Does ISO 27001 require monitoring AI tool usage?

It requires controls that match assessed risks, and unmanaged AI services now sit inside most ISMS scopes. Auditors then ask how usage is actually known, which needs evidence.

Is a log-based AI audit acceptable ISO 27001 evidence?

Dated, repeatable observations with a stated method are the strongest class of operational evidence. Each report states its window, source and register size for exactly that reason.

How is a self-declared AI register different from audit evidence?

A self-declared register is an assertion sourced from memory and interviews. A log-derived inventory is an observation that can be regenerated and cross-checked on demand.

How many audit reports should be on file before certification?

Every filed quarter strengthens the control narrative, and four consecutive reports read as an operating control rather than an audit-week artifact.

Can internal audit verify shadow AI audit findings?

Yes. Re-running the same export window regenerates the findings, and the CSV allows sampling against raw logs without vendor involvement.

Does the AI audit cover tools used off-network?

No, and the evidence statement says so. Auditors accept clearly stated scope; off-network use remains a policy and awareness control.

EVIDENCE
DATED
REPEATABLE

Compliance / ISO 27001

The auditor asks: "how do you know?"

Your ISMS says AI tool usage is controlled. The auditor's follow-up is always the same question, and "we asked the department heads" is the answer that turns a checkmark into a finding. This page is about producing the other kind of answer.

Produce the evidence free

shadow-ai-audit.pdf

Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings.

Sample report View all 11 pages Opens in your browser · PDF

The two answers

Self-declared register vs observed evidence

Both look like an AI inventory in the ISMS. Under audit questioning they behave very differently.

"We maintain a register"

Sourced from asking teams what they use. Complete on the day people answered honestly and remembered everything, which is no day.
Silent on embedded AI features nobody thinks of as tools.
No timestamps, no method statement, no way to re-derive it.
Auditor's next question: "How would this register learn about a tool adopted last month?" There is no good answer.

"We measure quarterly from logs"

Sourced from the organization's own DNS, proxy or firewall exports, matched against a register of 11,841 classified AI domains.
Each report states its window, line counts and register size: a method statement built in.
Repeatable on demand: the same procedure regenerates the evidence for any period.
Auditor's next question: "Can I see last quarter's?" You hand over a PDF. The interview moves on.

The distinction auditors care about is not effort, it is evidentiary class: assertion versus observation. Log-derived inventories are observations with dates on them.

Control mapping

Where AI usage evidence lands in an ISMS

Generic-safe mapping: your ISMS scoping decides the exact control references. These are the conversations where the report keeps appearing.

ISMS conversation	The auditor's angle	What the report supplies
Asset and service inventory	Are cloud services in use identified and owned?	The observed AI service list, per period, with per-team attribution.
Supplier relationships	Are third parties handling data assessed?	Dated training verdicts and sovereignty flags per vendor found in use.
Acceptable use and awareness	Is the policy real or decorative?	The sanctioned split: policy versus observed behavior, quantified.
Data leakage prevention	What stops data leaving through unapproved channels?	Detection cadence plus blocked-attempt evidence from the filter, verified by re-runs.
Change and continual improvement	Does the ISMS learn?	Quarter-over-quarter deltas: tools found, blocked, sanctioned, drifted verdicts.

The interview

Six auditor questions, answered from the report

A composite of how the interview actually goes when the evidence exists. Sample dialogue, real structure.

"How do you identify AI services in use?"

"Quarterly log-based audit: network exports matched against a daily-maintained register of classified AI domains. Here are the last four reports."

"How current is the reference data?"

"The register updates daily, roughly 300,000 domains screened per day, and each report states the register size at run time."

"How do you assess these vendors?"

"Each found tool carries a training verdict with the date the vendor's terms were checked, drawn from an ongoing review of 13,000+ terms documents. High-tier findings feed our supplier process."

"What happens with findings?"

"Triage into sanction, control or block, minuted in this decision table, with the block list verified by the following quarter's run."

"Who sees personal data during this?"

"The audit consumes hostnames, identities and timestamps. Uploads are discarded after each run and reports are deletable; here is the data-handling note."

"Can you demonstrate it now?"

"Yes, the free preview runs in minutes on any export. Would you like to pick the window?"

Auditors reward systems that survive the "show me now" question. This one is designed to be demonstrated live.

Evidence hygiene

Filing the reports so they work as evidence

The document is built for filing; four habits keep the chain tidy.

File unedited

The PDF's scope line and evidence statement are worded to stand alone. Editing or excerpting reintroduces the assertion problem you were solving.

Fix the window

Same 30-day window each quarter, noted in the ISMS procedure. Consistent method is half of what "repeatable" means to an auditor.

