What Is an AI Audit? What It Covers and What It Costs

An AI audit reviews where AI could help your business, how safely you already use it, or both: workflows, the AI tools staff use, data flows, accuracy, supplier terms, customer disclosures and spend. A do-it-yourself audit costs staff time only; a paid audit is priced on days of work, so compare quotes by days and deliverables.

The phrase covers different jobs, and the price depends on which one you're buying. An opportunity audit asks where AI could save time. A usage and risk audit asks what AI is already in use, what data goes where and what could go wrong. A spend audit asks which AI subscriptions are paid for and actually used. Formal certification against a standard is a fourth, rarer job. Most small businesses need the second and third far more than they realise, because staff adopted AI long before anyone wrote a policy.

Follow me on Instagram@sagnikteaches

Four jobs sold under the name "AI audit"

You can run the first and third yourself with a spreadsheet and some honesty; auditing your workflows for AI opportunities yourself and auditing your AI subscriptions show how. The usage and risk audit is where outside eyes add most, because the people doing the work are the ones who took the shortcuts. The rest of this tutorial concentrates on it.

Connect on LinkedInSagnik Bhattacharya

A spend audit doesn't always cut the bill, and it's worth knowing that before you start. A seven-person sports equipment shop found four staff expensing personal ChatGPT Plus subscriptions at $20 a month each, plus an AI copywriting tool nobody had opened in 60 days. Cancelling the copywriting tool saved money. Moving the four chat users to ChatGPT Business, where business data isn't used for training by default and an administrator controls the accounts, cost $25 a seat on monthly billing or $20 a seat billed annually: on annual billing, the same $80 a month the four personal subscriptions had cost. The audit's value was control over customer data and leavers' accounts, not a smaller invoice.

Subscribe on YouTube@codingliquids

What a usage and risk audit covers, item by item

An inventory of every AI tool in use

Include the official ones and the unofficial ones: free chat accounts, browser extensions, AI features switched on inside existing software, meeting note-takers that join calls, AI steps inside automations. The unofficial list is usually longer. A short anonymous survey ("which AI tools have you used for work in the last month?") gets more honest answers than asking in a meeting.

Where the data goes

For each tool, what goes in (customer names, order details, health or dietary information, staff data, supplier prices) and under which kind of account. Business plans such as ChatGPT Business, Claude Team, Microsoft 365 Copilot and Gemini in Workspace don't train on business content by default. Consumer plans let each user switch off training in their privacy settings, but nobody checks whether every member of staff has done so. Vendors also change defaults: since June 2026, for example, a therapy-notes tool opted new users in by default to keeping de-identified transcripts. An audit re-checks settings rather than trusting last year's answers, and it considers your duties under data-protection law such as the GDPR where personal data is involved.

Accuracy where it matters

Sample real outputs, not demos: 20 to 50 recent AI-assisted emails, product descriptions, chatbot conversations or summaries. Count errors by type. The audit cares most about outputs that reach customers without a person checking them.

Supplier terms and supplier risk

Who owns outputs, how long prompts are kept, what happens to your data if the tool closes. That last point is not hypothetical. The AI calendar tool Clockwise shut down in March 2026 and deleted user data rather than transferring it. OpenAI closed its Sora video app in April 2026 and the Sora API in September. OpenAI is switching off custom GPTs on 11 December 2026. An audit notes which of your processes depend on a single supplier and whether you could export your data tomorrow.

What customers are told

If you sell to customers in the EU, the AI Act's transparency duties have applied since 2 August 2026: people must be told when they're talking to a chatbot, and AI-generated or deepfake content must be labelled. The audit also checks for uses the Act bans outright, such as AI that infers employees' or job applicants' emotions, and flags uses it treats as high-risk, such as screening job applicants, whose main obligations were deferred to 2 December 2027. For a definitive view on your position, ask a qualified adviser.

Automations and accounts nobody owns

Zaps, scenarios and flows built by someone who has since left, running on their personal login. These are both a risk and a hidden cost, and they tend to break at the worst moment.

