Which documents are essential for AI governance audits?

• A. Model cards, data lineage, data usage logs.
• B. Model cards, data lineage, data usage logs, risk assessments.
• C. Model cards, data lineage, data usage logs, risk assessments, test results.
• D. Model cards, data lineage, data usage logs, risk assessments, test results, change logs, and policy compliance records.

Answer: (D)

The main idea here is that a governance audit needs a complete, traceable record that covers what the model is, where the data came from, how data is used, the risks involved, how the model was tested, how changes were made over time, and evidence of policy adherence. When you include model cards, data lineage, data usage logs, risk assessments, test results, change logs, and policy compliance records, you provide a full, auditable trail that supports accountability, reproducibility, and regulatory alignment.

Each piece plays a crucial role: model cards describe the model’s capabilities, limitations, and intended uses; data lineage shows where data originated and how it was transformed; data usage logs reveal who accessed or processed data and under what purposes; risk assessments identify and document potential harms and mitigation strategies; test results demonstrate performance, safety, and reliability under specified conditions; change logs track version history and reasons for updates; policy compliance records provide evidence that policies and regulations are being followed. Together, they enable auditors to verify governance controls, trace decisions, and assess ongoing risk and compliance.

If any of these elements are missing, the audit would face gaps. For example, without change logs you can’t verify how the model evolved or why updates were made; without policy compliance records you can’t prove adherence to standards or laws; without test results you lack verified evidence of performance and safety. The full set ensures a robust, defendable audit trail.