Since the AI system processes customer data-including potentially personal, sensitive, or behavioral data- the auditor's primary focus must be privacy compliance (C). AAIA identifies privacy violations as one of the highest-risk areas for organizations using AI.
The auditor must ensure:
* Data collection follows lawful basis requirements
* Customers gave proper consent (if required)
* Processing adheres to data minimization and purpose limitation
* Storage and retention policies meet regulatory standards
* Data subjects ' rights (access, correction, deletion) are protected
* Third-party or cross-border transfers are compliant
Access controls (B) matter but are secondary to ensuring the data is legally collected and processed. AI strategy alignment (A) is governance-related, not risk-critical. Escalation protocols (D) support incident response but come after confirming lawful processing.
References:
AAIA Domain 5: Data Privacy, Lawfulness of Processing
AAIA Domain 1: Privacy and Data Governance Programs