A food truck business audited in an afternoon

Scale matters less than people think. A two-truck street food business with a catering side and six staff ran a usage and risk audit in about four hours of the owner's time and one hour of the catering manager's. What turned up:

1. Customer data in a personal account. The catering manager drafted replies to event enquiries with a free chat assistant on a personal login, pasting in client names, venue addresses and guests' dietary and medical notes. Training was still switched on in that account's settings.
2. An allergen claim in a sent email. A search of sent catering emails found one AI-drafted reply stating "our satay sauce is nut-free". The recipe contains peanuts. The draft had turned "can be made without the satay" into a claim about the sauce, and nobody caught it.
3. Photos that oversold the food. AI-enhanced menu photos on the delivery apps showed noticeably larger portions than served. Over two months, the owner found nine refund requests that mentioned portion size.
4. Three overlapping subscriptions. Two personal chat subscriptions expensed at $20 a month each, plus an AI caption tool at $15 a month used by nobody since spring: $55 a month.
5. An orphaned automation. The Zap that posts each day's truck locations to social media ran on a former employee's Zapier account and email address.

The inventory sheet that produced those findings was one simple table, filled in during a 20-minute conversation with each person:

Copy the columns as they are. "Account" and "Reaches customers?" are the two that turn a list of apps into a list of risks.

The fixes took about a week. One business chat account with training off by default replaced the personal ones. A written rule went up in the prep area and in the shared inbox: allergen answers come only from the signed-off allergen sheet, never from an AI draft, and any enquiry mentioning allergies goes to the owner. The photos were reshot on a phone without enhancement. The caption tool was cancelled. The location Zap was rebuilt in an account the business owns. The owner now repeats a 30-minute version of the check every quarter. Of the five findings, the allergen claim was the one that could have hurt someone; it is also the kind of error that only shows up when somebody actually reads the output.

Checking output accuracy with a sample and a second pair of eyes

Reading 50 outputs by hand is slow, and an AI assistant can pre-screen them, as long as a person makes the final call. A prompt for screening customer emails against your own rules:

Below are [number] customer emails sent by my business, followed by
our rules. For each email, check every factual claim against the
rules. Flag any email that: states something about allergens,
ingredients, prices, refunds or delivery dates that the rules don't
support; promises anything the rules don't allow; or includes
another customer's details. For each flag, quote the exact sentence
and the rule it breaks. If an email has no problems, say "OK".

Rules: [paste allergen sheet summary, price list, refund policy]
Emails: [paste, with customer names replaced by placeholders]

In an illustrative run on the food business's 30 sampled emails, the assistant flagged four, including a quoted delivery time the rules didn't cover and a price from last season's menu. It marked the satay email "OK", because the draft said "nut-free" about the sauce while the rules listed "satay" under peanuts, and it didn't connect the two. The owner caught it on a manual read of every email that mentioned food. The lesson for audits generally: AI screening is good at finding candidates for a closer look, and it can miss the most important error. Anything involving health, money or legal promises gets read by a person.

Ongoing checks after the audit are cheaper than repeat audits. How to monitor AI that talks to customers covers the routine, and the staff side of the data problem is dealt with in stopping staff pasting client data into free tools.

What an AI audit costs, and why quotes differ so much

Audit fees are built from days of work multiplied by a rate, and both numbers vary enormously. Published marketplace figures help. Contra's hiring page for Zapier freelancers quotes typical rates of $30 to $150 an hour for automation specialists. Clutch's AI consulting directory is another reference point: when checked in September 2026, the firms on its first page quoted hourly bands between $25–$49 and $150–$199 and minimum projects of $10,000 or more, so many of them aren't set up for a small business's audit at all.

The cost column is simple arithmetic, days times eight hours times the published hourly range; it is not a survey of what audits sell for. Your quotes will land somewhere inside or outside it depending on four things: how many people and tools are in scope, whether the auditor samples real outputs or only interviews, how sensitive your sector's data is, and whether fixing the problems is included or quoted separately. A quote that includes remediation will look dearer and may be cheaper overall.

