{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T07:20:06Z","timestamp":1772090406173,"version":"3.50.1"},"reference-count":75,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T00:00:00Z","timestamp":1772064000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100004242","name":"Princess Nourah Bint Abdulrahman University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100004242","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>Existing AI assurance and governance frameworks rely heavily on documented written policies and manual reviews of the implementation. The primary challenge is not the length of these documents, but to operationalize the gap from transforming qualitative requirements into verifiable controls. This approach makes ensuring continuous compliance through the development life cycle hard to enforce, scale, and reproduce.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>This study presents a continuous assurance framework called Audit-as-Code that maps governance requirements to technically-auditable rules, that can be a combination of versioned policy specification and executable checks for evidence artifacts, linked to structured evidence regarding data, models, provenance, performance, decisions, and explanations regarding the decisions being made. While the framework addresses the governance and regulatory mapping requirements, the primary focus of this study is MLOps\/CI-CD (continuous integration\/continuous delivery) operationalization, and turning these requirements into deterministic checks and gate decisions integrated in operational workflows. In this study, we introduce an assured readiness score that integrates the governance risk with other key responsible AI principles, such as traceability and explainability. This approach helps in aligning deployment decisions with predefined risk tiers, and the framework automates decisions on whether a system can proceed, requires remediation and fixes, or should be blocked. It also provides targeted suggestions for improvement and compliance for the lags identified.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>We evaluated this framework on representative AI systems and demonstrated how a single evidence bundle can be used to support assessment across different governance regulations.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>In doing so, Audit-as-Code ensures AI assurance transforms from a documentation-driven policy module to a quantitative, auditable, reproducible, and operationally practical module to ensure compliance.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/frai.2026.1759211","type":"journal-article","created":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T06:53:11Z","timestamp":1772088791000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Audit-as-code: a policy-as-code framework for continuous AI assurance"],"prefix":"10.3389","volume":"9","author":[{"given":"Aoun E.","family":"Muhammad","sequence":"first","affiliation":[{"name":"Faculty of Engineering and Applied Science, University of Regina","place":["Regina, SK, Canada"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kin-Choong","family":"Yow","sequence":"additional","affiliation":[{"name":"Faculty of Engineering and Applied Science, University of Regina","place":["Regina, SK, Canada"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shrooq","family":"Alsenan","sequence":"additional","affiliation":[{"name":"Department of Information Systems, College of Computer and Information Sciences, Princess Nourah Bint Abdurahman University","place":["Riyadh, Saudi Arabia"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2026,2,26]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1147\/JRD.2019.2942288","article-title":"Factsheets: increasing trust in ai services through supplier's declarations of conformity","volume":"63","author":"Arnold","year":"2019","journal-title":"IBM J. Res. Dev"},{"key":"B2","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1016\/j.ssci.2015.12.022","article-title":"Rationale mapping and functional modelling enhanced root cause analysis","volume":"85","author":"Aurisicchio","year":"2016","journal-title":"Saf. Sci"},{"key":"B3","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3449148","article-title":"Problematic machine behavior: a systematic literature review of algorithm audits","volume":"5","author":"Bandy","year":"2021","journal-title":"Proc. ACM Hum.