UK moves to regulate AI audit ‘wild west’ with first global standard

The British Standards Institution (BSI) has published a new international standard aimed at bringing structure, transparency, and trust to the rapidly expanding AI audit sector, amid mounting concerns about the proliferation of unchecked providers.

The BS ISO/IEC 42006:2025 sets out requirements for bodies providing audit and certification of artificial intelligence management systems. It is the first global standard of its kind, designed specifically to assess those conducting AI audits, rather than the AI systems themselves.

The guidance arrives at a pivotal moment for the accountancy and assurance sectors. As AI becomes more embedded in enterprise operations, demand has surged for credible oversight.

Yet with hundreds of UK-based firms now offering AI assurance – many of them AI developers themselves – the sector faces growing scrutiny over conflicts of interest and inconsistent methodologies.

“There is a risk of a ‘wild west’ of unchecked providers and the potential for radically different levels of assessment,” warned Mark Thirwell, Global Digital Director at BSI. “Only robust, coherent and consistent audits will build much-needed confidence in a safe, secure AI ecosystem.”

The new standard aims to resolve that by establishing a clear competency framework for AI auditors and a structured methodology for certifying bodies assessing compliance with BS ISO/IEC 42001, the AI management system standard first released in 2023.

That earlier framework, which has already been used to certify organisations such as KPMG Australia, outlines how companies should govern the development and deployment of AI systems.

Together, BS ISO/IEC 42001 and 42006 offer a layered approach to AI assurance: one for organisations, the other for those tasked with certifying them. This additional scrutiny, BSI argues, is vital for credibility,particularly as regulatory landscapes evolve.

The move also reinforces the UK’s leadership in ethical AI governance. BSI convened local experts in the development of the standard, which is expected to be referenced by accreditation bodies and conformity assessment organisations worldwide.

While some jurisdictions, including the EU, have opted for wide-reaching legislative frameworks like the AI Act, the UK’s approach leans toward principles-based, standards-led regulation.

In that context, BS ISO/IEC 42006 provides a crucial anchor: a globally recognised benchmark to help regulators, customers, and investors identify reliable AI assurance providers.

The standard is also a direct response to a growing talent and credibility gap in the market. As more accountancy and audit firms, including members of the Big Four, launch AI audit offerings, the need for consistent criteria and qualified professionals has become urgent.

Thirwell noted that the guidance marks a “crucial milestone in global AI accountability” and will support responsible innovation by enabling stakeholders to “differentiate credible AI governance implementations from unchecked claims.”

For auditors, certification bodies, and accountancy firms looking to build or validate their AI assurance capabilities, BS ISO/IEC 42006 could soon become an indispensable reference point.