Algorithmic Audits: What an Outside Examination of an AI System Can Actually Establish

In May 2017, IBM's commercial gender classifier misclassified 34.7% of darker-skinned women in a 1,270-face benchmark and 0.3% of lighter-skinned men (Buolamwini & Gebru, 2018, Gender Shades, PMLR 81). Two researchers with API access found it, published with the vendors named, and within seven months all three audited companies had shipped models that cut the darker-female error rate by 17.7 to 30.4 percentage points (Raji & Buolamwini, 2019, Actionable Auditing, AIES).

New York City later made bias audits mandatory for automated hiring tools. When 155 student investigators went looking, 391 employers yielded 18 posted audit reports and 13 transparency notices (Wright et al., 2024, Null Compliance, FAccT). In December 2025 the New York State Comptroller found that the city regulator had received two complaints in two years, and that nine of twelve test calls to the 311 line never reached it (NYS Comptroller, 2025, Report 2024-N-6).

Same instrument, opposite outcomes, and the difference was structural. An external audit establishes one kind of claim: on these inputs, at this access level, against this version, the measured quantity lies in this interval. Anything more depends on who chose the scope and sample, how many cases there were, and who decided to publish.

Why this matters: Audits are becoming the load-bearing mechanism of AI governance: Local Law 144 requires them for hiring tools, the EU AI Act relies on conformity assessment, and as of September 2026 five frontier labs give the US Center for AI Standards and Innovation pre-deployment access. Anyone relying on an audit needs to know what its access licenses and how many cases its conclusion can bear.

TL;DR

• An audit establishes a bounded, dated, conditional claim: a rate with an interval, on a stated input distribution, version and access level. It cannot establish absence of a behaviour, only an upper bound on its rate.
• Gender Shades worked because the gap was sharp (34.4 points, 95% interval roughly 29 to 40), the auditors chose scope and test set, and publication was not negotiable.
• Local Law 144 inverted all three. Of 386 published impact ratios only 9 fell below the 0.8 four-fifths threshold, and 20% of ratios were omitted under a small-group rule.
• Detecting a 2-point error gap (5% vs 3%) with 80% power needs about 1,500 labelled cases per group; a corrected four-group intersectional audit needs over 5,000.
• Zero failures in \(n\) trials bounds the failure rate at about \(3/n\). A clean 300-prompt red-team run supports "under 1%", never "none".
• Access sets the ceiling: a black-box audit cannot tell a model property from a filter's effect (Casper et al., 2024).
• 80% of surveyed auditors have recommended changes that were never implemented (Costanza-Chock, Raji & Buolamwini, 2022).
• Government pre-deployment testing (UK AISI, US CAISI) has the deepest access but a deliberately narrow security scope.

At a Glance

flowchart LR
    A["Access granted"] --> T["Test set"]
    S["Scope: who decides?"] --> T
    T --> M["Rates per group"]
    M --> I["Interval, not verdict"]
    V["Version and date"] --> I
    I --> P{"Who decides to publish?"}
    P -->|auditor| C["Public, contestable claim"]
    P -->|auditee| Q["Private report or silence"]
    classDef blue fill:#1e40af,stroke:#3b82f6,stroke-width:1px,color:#fff
    classDef purple fill:#6d28d9,stroke:#a78bfa,stroke-width:1px,color:#fff
    classDef teal fill:#0e7490,stroke:#22d3ee,stroke-width:1px,color:#fff
    classDef amber fill:#b45309,stroke:#fbbf24,stroke-width:1px,color:#fff
    classDef emerald fill:#047857,stroke:#34d399,stroke-width:1px,color:#fff
    classDef rose fill:#be123c,stroke:#fb7185,stroke-width:1px,color:#fff
    class A,S,V blue
    class T,M purple
    class I teal
    class P amber
    class C emerald
    class Q rose

Access, scope and version decide what the interval means; publication, outside the measurement, decides whether it becomes accountability.

