Should AI companies be subject to independent safety audits?

A Live Policy Debate, Not a Settled Question

Whether AI companies should be subject to independent safety audits is a question actively debated among AI safety researchers, policymakers, industry representatives, and civil society advocates, without a single settled or universally adopted answer. The core disagreement isn’t primarily about whether accountability matters — most participants in this debate agree that some form of accountability is desirable — but rather about whether independent, third-party audits are the right mechanism, and if so, how they should be designed and implemented in practice.

Understanding both sides of this debate is useful for evaluating specific policy proposals as they continue to emerge in various jurisdictions.

The Case for Independent Audits

Proponents of independent safety audits argue that voluntary self-reporting by AI companies, however well-intentioned, has an inherent limitation: it relies on the audited party to both define the standards and report on its own compliance, without meaningful external verification. Independent audits, by contrast, could provide outside verification of safety claims, potentially catching issues that internal teams might miss or be inclined to downplay, whether due to commercial pressure or simple blind spots. Advocates also point to analogies with other high-stakes industries, such as financial services or aviation, where independent auditing and certification processes are well established and widely viewed as important accountability tools, arguing that AI’s growing societal impact warrants a similar approach.

The Case for Caution or Alternative Approaches

Critics and skeptics of mandatory independent audits raise several practical concerns. One is the sheer difficulty of designing standardized audit criteria for AI systems that are complex, rapidly evolving, and often difficult to fully explain even by their own developers — concerns closely related to broader AI explainability challenges. Another concern involves protecting genuinely proprietary or security-sensitive information; companies argue that certain technical details, if broadly disclosed even to auditors, could pose competitive or security risks. There are also open questions about which organizations would be qualified, sufficiently resourced, and sufficiently independent to conduct credible AI audits at scale, given how specialized and fast-moving the field is.

Some in this camp favor alternative or complementary approaches, such as more robust voluntary frameworks, government-led evaluation programs, or narrower audit requirements focused specifically on the highest-risk AI applications rather than blanket requirements across all AI systems.

Where Policy Has Started to Move

A small but growing number of regulatory frameworks have begun incorporating audit-like requirements, at least for certain categories of AI systems. The European Union’s regulatory approach to AI, for example, includes conformity assessment requirements for some higher-risk AI system categories, representing a step toward mandatory external evaluation, though not a comprehensive, universal independent audit regime covering all AI systems and companies globally.

Bottom Line

Whether AI companies should face independent safety audits remains a genuinely contested policy question — supporters argue it would provide crucial external verification lacking under voluntary self-reporting, while critics raise real practical concerns about standardization and proprietary protection, and while some jurisdictions have introduced narrower audit-like requirements, no comprehensive, universally adopted independent audit system currently exists.

Go deeper

• What is New York City’s Local Law 144 and why does it matter for AI hiring tools?