AI Assurance Directory

An AI audit evidence checklist for regulated programs

Published · Updated · 5 min read

Informational only, not professional or legal advice. Facts are linked to the source we checked; statuses can change after the date above.

Auditors differ, but the evidence they ask for converges. This checklist groups artifacts by what they prove and cites the source that expects each one. It is a starting point, not a substitute for the requirements that apply to your program. A printable checkbox version is on the checklists page.

ISO says certification, where an organization chooses it, is performed by independent certification bodies, so ISO-oriented evidence is read by auditors as well as internal reviewers.

Status as of 14 October 2026 (re-verified on ISO’s explained page): the standard does not replace laws or regulations, Certification for ISO/IEC 42001 is voluntary, and ISO does not certify organizations. The evidence rows below are unchanged.

How to read it: “NIST” rows use AI RMF subcategories as listed in NIST’s crosswalk to ISO/IEC 42001, which also gives the ISO clause references. The crosswalk targets the final draft of the standard, so check clause numbers against the published version.

1. Governance and accountability

Evidence Why it is asked for Source
Inventory of AI systems AI RMF Govern 1.6 expects mechanisms to inventory AI systems; the crosswalk points to ISO B.4.2 to B.4.6 NIST crosswalk
Legal and regulatory requirements register Govern 1.1: legal and regulatory requirements involving AI are understood, managed and documented NIST crosswalk
Roles and responsibilities Govern 2.1: roles, responsibilities and lines of communication are documented NIST crosswalk
AI policy and management review records Govern 2.3 maps to ISO 5.1, 5.2 and 9.3 in the crosswalk NIST crosswalk
Internal audit programme and results Measure 1.3 maps to ISO 9.2.2 internal audit programme NIST crosswalk
Supplier and third-party AI records Govern 6.1 maps to ISO B.10.2 and B.10.3 allocating responsibilities and suppliers NIST crosswalk

2. Risk and intended use

Evidence Why it is asked for Source
AI risk assessment and treatment records Govern 1.3 maps to ISO 6.1.1 to 6.1.3 in the crosswalk NIST crosswalk
Intended purpose and deployment context Map 1.1: intended purposes, uses and prospective settings are understood and documented NIST crosswalk
Impact assessments Map 1.1 maps to ISO B.5.2 to B.5.5 impact assessment NIST crosswalk
Defined uses and lifecycle testing scope DoD’s Reliable principle: explicit, well-defined uses, with safety, security and effectiveness tested within those uses across the life-cycle DoD AI principles

3. Data and model evidence

Evidence Why it is asked for Source
Operational design domain definition EASA: a correct and complete ODD definition is a prerequisite to an adequate level of quality of the data sets EASA
Data sources and data quality requirements EASA objective DM-01: identify data sources and collect data in accordance with the defined ODD while ensuring data quality requirements are satisfied. DoD’s Traceable principle expects auditable methodologies, data sources and design procedures EASA, DoD
Evidence of training, validation and test data independence EASA bases learning assurance on three separate and independent data sets EASA
Test sets, metrics and test tool details Measure 2.1: test sets, metrics and details about the tools used during TEVV are documented NIST crosswalk
Verification and validation results Maps to ISO B.6.2.4 verification and validation NIST crosswalk
Documented limits of generalizability Measure 2.5: limitations of generalizability beyond the development conditions are documented NIST crosswalk

4. Documentation and records

Evidence Why it is asked for Source
Technical documentation EU AI Act Article 11 (high-risk systems): drawn up before the system is placed on the market and kept up to date; ISO B.6.2.7 in the crosswalk EU AI Act, NIST crosswalk
Event logs EU AI Act Article 12: automatic recording of events over the lifetime of the system; Measure 2.4 maps to ISO B.6.2.8 event logs EU AI Act, NIST crosswalk
Record retention EU AI Act Article 18: documentation kept for 10 years after the high-risk system is placed on the market or put into service EU AI Act

5. Operation, monitoring and corrective action

Evidence Why it is asked for Source
Production monitoring records Measure 2.4: functionality and behavior are monitored when in production NIST crosswalk
Post-deployment monitoring and incident plans Manage 4.1 covers post-deployment monitoring plans, including incident response NIST crosswalk
Nonconformity and corrective action records Manage 2.3 maps to ISO 10.2 nonconformity and corrective action NIST crosswalk
Ability to disengage or deactivate DoD’s Governable principle: ability to disengage or deactivate deployed systems that demonstrate unintended behavior DoD AI principles

6. If the system touches CUI

Evidence Why it is asked for Source
System security plan covering each AI component and service provider Use of an external service provider and its services documented in the SSP and described in the provider’s service description and CRM 32 CFR 170.16
FedRAMP Moderate authorization or equivalence evidence for cloud AI services FedRAMP Authorized at Moderate or higher, or equivalent 32 CFR 170.16
Evidence organized for examine, interview and test NIST SP 800-171A defines three assessment methods: examine, interview and test NIST SP 800-171A

Level 2 and Level 3 are different requirement sets and assessment paths. See CMMC Level 2 vs Level 3 for AI systems.

7. Aviation-specific

Certification evidence for airborne AI is project-specific. The FAA says project-specific issue papers and special conditions document the criteria. The artifacts above are inputs to that conversation, not a replacement for it. See DO-178C and ML gaps and How to map an AI model to DO-178C / DO-330 tool qualification.

Using this list

Analysis, not sourced fact: sort the artifacts by who will read them. Evidence for a certification authority needs traceability to requirements and data; evidence for an ISO 42001 certification body needs management-system records; evidence for a CMMC assessment needs system-scoping and control implementation records. One artifact can serve more than one reader if it is written to be traceable.

Sources

  1. NIST AI RMF to ISO/IEC FDIS 42001 crosswalk - NIST AI Resource Center
  2. ISO 42001 explained: what it is - ISO
  3. Regulation (EU) 2024/1689 - consolidated text (27.07.2026) - EUR-Lex
  4. EASA Concept Paper Issue 02 - Guidance for Level 1 & 2 machine learning applications - EASA
  5. NIST SP 800-171A - Assessing Security Requirements for CUI - NIST
  6. 32 CFR 170.16 - CMMC Level 2 self-assessment and affirmation requirements - eCFR
  7. DOD Adopts Ethical Principles for Artificial Intelligence - Department of War
  8. Roadmap for Artificial Intelligence Safety Assurance, Version I - FAA

Free next step: take the AI assurance readiness self-check or create a free account. Quoted evidence stays on Pro.