From Housing Testers to Frontier Labs

"Audit" reached algorithms from civil-rights enforcement, not accounting: in the 1970s US housing researchers sent matched testers, identical but for race, to landlords and counted differential treatment. Sandvig, Hamilton, Karahalios and Langbort carried the design onto platforms and named five variants: code audits, noninvasive user audits, scraping audits, sock-puppet audits and crowdsourced audits (Sandvig et al., 2014, ICA preconference). Their sharpest warning was legal: scraping and sock puppets risked Computer Fraud and Abuse Act liability. Sandvig v. Barr later held that discrimination research does not violate the CFAA, yet auditors still call the risk a "specter" (Costanza-Chock, Raji & Buolamwini, 2022, FAccT).

Gender Shades turned the method into a lever. Standard face benchmarks were 79.6% (IJB-A) and 86.2% (Adience) lighter-skinned, so Buolamwini and Gebru built the Pilot Parliaments Benchmark from parliamentarians of Rwanda, Senegal, South Africa, Iceland, Finland and Sweden. Every classifier tested did worst on darker-skinned women: 20.8% error for Microsoft, 34.7% for IBM.

Raji and Buolamwini (2019) describe a procedure borrowed from coordinated vulnerability disclosure: anonymised results to vendors on 19 December 2017, named results public on 9 February 2018, re-audit on 21 August 2018. IBM shipped a new API in 66 days, Microsoft in 189, Face++ in 190. Amazon and Kairos, never named, showed darker-female error of 31.37% and 22.50%: the pattern was industry-wide, and only the named firms had moved.

Raji, Smart and colleagues then specified the inside view, where access is no obstacle: SMACTR (Scoping, Mapping, Artifact Collection, Testing, Reflection), which borrows failure modes and effects analysis from safety engineering (Raji et al., 2020, FAT*, arXiv:2001.00973).

timeline
    title From paired testers to pre-deployment access
    1970s : HUD paired-tester housing audits
    2014 : Sandvig et al. name five platform audit designs
    2018 : Gender Shades publishes a named 34.4-point gap
    2019 : Actionable Auditing finds 17.7 to 30.4 point cuts
    2020 : SMACTR internal audit lifecycle
         : Sandvig v. Barr on research and the CFAA
    2022 : Who Audits the Auditors surveys 152 practitioners
    2023 : NYC Local Law 144 enforcement begins in July
    2024 : Casper et al. argue black-box access is insufficient
         : Null Compliance finds 18 audits across 391 employers
         : US AI Safety Institute signs MOUs with OpenAI and Anthropic
    2025 : UK institute renamed AI Security Institute
         : US institute becomes CAISI
         : NYS Comptroller audits LL144 enforcement
    2026 : DeepMind, Microsoft and xAI sign CAISI agreements

By 2022 Costanza-Chock and colleagues had catalogued 189 auditing organisations and found only 7% of 152 surveyed practitioners used a standardised framework. Regulation then arrived in two shapes: hiring-tool disparity audits in New York, and government security testing of frontier models.

What an Audit Measures, and What It Licenses

Read any audit as a chain of links (access, scope, sample, inference), each of which can only narrow the claim made by the one before.

Access sets the ceiling

Casper and colleagues give the cleanest taxonomy (Casper et al., 2024, FAccT, arXiv:2401.14446). Black-box access lets the auditor design inputs and observe outputs. Grey-box adds limited internals such as sampling probabilities or activations. White-box adds weights, gradients and fine-tuning. Outside-the-box access is orthogonal: methodology, code, documentation, training data, deployment details and the developer's internal evaluations. A "de facto white-box" tier lets the auditor run arbitrary processes through an interface without copying parameters.

Each tier licenses a different sentence. Black-box supports "the deployed endpoint produced these outputs on these inputs". It cannot separate the model from an input filter, output classifier or system prompt, since it sees only their composition, and it cannot find a backdoor whose trigger nobody tried. Grey-box permits calibration checks and per-group score distributions. White-box permits gradient-based attack search, interpretability probes, and fine-tuning to test whether a safeguard is shallow. Outside-the-box access is what makes targeted testing possible: without knowing the training data, an auditor cannot know which subpopulation is thin. Casper et al. conclude that an audit result cannot be interpreted without knowing the access and methods used.

