Galicia's regional audit body has adopted binding internal AI rules for its own staff: AI output is not sufficient audit evidence on its own, and using AI to profile people is prohibited

The sentence that makes this worth reading outside Galicia

First, the scope, because everything below depends on it. This policy binds only the Consejo de Cuentas de Galicia and its own staff. It does not apply to private audit firms, to audited entities, to other Spanish autonomous communities, to national Spanish institutions, or to any jurisdiction outside this one regional public-audit body. It is an internal rule that happens to have been published in a gazette.

With that established: an external audit institution has written down, in a published and binding instrument, that an AI output is not evidence on its own.

Article 16 provides that results generated by artificial intelligence systems have an auxiliary character and do not by themselves constitute sufficient and adequate audit evidence, and that their use must be corroborated through other sources of evidence obtained in accordance with the applicable auditing standards.

That is the question audit committees and firm methodology teams have been circling since generative tools arrived in the workpapers. Here one audit institution answers it in a gazette rather than in a training deck. It is not a general audit standard and it does not bind anyone outside the Council; it is one body's answer, written down and adopted.

Its value to a reader elsewhere is that it is a drafted, adopted answer to a question most internal policies leave open, not that it governs anyone else.

What it prohibits

The prohibitions are specific rather than atmospheric. Article 8.3 prohibits the mass or indiscriminate processing of personal data and of audit data through AI systems. Audit data is defined broadly, covering draft reports, working papers, correspondence with audited entities and reserved information.

Article 9.1 prohibits the use of AI systems that, knowably or probably, produce discriminatory biases or unfair results. Article 9.3 requires the risk of known or foreseeable bias to be assessed before a system is authorised, and 9.4 requires periodic evaluation to catch biases that were not apparent at authorisation.

Article 15.4 expressly prohibits using AI to build profiles of natural persons, predict behaviour, evaluate individual risks or classify subjects in the exercise of the Council's functions, except where expressly authorised by law and duly authorised internally.

For an audit body, that last one is a deliberate closing of a door. Risk-scoring individuals is exactly the use case an audit institution would be tempted toward.

Authorisation, and a register of what is forbidden

Article 13 makes every corporate AI system subject to prior authorisation. Authorised systems are reviewed at least every two years, and a review can confirm, condition or revoke the authorisation.

The Council keeps a register of authorised and prohibited systems, and the policy states that all personnel must know and observe it. A register that names prohibited systems, not only approved ones, is the unusual half.

There is a carve-out for personal use that is tightly drawn. Staff may use other AI systems only where the information used comes exclusively from open sources, where no Council data or information classified as limited-circulation or confidential is incorporated directly or indirectly, and where the results are not incorporated into audit work in progress.

Governance sits with a new Committee chaired by the Consejero mayor, with an auditor from each sectoral department, the head of IT and the Data Protection Officer. It authorises new uses, sets internal standards, maintains the register and publishes an annual report on AI use in the institution's public transparency portal.

The disclosure duty inside the working papers

Article 17 requires that every use of AI be documented, and specifically in the audit working papers. More than that, any document produced in the Council in which AI is used must state that fact, the system used, and the person responsible for validating it.

That is a disclosure obligation pointed inward, at the file rather than at the public. It makes the question of who checked the machine answerable years later, which is the point of a working paper.

Article 15.3 sets the boundary of what the tool may produce at all. AI may not draw audit conclusions, make formal recommendations, produce legal qualifications, take automated decisions, form professional judgments or make assessments of responsibility.

Article 18 closes it. Full responsibility for the conclusions, valuations and recommendations in audit reports rests with the audit staff and the competent organs, and the policy states that the use of AI neither alters nor attenuates that responsibility.

Why a regional audit body wrote its own rules

The Council states in its preamble that Galicia has an AI law, Ley 2/2025 of 2 April, on the development and promotion of artificial intelligence in Galicia, and that this law does not include the Consejo de Cuentas within its subjective scope. According to the same preamble, the Council nonetheless takes up the principles of that law in exercise of its organisational autonomy as a statutory body.

We report that as the preamble states it. We have not read Ley 2/2025 and we make no claim about what the statute actually contains or requires; the only thing established here is what this policy says about its own relationship to it.

The practical point for a reader is narrower than it looks. An institution not covered by its region's AI statute adopted comparable principles through internal rules instead. How AI governance reaches bodies that sit outside a statute's scope is a live question in a lot of jurisdictions, and this is one worked example of it.

What we did not verify

We read the policy in full as published in the Diario Oficial de Galicia. Every provision described above comes from that text.

We have not read Ley 2/2025 of Galicia. Where we mention it, we report only what this policy's preamble says about its own scope in relation to it, and we make no claim about the statute's content.

The policy's preamble refers to a number of other documents as background. We have not read any of them, so we do not describe them, do not treat them as comparators, and do not rely on them for anything stated above.

We did not check whether other Spanish regional audit bodies have adopted comparable policies. We therefore make no claim that this is the first, the only, or an unusual instrument, and readers should not infer one.

The Committee's internal operating rules do not exist yet. The policy says the Committee will draft them and the Pleno will approve them, so how authorisation will work in practice is not yet observable.

We have not seen the register of authorised and prohibited systems, and we do not know whether it will be published or held internally. The policy requires personnel to know it; it does not on its face require publication of the register itself.

Related briefings

• Spain's AI organic law and AESIA fines
• The PCAOB on AI and audit documentation under QC 1000
• The EU AI Act's AI literacy duty
• ISO/IEC 42005 on AI impact assessment
• AI Regulation News hub