AI Model Audits: Who’s Required to Conduct Them in 2026

Somewhere inside your company, three different people are touching AI: one is buying a model, one is fine-tuning a model, one is building features on top of someone else’s model. Under the EU AI Act, exactly one of those people may carry audit obligations — and in most companies, nobody has figured out which. That confusion is the single most expensive compliance risk of 2026, because the Act does not grade on effort. It grades on role.

The law’s logic is role-based. Provider, deployer, importer, distributor — each carries different duties, and the same company can be a provider of one system and a deployer of another. Get the classification wrong and you will either do expensive work nobody requires or skip mandatory work everyone assumed someone else was doing.

Providers: the documentation is the audit

If you develop an AI system or a general-purpose model and place it on the EU market — even as a download, an API, or an open-weights release — you are likely a provider, and your audit burden is the heaviest. For general-purpose AI models, the obligations have been binding since August 2, 2025, under Articles 53 and 55, and there is no deferral in sight.

Every GPAI provider, regardless of model size, must maintain and update technical documentation covering training approach, architecture, capabilities, and known limitations; share operational documentation with downstream integrators; operate a copyright-compliance policy including text-and-data-mining opt-outs; publish a sufficiently detailed summary of training data; and — if established outside the EU — appoint an EU representative. Open-source providers get reduced obligations, but reduced is not zero: copyright transparency, basic documentation, and an acceptable-use policy are still required.

Cross the systemic-risk threshold — models trained with more than 10²⁵ FLOPs of compute, currently capturing frontier models on the scale of GPT-4, Gemini Ultra, and Claude 3 Opus, training runs estimated at $50–100 million and up — and Article 55 adds five duties that look exactly like an audit program: adversarial testing before deployment and after significant updates, serious-incident reporting to the European AI Office, documented cybersecurity protections for model weights and infrastructure, energy-consumption reporting, and cooperation with the AI Office’s ongoing evaluations. The Commission can fine GPAI providers directly, with enforcement powers active since August 2026.

For high-risk AI systems, the provider’s audit takes the form of conformity assessment — and here the Digital Omnibus matters. The full Chapter III assessment duties now land on December 2, 2027 for standalone Annex III systems and August 2, 2028 for Annex I embedded systems. Most Annex III systems will follow an internal conformity procedure; biometric-identification systems require a third-party notified body. The practical point: the assessment is future-dated, but the evidence it examines — data governance records, test results, logging architecture — must be generated continuously. A 2027 assessment of a system with no 2026 logs is a failed assessment.

Deployers: the hidden majority of obligations

Here is the part companies miss. The deployer — the organization that uses an AI system under its own authority — is where most enterprises actually sit, and deployer duties are live now. Buy a chatbot, configure it with your content, offer it under your name: you are the deployer, your vendor is the provider, and you have your own obligations.

Deployers must use systems in accordance with the provider’s instructions, maintain human oversight, monitor operation, and retain the logs the system generates under their control. They must ensure the people operating the systems are AI-literate — Article 4 applies to deployers of any AI system, from February 2025. And under Article 50, deployers carry the labelling duties: notifying individuals exposed to emotion-recognition or biometric-categorization systems, and disclosing AI-generated or manipulated deepfakes and public-interest text.

Certain deployers face more. Article 27 requires Fundamental Rights Impact Assessments from deployers that are public bodies, private entities providing public services, and deployers of specific Annex III systems such as credit and insurance-risk scoring. An FRIA is a genuine audit: it must describe the deployment context, identify who is affected and how, assess the risks to fundamental rights, and document mitigation — before deployment, not after. Deployer obligations under Article 26 attach to the December 2027 date for high-risk systems, but the transparency and literacy duties do not wait.

One commercial consequence deserves emphasis. Enterprise buyers increasingly demand their vendors’ audit evidence as a procurement condition — training-data documentation, red-team summaries, conformity declarations. A provider that cannot furnish compliant Article 53 documentation does not merely risk the AI Office’s attention; it loses deals. Audit readiness is becoming a sales qualification.

The third-party question: who certifies, and when

The Act does not require most companies to hire an external auditor in 2026. It requires them to act like one. The mandatory third-party layer — notified-body conformity assessment — applies to a narrow slice of high-risk systems and arrives with the deferred dates. What is genuinely mandatory now is the internal audit function: classification of every system, gap analysis against the live articles, and evidence collection that would survive an AI Office investigation or a market-surveillance authority’s request.

That is why the voluntary standards matter commercially. ISO/IEC 42001, the AI management-system standard, gives companies an auditable governance structure that maps closely onto the Act’s provider duties; certification bodies are building AI-audit practices around it. The Big Four and specialist AI-assurance firms are standing up audit lines now, in anticipation of the December 2027 conformity wave. Early movers are using 2026 for dry runs: mock conformity assessments against the published and draft harmonized standards, starting with EN 18286:2026, the July 2026 standard covering quality management.

The smartest framing of the year comes from the procurement side.

The firm that becomes the reference point for AI audit practice will need a name that says exactly what it does. Aiaudittrail.com is available for acquisition by that firm — inquiries to info@primedomaincapital.com.