Book a free consultation

AI in ISO Management System Audits – What Will Your Auditor Ask?

Table of Contents

AI in ISO management system audits – what your auditor will ask

AI in ISO Management System Audits: What Will Your Auditor Ask?

Many organisations are now using AI in their day-to-day work, often in processes already covered by their management system. Your auditor will want to know about it.

In May 2026, the ISO 9001 Auditing Practices Group (APG) published guidance for auditors on organisations that use AI systems [1]. The APG is an informal group of experts from ISO/TC 176 and the International Accreditation Forum (IAF), and its papers explain how auditors should approach ISO 9001 conformity audits.

The paper is written for ISO 9001. However, in our view you should expect the same AI questions when you’re audited against other ISO management system standards, such as ISO 14001, ISO 45001 and ISO/IEC 27001. They share the same high-level structure, and the same AI tools often sit across all of them.

I’m seeing clients go well beyond off-the-shelf AI tools. They’re building internal tools with AI, handing critical process steps to AI applications and agents, and even setting up their own AI servers to automate standardised, high-volume tasks. Often this happens before they’ve considered how it fits into their management system.

What the APG paper says about AI

The paper’s starting point is that AI needs auditors to build new knowledge, but it doesn’t need new audit methods or a change to the audit objectives [1]. It describes AI systems as “advanced tools with high potential for both improvement and abuse”.

It gives examples of where AI is found in a quality management system, including design, supplier evaluation, chatbots, predictive maintenance, inspection, forecasting, training and compliance alerts.

Before the audit, the auditor should find out whether you use AI in any process within your scope, and who is responsible for it. During the audit, they should look for evidence that AI isn’t adversely affecting conformity, process control or your objectives.

How far the auditor goes depends on the use case. The paper’s examples are a sales forecasting tool, which affects planning and resources, and a customer chatbot, which directly affects customer satisfaction.

The paper also points out that AI isn’t like conventional software. An AI system is made up of models, data, infrastructure and a user interface, and these can change over time. Because AI can drift or produce biased outputs, conventional quality controls may not be enough on their own.

Guidance vs requirement

Requirement: ISO 9001 has no separate AI clause. The existing requirements apply to processes that use AI.

Guidance: The APG paper [1] is useful, but it isn’t audit criteria and hasn’t been endorsed by ISO, ISO/TC 176 or IAF.

Our view: It’s a good preview of the questions you can expect, whichever standard you’re certified to.

What your auditor will ask, clause by clause

The paper lists questions for each clause. We’ve paraphrased the main ones below. The paper notes the list isn’t exhaustive and should be applied based on your use case [1].

  • Clause 4 Context: Have you considered AI in your internal and external issues, customer and legal requirements (e.g. privacy and data protection), and the people affected by AI decisions?
  • Clause 5 Leadership: Does top management take accountability for AI, promote its responsible use, and assign roles such as data ownership, monitoring and interpreting outputs?
  • Clause 6 Planning: Have you addressed risks such as bias, inaccurate outputs, model drift and overreliance on automated decisions, and planned human oversight and contingencies if the AI fails?
  • Clause 7 Support: Are the people using AI competent and aware of its limitations? Where traceability matters, do your records cover data sources, model versions and AI outputs used in decisions?
  • Clause 8 Operation: Are AI outputs validated before use, are changes to AI controlled, and were external AI providers evaluated? Where AI influences product release, safety or regulatory reporting, have you decided if human review is needed?
  • Clauses 9 and 10 Evaluation and improvement: Do you monitor AI performance, include it in internal audits and management review, and record and address AI-related nonconformities and complaints?

Don’t upload ISO standards to AI tools

This one is easy to overlook. The paper says auditors should obtain evidence that intellectual property is respected, including that ISO standards and other copyrighted material aren’t uploaded to AI systems [1].

Make your rules on this clear to staff, and include them in your AI policy and training.

Your auditor needs to understand AI too

The paper expects auditors to have competence in AI concepts, AI risks such as drift and bias, data quality, how AI changes process controls, and the legal and ethical issues. It’s reasonable to ask your certification body how its auditors meet this.

How to prepare

  • Know where you use AI: List the AI tools used in processes within your scope, and who owns each one.
  • Focus on impact: Put the most control around AI that affects conformity, safety, customers or compliance.
  • Update your risk and context: Include AI in your issues, legal requirements and risk register.
  • Decide on human review: Be clear where a person must check AI outputs before they’re used.
  • Treat AI changes as changes: Control tool and model updates, and evaluate AI suppliers.
  • Review it: Cover AI in internal audits and management review.

Finally, remember an auditor won’t rely on documents alone, as I explained in It’s More Than Just an Audit Checklist. Expect them to talk to the people using the AI.

Our view on AI governance

The paper’s questions match the approach in our own AI Governance Policy, which draws on ISO/IEC 27001 and ISO/IEC 42001.

Where AI use is significant, ISO/IEC 42001 [3] provides a dedicated AI management system standard that can be integrated with your existing system. For AI security threats, ISO/IEC 27090:2026 [4] gives guidance on detecting and managing them. The APG paper doesn’t mention either standard; this is our recommendation. You can also read our thoughts on the impact of AI on ISO management system consulting.

Final Thoughts

AI doesn’t change what an audit is for. What changes is where the auditor looks. So, if your auditor asked tomorrow how your AI is controlled, could you show them?

Speak with Us about your Audit Needs

DBell Consulting helps WA organisations bring AI into their management systems and prepare for certification audits. Speak with us to discuss your audit needs, or please visit our Contact Us page.

References

  1. Guidance on: Auditing a Quality Management System that uses Artificial Intelligence (AI) systems. ISO 9001 Auditing Practices Group. Edition 1, 29 May 2026. committee.iso.org (PDF). Other APG papers, including Auditing digital processes: ISO 9001 Auditing Practices Group.
  2. ISO 9001:2026 – Quality management systems – Requirements. Published 16 September 2026. iso.org. ISO 9001:2015 remains in force during the transition.
  3. ISO/IEC 42001:2023 – Information technology – Artificial intelligence – Management system. iso.org.
  4. ISO/IEC 27090:2026 – Cybersecurity – Artificial intelligence (AI) – Addressing security threats and compromises to AI systems. Published 14 October 2026. iso.org.

The paper also suggests ISO/IEC 22989 (AI concepts and terminology) and ISO/IEC 23894 (AI risk management) as further reading.

How this article uses its sources

Source and status note: We’ve paraphrased the APG paper [1], not reproduced it.

  • APG guidance: Non-definitive guidance for ISO 9001 auditors. It isn’t audit criteria and hasn’t been endorsed by ISO, ISO/TC 176 or IAF.
  • DBC commentary: Applying the paper to other ISO standards, the preparation list and the ISO/IEC 42001 and 27090 section are our professional opinion.

Accessing Official copies of ISO Standards

ISO management system standards are protected by copyright, with reproduction subject to certain restrictions. This includes the standards being subject to licensed purchasing via the ISO website and approved distributors. If you require a copy of these standards, visit the ISO website, or follow the below links for specific standards:

Share the Post:
Related Posts