{"id":"https://openalex.org/W7131647023","doi":"https://doi.org/10.3389/frai.2026.1759211","title":"Audit-as-code: a policy-as-code framework for continuous AI assurance","display_name":"Audit-as-code: a policy-as-code framework for continuous AI assurance","publication_year":2026,"publication_date":"2026-02-26","ids":{"openalex":"https://openalex.org/W7131647023","doi":"https://doi.org/10.3389/frai.2026.1759211","pmid":"https://pubmed.ncbi.nlm.nih.gov/41837238"},"language":"en","primary_location":{"id":"doi:10.3389/frai.2026.1759211","is_oa":true,"landing_page_url":"https://doi.org/10.3389/frai.2026.1759211","pdf_url":null,"source":{"id":"https://openalex.org/S4210197006","display_name":"Frontiers in Artificial Intelligence","issn_l":"2624-8212","issn":["2624-8212"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Artificial Intelligence","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3389/frai.2026.1759211","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126926796","display_name":"Aoun E. Muhammad","orcid":null},"institutions":[{"id":"https://openalex.org/I146367977","display_name":"Applied Science Private University","ror":"https://ror.org/01ah6nb52","country_code":"JO","type":"education","lineage":["https://openalex.org/I146367977"]},{"id":"https://openalex.org/I194028371","display_name":"University of Regina","ror":"https://ror.org/03dzc0485","country_code":"CA","type":"education","lineage":["https://openalex.org/I194028371"]},{"id":"https://openalex.org/I4210163116","display_name":"Applied Science University","ror":"https://ror.org/059zrbe49","country_code":"BH","type":"education","lineage":["https://openalex.org/I4210163116"]}],"countries":["BH","CA","JO"],"is_corresponding":false,"raw_author_name":"Aoun E. Muhammad","raw_affiliation_strings":["Faculty of Engineering and Applied Science, University of Regina"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Engineering and Applied Science, University of Regina","institution_ids":["https://openalex.org/I146367977","https://openalex.org/I194028371","https://openalex.org/I4210163116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126279691","display_name":"Kin-Choong Yow","orcid":null},"institutions":[{"id":"https://openalex.org/I146367977","display_name":"Applied Science Private University","ror":"https://ror.org/01ah6nb52","country_code":"JO","type":"education","lineage":["https://openalex.org/I146367977"]},{"id":"https://openalex.org/I194028371","display_name":"University of Regina","ror":"https://ror.org/03dzc0485","country_code":"CA","type":"education","lineage":["https://openalex.org/I194028371"]},{"id":"https://openalex.org/I4210163116","display_name":"Applied Science University","ror":"https://ror.org/059zrbe49","country_code":"BH","type":"education","lineage":["https://openalex.org/I4210163116"]}],"countries":["BH","CA","JO"],"is_corresponding":false,"raw_author_name":"Kin-Choong Yow","raw_affiliation_strings":["Faculty of Engineering and Applied Science, University of Regina"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Engineering and Applied Science, University of Regina","institution_ids":["https://openalex.org/I146367977","https://openalex.org/I194028371","https://openalex.org/I4210163116"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124321786","display_name":"Shrooq Alsenan","orcid":null},"institutions":[{"id":"https://openalex.org/I106778892","display_name":"Princess Nourah bint Abdulrahman University","ror":"https://ror.org/05b0cyh02","country_code":"SA","type":"education","lineage":["https://openalex.org/I106778892"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Shrooq Alsenan","raw_affiliation_strings":["Department of Information Systems, College of Computer and Information Sciences, Princess Nourah Bint Abdurahman University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Systems, College of Computer and Information Sciences, Princess Nourah Bint Abdurahman University","institution_ids":["https://openalex.org/I106778892"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2125,"currency":"USD","value_usd":2125},"apc_paid":{"value":2125,"currency":"USD","value_usd":2125},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.17989133,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":null,"first_page":"1759211","last_page":"1759211"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.6384999752044678,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11986","display_name":"Scientific Computing and Data Management","score":0.6384999752044678,"subfield":{"id":"https://openalex.org/subfields/1802","display_name":"Information Systems and Management"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.08820000290870667,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.06499999761581421,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/verifiable-secret-sharing","display_name":"Verifiable