Scope decides what the silence means

SMACTR's first stage exists to write scope down. In an external audit the question is who wrote it. Gender Shades chose its own scope and vendors. Under Local Law 144 the employer decides whether its tool is an "automated employment decision tool" at all, so when an employer posts nothing an investigator cannot tell non-compliance from a judgement that the tool is out of scope. Wright et al. call this null compliance: a state in which non-compliance cannot be ascertained. Scope also bounds negative findings: no disparity by sex and race says nothing about disability, age or language.

The sample decides how sharp the interval is

Fix scope; the measurand is an error rate per group. The auditor tests \(n_g\) cases from group \(g\) and sees \(x_g\) errors, so \(\hat p_g = x_g/n_g\). The naive Wald interval \(\hat p \pm z\sqrt{\hat p(1-\hat p)/n}\) fails exactly where audits live, at small rates and small groups, where it can go negative or collapse to zero width when \(x_g = 0\). Wilson's score interval (Wilson, 1927, JASA) inverts the score test instead:

With \(z = 1.96\) for 95% confidence, the centre is pulled toward one half by \(z^2/2n\), which keeps the interval inside \([0,1]\) and gives it honest width when no errors are observed.

A disparity audit wants \(d = p_A - p_B\). Newcombe's comparison of eleven methods recommends combining the two Wilson intervals \([\ell_A, u_A]\) and \([\ell_B, u_B]\) into a hybrid score interval (Newcombe, 1998, Statistics in Medicine):

The lower bound pools how far A's rate could fall and B's could rise. The asymmetry matters because in disparity audits the best-served group's error is often near zero, where its interval is lopsided.

For a target half-width \(w\) on the difference, the normal approximation gives

This is why audits of small gaps are expensive: halving \(w\) quadruples \(n\). Comparing \(k\) groups pairwise makes \(m = \binom{k}{2}\) comparisons, and a Bonferroni correction at a 5% family-wise rate replaces 1.96 with \(z_{1-0.025/m}\), about 2.64 for four groups (\(m = 6\)), multiplying the sample by \((2.64/1.96)^2 \approx 1.81\).

Precision is not power. To detect a true gap \(\Delta\) with power \(1-\beta\) at two-sided level \(\alpha\),

The first term guards against false alarms, the second against misses; sizing by the first alone misses a threshold-sized gap about half the time.

Inference: the absence claim

This is where reports most often overreach. Zero failures in \(n\) independent trials does not show a zero rate. The largest rate consistent with that at 95% confidence solves \((1-p)^n = 0.05\):

This is the clinical "rule of three" (Hanley & Lippman-Hand, 1983, JAMA). A red team that lands none of 300 attacks supports "this attack family's per-attempt success rate is probably below 1%", nothing about families not tried, and even that assumes independence that one attacker's shared strategy violates. The UK AI Security Institute reports finding universal jailbreaks for every system it has tested; in two safeguard tests six months apart the expert time needed rose from 10 minutes to over 7 hours (UK AISI, Frontier AI Trends Report). A fixed prompt set scores both as failures. What changed was attacker cost, which a success count cannot express.

Enforcement sits outside the chain

None of these links makes anything happen. In the 2022 survey, 65% of auditors said auditees will not commit to fixing what audits uncover. No first-party auditor reported lacking data access, against 58% of second-party and 50% of third-party auditors, yet third-party auditors were the ones free to publish. Access and independence trade off; that is the market's shape, not an individual failing.

Seeing It in Motion

Each access tier licenses a larger set of claims, and two claims stay out of reach at every tier.