-Comput. Interact"},{"key":"B4","doi-asserted-by":"publisher","DOI":"10.5089\/9798229013468.019","author":"Beitner","year":"2025","journal-title":"Temporalfusiontransformer"},{"key":"B5","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3435104","author":"Bracke","year":"2019","journal-title":"Machine Learning Explainability in Finance: An Application to Default Risk Analysis"},{"key":"B6","first-page":"454","article-title":"\u201cProxy tasks and subjective measures can be misleading in evaluating XAI systems,\u201d","volume-title":"Proceedings of the 25th International Conference on Intelligent User Interfaces (IUI '20)","author":"Bu\u00e7inca","year":"2020"},{"key":"B7","doi-asserted-by":"publisher","first-page":"103","DOI":"10.3389\/fnhum.2012.00103","article-title":"How do we think machines think? An fMRI study of alleged competition with an artificial intelligence","volume":"6","author":"Chaminade","year":"2012","journal-title":"Front. Hum. Neurosci"},{"key":"B8","first-page":"785","article-title":"\u201cXgboost: a scalable tree boosting system,\u201d","volume-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD '16)","author":"Chen","year":"2016"},{"key":"B9","doi-asserted-by":"crossref","first-page":"1571","DOI":"10.1145\/3531146.3533213","article-title":"\u201cWho audits the auditors? recommendations from a field scan of the algorithmic auditing ecosystem,\u201d","volume-title":"Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT '22)","author":"Costanza-Chock","year":"2022"},{"key":"B10","doi-asserted-by":"publisher","first-page":"778","DOI":"10.1109\/TAI.2021.3137091","article-title":"Building trustworthy AI solutions: a case for practical solutions for small businesses","volume":"4","author":"Crockett","year":"2023","journal-title":"IEEE Trans. Artif. Intell"},{"key":"B11","unstructured":"Voluntary AI Safety Standard\n          \n          2024"},{"key":"B12","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1702.08608","article-title":"Towards a rigorous science of interpretable machine learning","year":"2017","journal-title":"arXiv [Preprint]"},{"key":"B13","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1007\/s43681-020-00011-6","article-title":"Beyond the promise: implementing ethical AI","volume":"1","author":"Eitel-Porter","year":"2021","journal-title":"AI Ethics"},{"key":"B14","year":"2024","journal-title":"Regulation (EU) 2024\/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act)"},{"key":"B15","doi-asserted-by":"publisher","first-page":"e3887","DOI":"10.7769\/gesec.v15i7.3887","article-title":"Processing of computer algorithms for traceability identification in scientific research","volume":"15","author":"Fraga","year":"2024","journal-title":"Re. Gest\u00e3o Secretariado"},{"key":"B16","unstructured":"Issue Brief: Components of Frontier AI Safety Frameworks\n          \n          2024"},{"key":"B17","doi-asserted-by":"publisher","first-page":"86","DOI":"10.1145\/3458723","article-title":"Datasheets for datasets","volume":"64","author":"Gebru","year":"2021","journal-title":"Commun. ACM"},{"key":"B18","doi-asserted-by":"publisher","first-page":"1587244","DOI":"10.3389\/frai.2025.1587244","article-title":"From data extraction to analysis: a comparative study of ELISE capabilities in scientific literature","volume":"8","author":"Gobin","year":"2025","journal-title":"Front. Artif. Intell"},{"key":"B19","doi-asserted-by":"publisher","first-page":"55","DOI":"10.1186\/s12910-024-01062-8","article-title":"Ethical considerations and concerns in the implementation of AI in pharmacy practice: a cross-sectional study","volume":"25","author":"Hasan","year":"2024","journal-title":"BMC Med Ethics"},{"key":"B20","doi-asserted-by":"publisher","first-page":"e1312","DOI":"10.1002\/widm.1312","article-title":"Causability and explainability of AI in medicine","volume":"9","author":"Holzinger","year":"2019","journal-title":"WIREs Data Min. Knowl. Discov"},{"key":"B21","year":"2020","journal-title":"Explaining Decisions Made with AI"},{"key":"B22","year":"","journal-title":"ISO\/IEC 23894:2023 Information Technology \u2013 Artificial Intelligence \u2013 Guidance on Risk Management"},{"key":"B23","year":"","journal-title":"ISO\/IEC 42001:2023 Information Technology \u2013 Artificial Intelligence \u2013 Management System"},{"key":"B24","year":"2018","journal-title":"DVC: Data Version Control"},{"key":"B25","unstructured":"Jigsaw Toxic Comment Classification Challenge\n          \n          2018"},{"key":"B26","doi-asserted-by":"publisher","first-page":"230859","DOI":"10.1098\/rsos.230859","article-title":"Towards algorithm auditing: managing legal, ethical and technological risks of AI, ML and associated algorithms","volume":"11","author":"Koshiyama","year":"2024","journal-title":"Royal Soc. Open Sci"},{"key":"B27","unstructured":"Krizhevsky\n              A.