secret sharing","score":0.6434000134468079},{"id":"https://openalex.org/keywords/traceability","display_name":"Traceability","score":0.6294999718666077},{"id":"https://openalex.org/keywords/operationalization","display_name":"Operationalization","score":0.6291000247001648},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.6079000234603882},{"id":"https://openalex.org/keywords/corporate-governance","display_name":"Corporate governance","score":0.4880000054836273},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.44589999318122864},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.39329999685287476}],"concepts":[{"id":"https://openalex.org/C85847156","wikidata":"https://www.wikidata.org/wiki/Q59015987","display_name":"Verifiable secret sharing","level":3,"score":0.6434000134468079},{"id":"https://openalex.org/C153876917","wikidata":"https://www.wikidata.org/wiki/Q899704","display_name":"Traceability","level":2,"score":0.6294999718666077},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.6291000247001648},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.6079000234603882},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5964999794960022},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.5702000260353088},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5054000020027161},{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.4880000054836273},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.44589999318122864},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4146000146865845},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.39329999685287476},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.3224000036716461},{"id":"https://openalex.org/C106436119","wikidata":"https://www.wikidata.org/wiki/Q836575","display_name":"Quality assurance","level":3,"score":0.31690001487731934},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.31349998712539673},{"id":"https://openalex.org/C139458680","wikidata":"https://www.wikidata.org/wiki/Q12184942","display_name":"Interoperation","level":3,"score":0.30000001192092896},{"id":"https://openalex.org/C35084680","wikidata":"https://www.wikidata.org/wiki/Q848201","display_name":"Requirements traceability","level":5,"score":0.2775999903678894},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.2750000059604645},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2702000141143799},{"id":"https://openalex.org/C111498074","wikidata":"https://www.wikidata.org/wiki/Q173326","display_name":"Formal verification","level":2,"score":0.2648000121116638},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.26109999418258667},{"id":"https://openalex.org/C116253237","wikidata":"https://www.wikidata.org/wiki/Q1437424","display_name":"Formal specification","level":2,"score":0.2554999887943268},{"id":"https://openalex.org/C51687143","wikidata":"https://www.wikidata.org/wiki/Q295600","display_name":"QA/QC","level":5,"score":0.25540000200271606}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.3389/frai.2026.1759211","is_oa":true,"landing_page_url":"https://doi.org/10.3389/frai.2026.1759211","pdf_url":null,"source":{"id":"https://openalex.org/S4210197006","display_name":"Frontiers in Artificial Intelligence","issn_l":"2624-8212","issn":["2624-8212"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Artificial Intelligence","raw_type":"journal-article"},{"id":"pmid:41837238","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/41837238","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in artificial intelligence","raw_type":null},{"id":"pmh:oai:doaj.org/article:7dfae51682bc437f83cfd9a625cd129e","is_oa":false,"landing_page_url":"https://doaj.org/article/7dfae51682bc437f83cfd9a625cd129e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Frontiers in Artificial Intelligence, Vol 9 (2026)","raw_type":"article"},{"id":"pmh:oai:pubmedcentral.nih.gov:12979488","is_oa":true,"landing_page_url":"https://pmc.ncbi.nlm.nih.gov/articles/PMC12979488/","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Front Artif Intell","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.3389/frai.2026.1759211","is_oa":true,"landing_page_url":"https://doi.org/10.3389/frai.2026.1759211","pdf_url":null,"source":{"id":"https://openalex.org/S4210197006","display_name":"Frontiers in Artificial Intelligence","issn_l":"2624-8212","issn":["2624-8212"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320527","host_organization_name":"Frontiers Media","host_organization_lineage":["https://openalex.org/P4310320527"],"host_organization_lineage_names":["Frontiers Media"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Frontiers in Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.48501062393188477,"id":"https://metadata.un.org/sdg/12","display_name":"Responsible