flowchart TB
    subgraph Given["What the auditor is given"]
        BB["Black-box: query and observe"]
        GB["Grey-box: scores, activations"]
        WB["White-box: weights, gradients"]
        OB["Outside-the-box: data, docs"]
    end
    subgraph Licensed["What that licenses"]
        C1["Rates on tested inputs"]
        C2["Calibration and score gaps"]
        C3["Worst-case search"]
        C4["Targeted tests, root cause"]
    end
    subgraph Never["Licensed by no tier"]
        N1["Absence of a behaviour"]
        N2["Impact without deployment data"]
    end
    BB --> C1
    GB --> C2
    WB --> C3
    OB --> C4
    C1 -.-> N1
    C4 -.-> N2
    classDef blue fill:#1e40af,stroke:#3b82f6,stroke-width:1px,color:#fff
    classDef teal fill:#0e7490,stroke:#22d3ee,stroke-width:1px,color:#fff
    classDef rose fill:#be123c,stroke:#fb7185,stroke-width:1px,color:#fff
    class BB,GB,WB,OB blue
    class C1,C2,C3,C4 teal
    class N1,N2 rose

The dashed edges are the overreach: from "no failures observed" to "none exist", and from the model to its effect on people.

[IMAGE: A four-rung ladder labelled black, grey, white and outside-the-box access. Beside each rung, a speech bubble with the strongest sentence an auditor there may write, e.g. "The endpoint misclassified 94 of 271 darker-skinned women" at the bottom. Above the ladder, out of reach, two clouds: "This system is fair" and "This behaviour never occurs". Caption: "Access sets the ceiling on the sentence an audit report may write."]

The Gender Shades disclosure is the clearest record of an external audit producing change.

sequenceDiagram
    participant A as Auditors
    participant V as Named vendors
    participant P as Public
    participant N as Unnamed vendors
    A->>A: May 2017 black-box audit
    A->>V: 19 Dec 2017 anonymised results
    Note over V: Private response window
    A->>P: 9 Feb 2018 named results
    V->>P: New APIs after 66, 189, 190 days
    A->>V: 21 Aug 2018 re-audit
    A->>N: Same test on Amazon and Kairos
    Note over A,N: Unnamed vendors still at 22 to 31 percent

The private window allows a fix; publication cannot be vetoed. The non-targets make it a quasi-experiment suggesting naming drove the change, though they were chosen for visibility, not at random.

Local Law 144 has a lifecycle too, and the employer holds every branch.

stateDiagram-v2
    [*] --> ToolInUse
    ToolInUse --> OutOfScope: employer judges not an AEDT
    ToolInUse --> Audited: employer judges in scope
    Audited --> Favourable
    Audited --> Unfavourable
    Favourable --> Posted
    Unfavourable --> Posted
    Unfavourable --> NotPosted: litigation risk
    OutOfScope --> Invisible
    NotPosted --> Invisible
    Invisible --> Enforcement: complaint reaches DCWP
    Invisible --> [*]: no complaint
    Posted --> [*]

From outside, both paths into "Invisible" look identical: null compliance. The only exit is a complaint, a channel the Comptroller found largely disconnected.

[IMAGE: Funnel diagram: 391 NYC employers surveyed, then 18 posted audit reports, then 13 reports with 386 impact ratios, then 9 ratios below 0.8. A side branch marks "about 20% of ratios omitted under the 2% rule". Caption: "What a mandatory audit regime surfaced, from Wright et al. (2024)."]

By the Numbers

Sources: Buolamwini & Gebru, 2018 (Table 4); Raji & Buolamwini, 2019 (Tables 1–2); Costanza-Chock et al., 2022; Wright et al., 2024; NYS Comptroller; UK AISI; NIST, 2024; CIO, 2026. The Comptroller's summary says DCWP surveyed 32 companies; the one-versus-17 comparison covers 22 of them. The 2018 figures exclude faces the APIs failed to detect, so denominators differ slightly from 2017.

[IMAGE: Slope chart of darker-female error, May 2017 on the left axis and August 2018 on the right. IBM, Microsoft and Face++ slope steeply down; Amazon and Kairos appear only on the right as isolated warning-coloured dots at 31.37% and 22.50%. Caption: "Named vendors moved; unnamed ones sat where the named ones had started."]

A Concrete Example

You must audit a document-verification model for error-rate disparity across four applicant groups, with black-box access. How many labelled cases, and what can you then say? Calibrate on a known case first.