Don't forget your own side. Interviews, gathering access and reviewing the findings typically take a few hours per person involved, and fixing what the audit finds can take longer than the audit itself.

Comparing two audit quotes line by line

Put both quotes through the same questions:

• Which of the four audit types is this, and is spend included?
• How many days, and who does the work: the person who sold it, or someone junior?
• Will the auditor sample real outputs, or rely on interviews and questionnaires?
• What exactly is delivered: an inventory, a risk list graded by severity, fixes with owners?
• Is fixing included, quoted separately, or left to you?
• Does the auditor earn commission from any tool they might recommend? The answer should be in writing.
• Will you get the working files (the inventory spreadsheet, the sample results), or only a report?

Two quotes illustrate the difference. Quote one: "AI audit, 2 days, report and presentation." Quote two: "Usage and risk audit covering 12 staff and all AI tools: anonymous survey, 5 interviews, sampling of 40 customer-facing outputs, account and settings review, inventory spreadsheet, risk register graded high/medium/low, 60-minute readout; remediation quoted separately; no commissions from any vendor." The second costs more and is far easier to judge. If the first provider can't expand their line into something like the second, you don't know what you would be buying.

After the audit: fixing first, then a rhythm of re-checks

Sort findings into three piles. Fix this week: anything involving health, safety, customer money or personal data in the wrong place (the allergen rule and the personal chat account in the food truck case). Fix this quarter: supplier risks, orphaned automations, missing policy. Monitor: the rest.

Then set a rhythm: a light check each quarter covering new tools, account types and a small output sample, and a full audit each year or whenever you add something that talks to customers. The difference between an audit and a readiness assessment matters when you plan that rhythm, and AI audit versus AI readiness assessment explains which to use when.

AI audits: common follow-up questions

Does a small business legally need an AI audit?

Usually there is no rule that says a small business must commission one. But existing duties still apply to how you use AI: data-protection law, consumer law on misleading claims, and, if you sell to customers in the EU, the AI Act's transparency duties for chatbots and AI-generated content. An audit is a practical way to check you meet them. For a definitive answer on your situation, ask a qualified adviser.

How often should we audit our AI use?

A full usage and risk audit once a year suits most small businesses, with a lighter check whenever you add a tool that touches customer data or talks to customers. Vendors change defaults, staff change, and automations outlive the people who built them, so an audit that was accurate last spring can be out of date by autumn.

Can our IT support company do the AI audit?

They are well placed for the technical half: accounts, sign-in security, sharing settings and which tools are installed. They may be less used to judging whether AI output is accurate, whether customer-facing wording is appropriate, or whether a workflow is worth automating. Ask which of the four audit types they are offering and see a sample report before agreeing.

Is ISO/IEC 42001 certification worth it for a small firm?

Only if customers or tenders ask for it. ISO/IEC 42001, published in December 2023, is a management-system standard for organisations building or using AI, and certification means an accredited body audits your system, with preparation work beforehand. For most small businesses, a documented usage audit and a clear AI policy meet the practical need at far lower cost.

Further reads

• Automation Audit: Find the Zaps and Scenarios Nobody Owns — Find the automations nobody owns before they break.
• What Is an AI Readiness Assessment and What Does It Involve? — The check to run before you start, rather than after.
• How Much Does an AI Consultant Cost for a Small Business? — How consultants price their time more generally.
• Course, 1:1 Call, Audit, or Project: Which AI Help Do You Need? — Decide whether an audit is the right kind of help.
• Are ChatGPT, Claude, Gemini and Copilot GDPR-Compliant? — The data-protection questions an audit should raise.
• What If Your AI Vendor Shuts Down? Checks Before You Commit — Supplier checks worth adding to any audit.
• How to Run a Monthly AI Quality Review in 30 Minutes — A fixed 30-minute monthly review for AI emails, chatbots, posts and automations: random samples, a copyable scoring sheet and a rule for fixes that get done.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Contra hiring page for Zapier freelancers and Clutch AI consulting directory (rates checked September 2026); OpenAI, Anthropic and Google privacy and data-control help pages; EU AI Act summary of obligations and dates.