Audits of AI-assisted development are new enough that the questions are still stabilising, but a pattern has emerged. These are the ones we see, and what a defensible answer looks like.
“Which AI tools are used on this codebase?”
The weak answer names the tools you have licensed. The strong answer names the tools that were observed on the repository during the period, which is a different list in almost every organisation. Shadow adoption is normal; discovering it during an audit is not a good moment.
“How much of this system was AI-generated?”
Any number without a definition attached will be probed until it collapses. Bring a definition with the figure: what counts as AI-authored, how ambiguity is resolved, and what proportion could not be attributed at all. Auditors are far more comfortable with a documented method and a wide unknown column than with a confident round number.
“Show us a specific change.”
This is where preparation shows. Pick a file in a sensitive directory and ask your team to produce the prompt that generated its current implementation. If that takes more than a minute, the record does not exist in a usable form.
“Could this record have been altered?”
“We trust our engineers” is not an answer. Either the record is append-only and verifiable, or it is a database somebody can edit. Chain verification that returns a pass or a named break is the difference between evidence and assertion.
The four gaps that cause the most trouble
Coverage. Machines with no recorder produce no record. Report that as unmonitored rather than letting silence read as clean.
History. Nothing can attribute code written before you started recording. Say so explicitly and give the date.
Model detail. Some tools do not expose which model answered. Leave the field empty rather than inferring it.
Review evidence. Approval timestamps are not proof of reading. Where you can show what the human changed after the agent's output, show it.
A dry run is cheap
Pick one regulated repository. Ask the four questions above and write down the answers you can actually produce today. The gaps will be obvious within an hour, and every one of them is easier to close before somebody external is asking.