Step 1. Replay Gender Shades as an interval. PPB is 21.3% darker-female and 30.3% lighter-male, so of 1,270 faces about \(n_A = 271\) and \(n_B = 385\); IBM's 34.7% and 0.3% mean about \(x_A = 94\) and \(x_B = 1\).

• Wilson for A: \(\hat p_A = 0.347\), interval \([0.293, 0.405]\). For B: \(\hat p_B = 0.0026\), interval \([0.0005, 0.0146]\).
• Newcombe: \(\hat d = 0.344\), \(L = 0.344 - \sqrt{0.054^2 + 0.012^2} = 0.289\), \(U = 0.403\).

A 34.4-point gap, interval roughly 29 to 40 points: not noise. IBM's 2018 figure of 16.97% (about 46 of 271) gives a gap of 16.7 points, interval \([12.5, 21.6]\). The improvement is real and so is the remaining gap; the same arithmetic licenses both.

Step 2. Size the new audit. A pilot suggests 5% error for the worst group and 3% for the best.

• Half-width \(w = 0.02\), one comparison: \(n \approx 3.84 \times (0.0475 + 0.0291)/0.0004 \approx 736\) per group.
• Check: at 736 per group with 37 and 22 errors, the Newcombe interval is \([0.0002, 0.041]\). It barely excludes zero; one or two errors either way flips the conclusion.
• To detect the gap with 80% power (\(\bar p = 0.04\)): about 1,506 per group.
• For \(w = 0.01\): about 2,943 per group.
• Four groups pairwise, Bonferroni \(z \approx 2.64\), \(w = 0.02\): about 1,333 per group, 5,332 cases in total.

Step 3. Size the absence claim. The vendor wants "forgeries are never accepted". You run 1,000 forgeries and all are rejected: \(p_{\max} \approx 3/1000 = 0.3\%\). "Below 0.1%" needs about 3,000 clean trials, and only for the forgery techniques included, which is the scope question in statistical clothing.

Step 4. Check the small-group trap. One group is 2% of a 1,000-case historical sample: 20 people, 10 approved. Wilson gives \([0.30, 0.70]\); the reference group's 500 of 1,000 gives \([0.47, 0.53]\). A crude bound on the impact ratio runs from \(0.30/0.53 \approx 0.56\) to \(0.70/0.47 \approx 1.49\), consistent with both severe adverse impact and favouritism. That is why LL144's rules let auditors exclude categories under 2%, and why Wright et al. found 20% of ratios missing, mostly for Indigenous groups.

Step 5. Write the claim the audit can bear. "On 1,333 labelled documents per group from [stated distribution], tested through the production API on [date] against version [x], group A's error rate was 5.0% (95% CI 4.0–6.3%) and group B's 3.0% (2.2–4.1%); the Bonferroni-adjusted interval on the 2.0-point difference, 0.0 to 4.1 points, only just excludes zero. None of 1,000 forgeries using techniques [list] was accepted; the per-attempt rate for those techniques is below 0.3% at 95% confidence." No clause says "fair" or "secure".

[IMAGE: Log-scale plot of labelled cases per group (y) against target half-width in points (x, 0.5 to 5) for base rates 5% vs 3%, with three curves: single comparison, Bonferroni for four groups, and 80%-power detection. Dashed lines mark budgets of 200, 1,000 and 5,000 cases. Caption: "Halving the interval quadruples the cost; intersectional comparison nearly doubles it again."]

Where It Breaks

The test set becomes the target

The Gender Shades re-audit used the same public PPB, so it cannot distinguish a model that improved on darker-skinned women generally from one that improved on 271 parliamentarians. Falling overall error supports the first reading; only a refreshed held-out set would settle it. Frontier evaluations face worse: CAISI has written about models cheating on agentic evaluations (NIST CAISI).

The audited party controls the branches

Under LL144 the employer holds both scope and posting. Audit-industry workers in a companion interview study cited by Wright et al. said many tools on the market would fail the four-fifths rule and that some clients paid for audits and declined to post them. The authors say 9 of 386 below 0.8 fits publication bias without proving it. The mechanism need not be dishonesty. The law requires an audit but sets no result threshold, while federal anti-discrimination law makes a bad result evidence, so counsel can rationally advise silence.

