What auditors ask about AI-written code

Inventory: what is in use?

Every other question depends on this one. If you cannot say which tools and models are used, you cannot say how they are governed.

• Which AI coding assistants, agents, and models are used, and in which repositories?
• Is there an approved list, and who approves additions?
• Can you show use of a tool that is not on the approved list?
• Do contractors and vendors use the same tools on your code?

Policy: what are the rules?

A policy that exists only as a document is weaker than one you can show being applied. Auditors tend to ask both.

• Is there a written policy for AI-assisted development?
• Which paths, services, or data classes need extra care, such as payments or authentication code?
• Is the policy enforced automatically, or does it rely on people remembering?
• When did the policy change, and what did it say before?

Review: who checked it?

Most existing change-management controls already require review. The new question is whether that holds when a change was produced or modified by a tool.

• Does every AI-assisted change receive a human review before merge?
• Can a change be merged with only automated checks?
• Can you show the reviewer and the checks for a specific sampled change?
• Is the author allowed to approve their own AI-assisted change?

Evidence: how do you know?

This is where most teams struggle. The distinction that matters is between what was recorded by a trustworthy source, what a person stated, and what someone estimated.

• Is the record of AI involvement created automatically or by self-report?
• How do you know the record has not been edited afterwards?
• Which claims are proven, which are declared, and which are estimates?
• Can a third party check the evidence without trusting you?

Retention: how long does it last?

• How long are records of AI involvement kept?
• Does the record include source code, or only metadata?
• What happens to records when a person or repository is removed?
• Can you produce records for a past period on request?

Using the checklist

Take one recently merged change and try to answer every question about it using only records, without asking anyone. The gaps show where you rely on memory. Those are the places to add trailers, CI steps, or policies first.

Attesta is designed to help you produce this kind of evidence. It does not certify compliance with any framework, and the questions above are a starting point rather than a complete list for any particular audit.