\n            \n          \n          Cifar-10 and Cifar-100 Datasets\n          \n          2009"},{"key":"B28","volume-title":"Explainability auditing for intelligent","author":"Langer","year":"2021"},{"key":"B29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3555803","article-title":"Trustworthy AI: from principles to practices","volume":"55","author":"Li","year":"2023","journal-title":"ACM Comput. Surv"},{"key":"B30","article-title":"\u201cA unified approach to interpreting model predictions,\u201d","volume-title":"Advances in Neural Information Processing Systems 30 (NeurIPS 2017)","year":"2017"},{"key":"B31","doi-asserted-by":"publisher","first-page":"e202300274","DOI":"10.1002\/jbio.202300274","article-title":"Human selection bias drives the linear nature of the more ground truth effect in explainable deep learning oct image segmentation","volume":"17","author":"Maloca","year":"2024","journal-title":"J. Biophotonics"},{"key":"B32","unstructured":"Meta-Llama\/Meta-Llama-3-8b: Model Card\n          \n          2024"},{"key":"B33","doi-asserted-by":"publisher","first-page":"3503","DOI":"10.1007\/s10462-021-10088-y","article-title":"Explainable artificial intelligence: a comprehensive review","volume":"55","author":"Minh","year":"2021","journal-title":"Artif. Intell. Rev"},{"key":"B34","unstructured":"Seoul Declaration for Safe, Innovative and Inclusive AI (AI Seoul Summit, 21 May 2024)\n          \n          2024"},{"key":"B35","doi-asserted-by":"publisher","first-page":"329","DOI":"10.1007\/s00146-022-01415-0","article-title":"What about investors? ESG analyses as tools for ethics-based AI auditing","volume":"39","author":"Minkkinen","year":"2022","journal-title":"AI Soc"},{"key":"B36","doi-asserted-by":"crossref","first-page":"220","DOI":"10.1145\/3287560.3287596","article-title":"\u201cModel cards for model reporting,\u201d","volume-title":"Proceedings of the Conference on Fairness, Accountability, and Transparency (FAT*)","author":"Mitchell","year":"2019"},{"key":"B37","unstructured":"Atlas: Adversarial Threat Landscape for Artificial-Intelligence Systems\n          \n          2024"},{"key":"B38","unstructured":"Common Elements of Frontier AI Safety Policies\n          \n          2024"},{"key":"B39","doi-asserted-by":"publisher","first-page":"20","DOI":"10.3390\/bdcc5020020","article-title":"Traceability for trustworthy AI: a review of models and tools","volume":"5","author":"Mora-Cantallops","year":"2021","journal-title":"Big Data Cogn. Comput"},{"key":"B40","author":"Muhammad","year":"2025","journal-title":"ai-audit-as-code: Policy-as-Code Gate for TI\/XI, Floors, and Blockers"},{"key":"B41","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2508.19281","author":"Muhammad","year":"2025","journal-title":"Cortex: Composite Overlay for Risk Tiering and Exposure in Operational AI Systems"},{"key":"B42","doi-asserted-by":"publisher","first-page":"1393123","DOI":"10.3389\/fmed.2024.1393123","article-title":"A scalable and transparent data pipeline for AI-enabled health data ecosystems","volume":"11","author":"Naml\u0131","year":"2024","journal-title":"Front. Med"},{"key":"B43","volume-title":"Artificial Intelligence Risk Management Framework (AI RMF 1.0)","year":"2023"},{"key":"B44","unstructured":"Towards a Hiroshima Artificial Intelligence Process Code of Conduct Reporting Framework: Findings from the Pilot (Report of the G7 Italian Presidency)\n          \n          2024"},{"key":"B45","unstructured":"OECD Launches Global Framework to Monitor Application of G7 Hiroshima AI Code of Conduct\n          \n          2025"},{"key":"B46","unstructured":"Memorandum m-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence\n          \n          2024"},{"key":"B47","doi-asserted-by":"publisher","first-page":"354","DOI":"10.15441\/ceem.23.145","article-title":"XAI in emergency medicine: an overview","volume":"10","author":"Okada","year":"2023","journal-title":"Clin. Exp. Emerg. Med"},{"key":"B48","year":"2021","journal-title":"Open Policy Agent: Policy-based Control for Cloud-Native Environments"},{"key":"B49","volume-title":"SLSA v1.0: Supply-chain Levels for Software Artifacts","year":"2023"},{"key":"B50","volume-title":"OECD Council Recommendation on Artificial Intelligence (OECD AI Principles)","year":"2019"},{"key":"B51","unstructured":"Owasp Top 10 for Large Language Models\n          \n          2024"},{"key":"B52","doi-asserted-by":"publisher","first-page":"43","DOI":"10.54934\/ijlcw.v2i2.53","article-title":"The right to explanation in the processing of personal data with the use of AI systems","volume":"2","author":"Papadimitriou","year":"2023","journal-title":"Int. J. Law Changing World"},{"key":"B53","doi-asserted-by":"publisher","first-page":"899","DOI":"10.1007\/s10278-024-00982-6","article-title":"Development of medical imaging data standardization for imaging-based observational research: Omop common data model extension","volume":"37","author":"Park","year":"2024","journal-title":"J. Digit. Imaging"},{"key":"B54","unstructured":"Torchvision Resnet-50: Model Reference\n          \n          