Complaint-driven enforcement cannot see what is hidden

Screened-out applicants rarely know a tool screened them. The Comptroller found DCWP did not test whether its complaint intake worked, identified one issue where the Comptroller found at least 17, and missed that three employers' audits were not independent, two of them signed by an independent firm while the vendor ran the tests. DCWP disputed some findings while agreeing to adopt most recommendations in part or full, so this is a live disagreement.

Black-box results cannot locate the cause

When the joint UK AISI and CAISI team assessed Moonshot AI's Kimi K3 in July 2026, "the specifics of Kimi K3's hosting setup" limited them to a selective set of cyber evaluations (NIST, 2026).

Results decay, and subgroups multiply

IBM shipped a new model 66 days after disclosure, so the original audit described a product gone within two months. Meanwhile, four groups on three metrics is 18 pairwise comparisons; at an uncorrected 5% level a perfectly fair system still yields about one "significant" disparity. Collapsing to single-axis groups to save samples is the opposite error: Gender Shades showed the darker-female gap exceeded both the gender gap and the skin-type gap.

Alternative Designs

These cover different links. The adversarial audit has independence without access; internal audit the reverse. Government testing has access but chose its scope: recasting its institute as the AI Security Institute on 14 February 2025, the UK said it "will not focus on bias or freedom of speech" (GOV.UK, 2025). Structured access alone tries to break the access-independence trade-off technically; in March 2026 CAISI signed a research agreement with OpenMined on evaluations where "the underlying data, models, or benchmarks must remain confidential" (NIST, 2026).

How It Is Used in Practice

Frontier testing. The US AI Safety Institute's August 2024 memoranda with OpenAI and Anthropic gave it access to major new models "prior to and following their public release" (NIST, 2024). In June 2025 Commerce recast it as CAISI (Commerce, 2025), and in May 2026 Google DeepMind, Microsoft and xAI signed pre-deployment agreements, making five labs (CIO, 2026). These programmes establish capability and safeguard-robustness evidence in security domains; the per-model assessments CAISI publishes are mostly of foreign open-weight models such as DeepSeek V4 Pro and GLM-5.2.

Hiring and credit. LL144 audits compute each sex and race/ethnicity category's impact ratio against the most-selected one. Design logging before the audit: an audit on historical data can use only the demographic fields captured, and small groups vanish under the 2% rule unless deliberately oversampled in a test set.

Commissioning an audit. Four contract terms change what it can establish: the auditor sets or co-sets scope in writing; the report states its access tier; the auditee commits in advance to a response timeline (the 65% problem); and results carry sample sizes and intervals. Auditors disagree on mandates: 53% would require audits only for high-stakes systems, 42% for all; of those backing mandated disclosure, 39% want key metrics only and 42% full code and methodology.

[IMAGE: An annotated audit-report header with callouts on seven fields: model identifier and date, access tier, scope set by, sample size per group, intervals and correction method, absence claims as upper bounds, auditee response deadline. Caption: "Seven fields that decide what an audit report can be relied on for."]

Reading someone else's audit. If access tier, scope owner, version, per-group sample sizes or the publication decision is missing, downgrade it to "the auditee says".

[IMAGE: Two audit summary sentences side by side. Left, red border: "Our audit found the system to be free of bias." Right, green border: "1,333 cases per group, black-box, v4.2, 3 March 2026: max pairwise error gap 1.8 pts (95% CI −0.4 to 4.0, Bonferroni)." Caption: "The second is less comforting and far more useful."]

Insights Worth Remembering

1. An audit's output is an interval, not a verdict. "Fair" is a judgement about an interval; a report that skips to it hides what you needed.
2. Whoever controls scope, sample and publication controls what an audit can reveal. Gender Shades held all three and changed products; LL144 gave all three to the audited party.
3. Access and independence trade off. First-party auditors have access and cannot publish; half of third-party auditors can publish and lack access.
4. Absence claims are upper bounds. Zero failures in \(n\) trials supports a rate below about \(3/n\), for the attack family tested only.
5. Report robustness as attacker cost, not pass rate. Ten minutes to seven hours is progress a fixed prompt set cannot show.
6. Intersectional audits are expensive because statistics says so. Budgets of a few hundred cases find only large gaps, which is why the 20-to-34-point gaps were found first.
7. Naming works, on the named. Actionable Auditing's non-targets show public attribution moved the named vendors, not the market.
8. A mandated audit without a result threshold rewards not looking. When a bad result is evidence elsewhere, silence is the rational legal strategy.

