AI principles used by reference frameworks (fairness, transparency, explainability, accountability, data integrity, reliability, security, privacy) are audit criteria in waiting, because each translates into verifiable control questions. And the NIST AI RMF organizes AI risk management into four functions (govern, map, measure and manage) that map naturally onto the internal audit work cycle.
Agents are not audited with screenshots. They are audited with an inventory, verifiable limits and a record of every run that captures the context, the instructions, the tools invoked and the actions taken.
The auditor's agenda for the next two quarters
- Inventory of agents and AI usage, including the unauthorized. Without a census there is no auditable universe, and shadow AI is governed first by making it visible.
- Risk classification aligned with the AI Act, identifying which systems touch decisions about people, money or critical infrastructure.
- Verifiable limits in the form of action budgets, allowed tools and human approval for irreversible operations. They must be enforced technically, not just written in a policy.
- Audit-proof records of every run, retained and protected like any other critical record.
The underlying risk map is already known. Effective versus formal authorization, traceability of reasoning, behavioural drift and the cognitive supply chain. What separates prepared teams from the rest is having turned it into a work program. And the room the new calendar grants is exactly for that, not for postponing it.