2025"},{"key":"B55","doi-asserted-by":"publisher","first-page":"1135","DOI":"10.1145\/2939672.2939778","author":"Ribeiro","year":"2016"},{"key":"B56","doi-asserted-by":"publisher","DOI":"10.4850\/arXiv.2112.07467","article-title":"AI ethics principles in practice: perspectives of designers and developers","author":"Sanderson","year":"2021","journal-title":"arXiv [preprint"},{"key":"B57","doi-asserted-by":"publisher","first-page":"1332","DOI":"10.1111\/risa.17665","article-title":"Frontier AI developers need an internal audit function","volume":"45","author":"Schuett","year":"2024","journal-title":"Risk Anal"},{"key":"B58","first-page":"618","article-title":"\u201cGrad-CAM: Visual explanations from deep networks via gradient-based localization,\u201d","volume-title":"Proceedings of the IEEE International Conference on Computer Vision (ICCV)","author":"Selvaraju","year":"2017"},{"key":"B59","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3479577","article-title":"Everyday algorithm auditing: understanding the power of everyday users in surfacing harmful algorithmic behaviors","volume":"5","author":"Shen","year":"2021","journal-title":"Proc. ACM Hum.-Comput. Interact"},{"key":"B60","doi-asserted-by":"publisher","first-page":"294","DOI":"10.1002\/sys.21515","article-title":"Modeling and structuring design rationale to enable knowledge reuse","volume":"23","author":"Siddharth","year":"2020","journal-title":"Syst. Eng"},{"key":"B61","doi-asserted-by":"publisher","first-page":"261","DOI":"10.1016\/j.sheji.2025.06.002","article-title":"Data-driven innovation for trustworthy AI","volume":"11","author":"Siddharth","year":"2025","journal-title":"She Ji J. Des. Econ. Innov"},{"key":"B62","doi-asserted-by":"publisher","first-page":"1","DOI":"10.70777\/agi.v1i1.10881","article-title":"The AI risk repository: a comprehensive meta-review, database, and taxonomy of risks from artificial intelligence","volume":"1","author":"Slattery","year":"2024","journal-title":"AGI-Artif. Gen. Intell.-Robot.-Saf. Alignment"},{"key":"B63","doi-asserted-by":"crossref","first-page":"2239","DOI":"10.1145\/3531146.3534639","article-title":"\u201cA review of taxonomies of explainable artificial intelligence (XAI) methods,\u201d","volume-title":"Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency (FAccT '22)","author":"Speith","year":"2022"},{"key":"B64","doi-asserted-by":"publisher","first-page":"535","DOI":"10.1109\/ACCESS.2021.3137364","article-title":"Reliable and resilient AI and iot-based personalised healthcare services: a survey","volume":"10","author":"Taimoor","year":"2022","journal-title":"IEEE Access"},{"key":"B65","doi-asserted-by":"publisher","first-page":"viad040","DOI":"10.1093\/isr\/viad040","article-title":"The global governance of artificial intelligence: next steps for empirical and normative research","volume":"25","author":"Tallberg","year":"2023","journal-title":"Int. Stud. Rev"},{"key":"B66","year":"2021","journal-title":"Good Machine Learning Practice for Medical Device Development: Guiding Principles"},{"key":"B67","unstructured":"Electricityloaddiagrams20112014\n          \n          2015"},{"key":"B68","unstructured":"Adult\n          \n          2024"},{"key":"B69","unstructured":"Frontier AI Safety Commitments (AI Seoul Summit 2024)\n          \n          2024"},{"key":"B70","unstructured":"AI Safety Institute Approach to Evaluations\n          \n          2024"},{"key":"B71","unstructured":"Unitary\/Toxic-Bert: Model Card\n          \n          2021"},{"key":"B72","volume-title":"Recommendation on the Ethics of Artificial Intelligence","year":"2021"},{"key":"B73","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1093\/idpl\/ipx005","article-title":"Why a right to explanation of automated decision-making does not exist in the general data protection regulation","volume":"7","author":"Wachter","year":"2017","journal-title":"Int. Data Priv. Law"},{"key":"B74","first-page":"39","article-title":"Accelerating the machine learning lifecycle with mlflow","volume":"41","author":"Zaharia","year":"2018","journal-title":"IEEE Data Eng. Bull"},{"key":"B75","doi-asserted-by":"publisher","DOI":"10.21203\/rs.3.rs-1897856\/v1","article-title":"Quantifying trustworthiness of explainability in medical AI","author":"Zhang","year":"2022","journal-title":"Res. Sq"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1759211\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T06:53:17Z","timestamp":1772088797000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1759211\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,26]]},"references-count":75,"alternative-id":["10.3389\/frai.2026.1759211"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1759211","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,26]]},"article-number":"1759211"}}