Open Questions

Can structured access deliver white-box depth with third-party independence? Casper et al. argue secure environments can, and CAISI's OpenMined agreement funds the research. A routine external frontier audit run this way, with published results, has not yet been shown.

How much post-audit improvement is overfitting to the audit? Falling overall error on PPB suggests real change; an independent held-out re-test would settle it, and none appears in the published record from that period.

Would a result threshold fix LL144 or worsen it? A four-fifths floor gives audits consequences, and Wright et al.'s analysis implies it would also strengthen the incentive to declare tools out of scope. Whether it raises compliance or moves the evasion is an open empirical question.

Do government pre-deployment tests change release decisions? Five US labs now grant access, but public evidence that a finding delayed or altered a release is thin. That is measured absence of disclosure, not measured absence of effect.

How should audits handle systems that change weekly? Continuous monitoring on production logs is the likely answer, and needs the rarest access of all.

Sources and Further Reading

1. Sandvig, C., Hamilton, K., Karahalios, K., & Langbort, C. (2014). "Auditing Algorithms: Research Methods for Detecting Discrimination on Internet Platforms." ICA Data and Discrimination preconference. PDF
2. Buolamwini, J., & Gebru, T. (2018). "Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification." FAT* 2018, PMLR 81. proceedings.mlr.press
3. Raji, I. D., & Buolamwini, J. (2019). "Actionable Auditing: Investigating the Impact of Publicly Naming Biased Performance Results of Commercial AI Products." AIES 2019. doi:10.1145/3306618.3314244
4. Raji, I. D., Smart, A., et al. (2020). "Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing." FAT* 2020. arXiv:2001.00973
5. Costanza-Chock, S., Raji, I. D., & Buolamwini, J. (2022). "Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem." FAccT 2022. doi:10.1145/3531146.3533213
6. Casper, S., Ezell, C., et al. (2024). "Black-Box Access is Insufficient for Rigorous AI Audits." FAccT 2024. arXiv:2401.14446
7. Wright, L., Muenster, R. M., Vecchione, B., et al. (2024). "Null Compliance: NYC Local Law 144 and the Challenges of Algorithm Accountability." FAccT 2024. doi:10.1145/3630106.3658998
8. Office of the New York State Comptroller (2025). Enforcement of Local Law 144: Automated Employment Decision Tools. Report 2024-N-6. osc.ny.gov
9. UK AI Security Institute (2025). Frontier AI Trends Report. aisi.gov.uk
10. GOV.UK (14 February 2025). AI Security Institute announcement. gov.uk
11. NIST (29 August 2024). U.S. AI Safety Institute agreements with Anthropic and OpenAI. nist.gov
12. U.S. Department of Commerce (June 2025). Statement on transforming the U.S. AI Safety Institute into the Center for AI Standards and Innovation. commerce.gov
13. NIST (2026). CAISI CRADA with OpenMined; UK AISI / CAISI assessment of Kimi K3; CAISI hub page. nist.gov/caisi
14. CIO (6 May 2026). "US government agency to safety test frontier AI models before release." cio.com
15. Wilson, E. B. (1927). "Probable Inference, the Law of Succession, and Statistical Inference." JASA, 22, 209–212. doi
16. Newcombe, R. G. (1998). "Interval estimation for the difference between independent proportions: comparison of eleven methods." Statistics in Medicine, 17(8), 873–890. Wiley DOI
17. Hanley, J. A., & Lippman-Hand, A. (1983). "If Nothing Goes Wrong, Is Everything All Right?" JAMA, 249, 1743. doi

Free to read, no ads, no sign-up. If it was useful you can buy me a coffee.