Minute the triage

The report shows findings; a one-page decision table shows governance. Together they close the plan-do-check-act loop on paper.

Keep the CSVs

The machine-readable table lets internal audit re-sort and sample without new requests. Auditors notice when checking is easy.

Retention detail for the ISMS note: reports live 90 days in the account and can be deleted earlier; the filed PDFs and CSVs are your permanent record, under your control.

Common findings

Three nonconformity patterns this closes

Generic-safe composites of where AI-related findings actually come from in certification cycles.

The stale register

An AI inventory last touched before the audit announcement. The quarterly cadence with dated PDFs makes staleness structurally impossible to hide and easy to avoid.

The unassessed supplier

A tool in heavy use with no vendor assessment on file. Training verdicts per found tool mean the assessment queue is generated, not remembered.

The decorative policy

An acceptable-use clause about AI with no measurement behind it. The sanctioned split is the measurement, and its trend is the improvement story.

Certification calendar

Slotting the audit into the ISO year

Quarterly: the runs

Four reports a year, same window, filed with minutes. Plans with monthly allowances cover organizations that want tighter cadence; see pricing.

Pre-audit: the rehearsal

Before the certification or surveillance visit, re-read the last two reports and the decision tables. The interview script above is your rehearsal sheet.

Post-finding: the correction

If a visit does produce an AI-related finding, the corrective action is often literally "adopt the cadence": measurable, dated, and closable at the next surveillance.

Internal audit can run the whole loop themselves: export, upload, read. No vendor meeting required, which is why this control survives budget seasons.

Worked scenario

A SaaS company preparing for surveillance

A 400-person B2B SaaS company, ISO 27001 certified for three years, preparing for a year-two surveillance audit. The auditor flagged AI governance as a focus area.

The evidence gap

The ISMS had an AI usage clause added at the last recertification. No measurement process behind it.
The register listed four sanctioned tools. Nobody believed the number.
The CISO expected the auditor to ask about it and had twelve weeks to produce evidence.

What they did

Week 1: exported 30 days of Cloudflare Gateway DNS logs and ran the audit. Result: 41 AI tools, including the four sanctioned ones plus 37 unknown.
Week 2: triage meeting with IT and legal. 12 tools sanctioned with controls, 6 under review, 19 blocked at the gateway.
Week 5: second audit run. Blocked tools gone, two new arrivals flagged and triaged same week.
Week 10: third run filed. Three consecutive reports, trend showing declining unsanctioned count. The auditor read them in twelve minutes.

Audit outcome: no finding on AI governance. The auditor noted the evidence cadence as a positive observation. Total cost: three audit runs at $99 each, well inside the existing ISMS budget line.

Annex A detail

Specific controls the report touches

ISO 27001:2022 Annex A references where AI usage evidence has the most direct relevance.

Control area	Reference	How the report contributes
Information security policies	A.5.1	The sanctioned split measures policy compliance: what the policy says versus what the network shows.
Inventory of information assets	A.5.9	AI services observed in use are information assets. The report is a dated, method-stated inventory of them.
Acceptable use	A.5.10	Usage counts per tool and per user show whether acceptable-use rules have operational reality.
Supplier assessment	A.5.19 - 5.22	Vendor training verdicts with check dates queue the supplier assessment process by risk order.
Data leakage prevention	A.8.12	Unsanctioned AI tools are data-exit channels. Detection plus block verification is the evidence the DLP control needs.
Monitoring activities	A.8.16	Quarterly runs with delta tracking are a monitoring activity by definition, with dated outputs.

Your ISMS scoping decides which references apply. The mapping above reflects where AI usage evidence most commonly enters the conversation during audits we have seen clients prepare for.

FAQ

ISO 27001 evidence questions

Does ISO 27001 require AI usage monitoring?

It requires that your ISMS controls match your risks, and unmanaged AI services are a risk most scoping now includes. The evidence question follows automatically.

Is a log-based audit acceptable evidence?

Dated, repeatable, method-stated observations are the strongest class of operational evidence an ISMS produces. That is precisely the report's construction.

How many periods of evidence do we need?

Start now and you have one period now; certification conversations improve with every quarter filed. Four consecutive reports read as a functioning control.

Can internal audit verify the findings?

Yes: re-run the same window and compare, or sample the CSV against raw logs. Repeatability is the design goal.

What about tools the network never sees?

State the scope honestly: the audit covers the logged network. Off-network use is a policy and awareness matter, and auditors respect stated boundaries far more than silent ones.

Does this replace supplier assessments?

No, it queues and prioritizes them. Verdicts identify which vendors need the full assessment first; the assessment itself stays your process.