Since the AI system processes customer data—including potentially personal, sensitive, or behavioral data—the auditor’s primary focus must be privacy compliance (C). AAIA identifies privacy violations as one of the highest-risk areas for organizations using AI.

The auditor must ensure:

Data collection follows lawful basis requirements

Customers gave proper consent (if required)

Processing adheres to data minimization and purpose limitation

Storage and retention policies meet regulatory standards

Data subjects ' rights (access, correction, deletion) are protected

Third-party or cross-border transfers are compliant

Access controls (B) matter but are secondary to ensuring the data is legally collected and processed. AI strategy alignment (A) is governance-related, not risk-critical. Escalation protocols (D) support incident response but come after confirming lawful processing.