CDT Releases Policy Framework for AI Auditing Requirements

State AI auditing policies face implementation hurdles

As state legislators increasingly consider mandating third-party audits of AI systems, a new policy framework from the Center for Democracy and Technology identifies the core obstacles these requirements must overcome to deliver meaningful accountability.

CDT's AI Governance Lab released an eleven-point policy guide on August 3 aimed at helping policymakers design auditing and assessment requirements that are both feasible and effective. The guidance comes as states grapple with how to regulate AI systems whose risks vary dramatically across models and use cases.

Why it matters

Without clear implementation pathways, AI auditing mandates risk becoming compliance theater—expensive to execute but ineffective at reducing harm. States need practical frameworks that account for resource constraints, technical complexity, and the current absence of standardized assessment methodologies. This guidance attempts to bridge the gap between regulatory intent and operational reality.

Key challenges identified

The CDT framework highlights several structural problems facing AI auditing policies. The enormous diversity of AI models and applications means a single auditing approach cannot address all risk types effectively. The field currently lacks established technical standards that auditors can consistently apply across different systems.

Cost considerations present another constraint. Requirements must mitigate genuine risks without imposing expenses that make compliance infeasible, particularly for smaller organizations. Third-party auditors themselves face capability gaps—they need adequate resources, specialized technical skills, and sufficient access to proprietary systems and data to conduct meaningful assessments.

Policy options for lawmakers

While the source document does not detail all eleven specific policy recommendations, CDT positions them as mechanisms to make third-party auditing "more feasible, effective, and meaningful in providing accountability." The framework is designed for state engagement teams working directly with legislators on AI governance.

The guidance reflects CDT's broader work through its AI Governance Lab on establishing practical governance structures for artificial intelligence systems. The organization has been active in AI policy development, recently submitting comments opposing an FTC policy statement on AI accuracy and contributing to federal contract language for AI systems.

Implementation context

The timing of CDT's framework reflects the current legislative landscape, where multiple states are advancing AI regulation without clear consensus on enforcement mechanisms. Third-party auditing has emerged as a popular policy tool, but questions remain about who qualifies as an auditor, what methodologies they should use, and how to verify audit quality.

The full policy guide is available as a PDF through CDT's website. The organization encourages state policymakers to contact its State Engagement team for additional information on implementing AI auditing and assessment requirements.

The framework was first published by the Center for Democracy and Technology on August 3, 2026.