consumption and production"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320322484","display_name":"Princess Nourah Bint Abdulrahman University","ror":"https://ror.org/05b0cyh02"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W2100531526","https://openalex.org/W2258576229","https://openalex.org/W2282821441","https://openalex.org/W2594475271","https://openalex.org/W2897042519","https://openalex.org/W2927351257","https://openalex.org/W2967730222","https://openalex.org/W2974071289","https://openalex.org/W2979468846","https://openalex.org/W3092263108","https://openalex.org/W3124443940","https://openalex.org/W3157059443","https://openalex.org/W3159435787","https://openalex.org/W3160887439","https://openalex.org/W3202183072","https://openalex.org/W3212368439","https://openalex.org/W3216065183","https://openalex.org/W4206081915","https://openalex.org/W4206547830","https://openalex.org/W4220919730","https://openalex.org/W4283159491","https://openalex.org/W4283168787","https://openalex.org/W4288702531","https://openalex.org/W4386428447","https://openalex.org/W4387356964","https://openalex.org/W4389096344","https://openalex.org/W4390320013","https://openalex.org/W4391530326","https://openalex.org/W4396928770","https://openalex.org/W4396973423","https://openalex.org/W4400545115","https://openalex.org/W4401117479","https://openalex.org/W4403612607","https://openalex.org/W4404575139","https://openalex.org/W4410282389","https://openalex.org/W4411078819","https://openalex.org/W4414706442","https://openalex.org/W7078083422"],"related_works":[],"abstract_inverted_index":{"Introduction:":[0],"Existing":[1],"AI":[2,161,218,243],"assurance":[3,64,244],"and":[4,13,56,84,100,113,129,136,166,179,192,205,220,256],"governance":[5,70,112,155,235],"frameworks":[6],"rely":[7],"heavily":[8],"on":[9,184,216],"documented":[10],"written":[11],"policies":[12],"manual":[14],"reviews":[15],"of":[16,26,80,120],"the":[17,24,32,48,103,108,111,117,154,180,208],"implementation.":[18],"The":[19],"primary":[20,118],"challenge":[21],"is":[22,123],"not":[23],"length":[25],"these":[27,131],"documents,":[28],"but":[29],"to":[30,53,72,91,230,251,260],"operationalize":[31],"gap":[33],"from":[34,246],"transforming":[35],"qualitative":[36],"requirements":[37,71,132],"into":[38,133],"verifiable":[39],"controls.":[40],"This":[41,59,168],"approach":[42,169],"makes":[43],"ensuring":[44],"continuous":[45,63],"compliance":[46,206],"through":[47],"development":[49],"life":[50],"cycle":[51],"hard":[52],"enforce,":[54],"scale,":[55],"reproduce.":[57],"Methods:":[58],"study":[60,122],"presents":[61],"a":[62,78,186,223,247,252],"framework":[65,109,181,215],"called":[66],"Audit-as-Code":[67,241],"that":[68,75,152],"maps":[69],"technically-auditable":[73],"rules,":[74],"can":[76,188,227],"be":[77,196,228],"combination":[79],"versioned":[81],"policy":[82,249],"specification":[83],"executable":[85],"checks":[86,135],"for":[87,203,207],"evidence":[88,93,225],"artifacts,":[89],"linked":[90],"structured":[92],"regarding":[94,102],"data,":[95],"models,":[96],"provenance,":[97],"performance,":[98],"decisions,":[99],"explanations":[101],"decisions":[104,138,174,183],"being":[105],"made.":[106],"While":[107],"addresses":[110],"regulatory":[114],"mapping":[115],"requirements,":[116],"focus":[119],"this":[121,144,214],"MLOps/CI-CD":[124],"(continuous":[125],"integration/continuous":[126],"delivery)":[127],"operationalization,":[128],"turning":[130],"deterministic":[134],"gate":[137],"integrated":[139],"in":[140,171],"operational":[141],"workflows.":[142],"In":[143,238],"study,":[145],"we":[146],"introduce":[147],"an":[148],"assured":[149],"readiness":[150],"score":[151],"integrates":[153],"risk":[156,177],"with":[157,175],"other":[158],"key":[159],"responsible":[160],"principles,":[162],"such":[163],"as":[164],"traceability":[165],"explainability.":[167],"helps":[170],"aligning":[172],"deployment":[173],"predefined":[176],"tiers,":[178],"automates":[182],"whether":[185],"system":[187],"proceed,":[189],"requires":[190],"remediation":[191],"fixes,":[193],"or":[194],"should":[195],"blocked.":[197],"It":[198],"also":[199],"provides":[200],"targeted":[201],"suggestions":[202],"improvement":[204],"lags":[209],"identified.":[210],"Results:":[211],"We":[212],"evaluated":[213],"representative":[217],"systems":[219],"demonstrated":[221],"how":[222],"single":[224],"bundle":[226],"used":[229],"support":[231],"assessment":[232],"across":[233],"different":[234],"regulations.":[236],"Discussion:":[237],"doing":[239],"so,":[240],"ensures":[242],"transforms":[245],"documentation-driven":[248],"module":[250,259],"quantitative,":[253],"auditable,":[254],"reproducible,":[255],"operationally":[257],"practical":[258],"ensure":[261],"compliance.":[262]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-02-27T00:00:00"}