Galicia's audit-body AI policy requires corroborating evidence and restricts profiling, subject to an express exception

The sentence that makes this worth reading outside Galicia

First, the scope, because everything below depends on it. This policy binds only the Consejo de Cuentas de Galicia and its own staff. It does not apply to private audit firms, to audited entities, to other Spanish autonomous communities, to national Spanish institutions, or to any jurisdiction outside this one regional public-audit body. It is an internal rule that happens to have been published in a gazette.

With that established: an external audit institution has written down, in a published and binding instrument, that an AI output is not sufficient audit evidence on its own.

Article 16 provides that results generated by artificial intelligence systems have an auxiliary character and do not by themselves constitute sufficient and adequate audit evidence, and that their use must be corroborated through other sources of evidence obtained in accordance with the applicable auditing standards.

Article 16 states a specific requirement for the Council's use of AI. It does not establish a general auditing standard for other organisations.

A reader elsewhere may compare this requirement with their own applicable standards and procedures. This article does not assess the content of other organisations' internal policies.

What it prohibits

The prohibitions are specific rather than atmospheric. Article 8.3 prohibits the mass or indiscriminate processing of personal data and of audit data through AI systems. Audit data is defined broadly, covering draft reports, working papers, correspondence with audited entities and reserved information.

Article 9.1 prohibits the use of AI systems that, knowably or probably, produce discriminatory biases or unfair results. Article 9.3 requires the risk of known or foreseeable bias to be assessed before a system is authorised, and 9.4 requires periodic evaluation to catch biases that were not apparent at authorisation.

Article 15.4 expressly prohibits using AI to build profiles of natural persons, predict behaviour, evaluate individual risks or classify subjects in the exercise of the Council's functions, except where expressly authorised by law and duly authorised internally.

The exception is part of article 15.4 and should accompany any summary of the restriction. The policy does not identify a specific authorised profiling project.

Authorisation, and a register of what is forbidden

Article 13 makes every corporate AI system subject to prior authorisation. Authorised systems are reviewed at least every two years, and a review can confirm, condition or revoke the authorisation.

The Council keeps a register of authorised and prohibited systems, and the policy states that all personnel must know and observe it. Article 12 also refers to conditionally authorised systems and requires the register to be accessible to personnel.

Article 13.4 permits personnel to use other systems subject to three conditions. Staff may use other AI systems only where the information used comes exclusively from open sources, where no Council data or information classified as limited-circulation or confidential is incorporated directly or indirectly, and where the results are not incorporated into audit work in progress.

The policy creates a Committee chaired by the Consejero mayor or a delegate, with an auditor from each sectoral department, the head of IT and the Data Protection Officer. The Secretary General or a delegate serves as secretary. Its functions include authorisation, internal standards and the register. The annual AI-use report enters the Council's annual report and is made public through its transparency portal, with information-security and legitimate-interest redactions.

The disclosure duty inside the working papers

Article 17 requires that every use of AI be documented, and specifically in the audit working papers. More than that, any document produced in the Council in which AI is used must state that fact, the system used, and the person responsible for validating it.

Article 17 covers working papers and all Council-generated documents using AI. Its wording should not be reduced to internal files alone. Article 12 separately requires publication of the annual report's content, subject to stated redactions.

Article 15.3 sets the boundary of what the tool may produce at all. AI may not draw audit conclusions, make formal recommendations, produce legal qualifications, take automated decisions, form professional judgments or make assessments of responsibility.

Article 18 closes it. Full responsibility for the conclusions, valuations and recommendations in audit reports rests with the audit staff and the competent organs, and the policy states that the use of AI neither alters nor attenuates that responsibility.

Why a regional audit body wrote its own rules

The Council states in its preamble that Galicia has an AI law, Ley 2/2025 of 2 April, on the development and promotion of artificial intelligence in Galicia, and that this law does not include the Consejo de Cuentas within its subjective scope. According to the same preamble, the Council nonetheless takes up the principles of that law in exercise of its organisational autonomy as a statutory body.

We report that as the preamble states it. We have not read Ley 2/2025 and we make no claim about what the statute actually contains or requires; the only thing established here is what this policy says about its own relationship to it.

The practical point for a reader is narrower than it looks. An institution not covered by its region's AI statute adopted comparable principles through internal rules instead. How AI governance reaches bodies that sit outside a statute's scope is a live question in a lot of jurisdictions, and this is one worked example of it.

What we did not verify

We read the policy in full as published in the Diario Oficial de Galicia. Every provision described above comes from that text.

We have not read Ley 2/2025 of Galicia. Where we mention it, we report only what this policy's preamble says about its own scope in relation to it, and we make no claim about the statute's content.

The policy's preamble refers to a number of other documents as background. We have not read any of them, so we do not describe them, do not treat them as comparators, and do not rely on them for anything stated above.

We did not check whether other Spanish regional audit bodies have adopted comparable policies. We therefore make no claim that this is the first, the only, or an unusual instrument, and readers should not infer one.

Article 11.3 provides for the Committee to draft internal operating rules for approval by the Pleno. That future-tense provision does not establish whether the rules have since been adopted; their present status was not verified.

We have not seen the register of authorised and prohibited systems, and we do not know whether it will be published or held internally. The policy requires personnel to know it; it does not on its face require publication of the register itself.

Related briefings

• Europe AI regulation
• Spain's AI organic law and AESIA fines
• The PCAOB on AI and audit documentation under QC 1000
• The EU AI Act's AI literacy duty
• ISO/IEC 42005 on AI impact assessment
• AI Regulation News hub