When a customer demands an audit: what it costs to be wrong
A customer's audit demand is rarely random. It usually signals that the customer itself carries obligations — often around cybersecurity or AI compliance — and needs assurance from its suppliers before it can sign off its own file. Refuse without structure, and the dispute becomes about the contract rather than the facts. Hand over access without a plan, and you give more than the clause ever required.
Why customers ask for audits now
Two developments changed customer behaviour toward suppliers. Under Directive (EU) 2022/2555 (NIS2), organisations classified as essential or important entities have to manage risk arising from their suppliers and service providers, not only from their own systems. Under Regulation (EU) 2024/1689 (AI Act), a deployer of a high-risk AI system carries due-diligence duties toward the providers and components it relies on. A customer audit is frequently how that duty gets discharged on the customer's side. It is a compliance step on their file, not necessarily a sign of distrust in yours.
That context matters for how you respond. A demand rooted in the customer's own regulatory exposure is usually structured, documented, and repeatable — it will come again next year. A demand rooted in a one-off dispute or a specific incident tends to be narrower and more urgent. The two calls for different handling, and confusing them is where most of the cost sits.
What it costs to get the response wrong
Three failure patterns repeat. First, treating every audit request as identical to the contract clause, when the clause and the customer's actual ask have drifted apart over the life of the relationship. Second, providing access before scope is agreed in writing, which removes your ability to argue later that something fell outside the clause. Third, silence — letting a contractual response deadline pass without acknowledgement, which converts a scoping disagreement into a breach argument regardless of the merits.
None of these failures require the customer to be right about the underlying compliance point. They only require you to have handled the process badly. That is the part within your control, and the part that is usually mishandled under time pressure.
What to do, in order
- Acknowledge the request in writing within whatever window the contract sets, and record the date it arrived.
- Read the audit clause literally. Note what it covers, not what the customer's email assumes it covers.
- Assign one internal owner — typically the person accountable for information security — to coordinate every exchange from this point.
- Assemble only the records the clause actually requires. Do not volunteer systems, logs, or personnel beyond that scope.
- Propose a format and a window: a document review before any request for live system or on-site access.
- Log what was provided, to whom, and when. If the scope is disputed later, this record is the evidence.
Who decides, and on what evidence
Scope is decided by the contract first. If the audit clause is clear, its wording governs what the customer can ask for and what you must produce — this is a matter of interpretation, not negotiation, once the clause is agreed. If the clause is silent or ambiguous, the parties negotiate scope directly, and the paper trail from step one onward becomes the evidence of what was reasonable.
| Track | What triggers it | Who sets the scope | What counts as evidence |
|---|---|---|---|
| Contractual audit | A clause in the agreement, invoked by the customer | The wording of the clause itself | The written scope proposal and the acknowledgement trail |
| Regulatory or supply-chain audit | The customer's own obligations toward its supervisory authority | The customer's compliance requirements, filtered through the contract | Documentation the customer can pass upward, plus the same contractual scope |
Where the two tracks overlap — a contractual clause invoked because of the customer's own NIS2 or AI Act duties — the contract still sets the boundary of what you owe. The regulatory background explains why the request exists; it does not enlarge the clause.
Which fork applies to you
If the demand rests on a contractual audit clause and you believe the clause does not cover what is being asked, the disagreement is about interpretation, not compliance. See When an audit clause is refused explained for how that argument is usually framed.
If the audit uncovers work product built during the engagement — configurations, adaptations, or code changes — ownership of that work can become a separate dispute running alongside the audit itself. See When a customer wants ownership of improvements in detail.
If the underlying goods also move across a border and the relevant authority becomes customs rather than the customer, the shape of the problem changes entirely. See When a customs authority detains a shipment and its.
If the product in question is a tokenised asset and the customer's real concern is disclosure rather than security, the trigger for review is different again. See When a white paper needs an update explained.
What this page does not decide
This page does not set the specific procedural deadlines your contract contains — only your contract does that. It does not cover a regulator's own inspection powers, which follow separate procedures from a customer's contractual request. And it does not address disputes that have already reached a formal claim; at that point the question stops being one of process and becomes one of substance.
Verified
Checked against primary sources on 14 January 2025. Regulation (EU) 2024/1689 (AI Act) enters into application from 2 August 2026 (date current as of the 14 January 2025 check; treat this date as subject to change). Directive (EU) 2022/2555 (NIS2) has applied since 18 October 2024. Primary sources: the consolidated text of the AI Act on EUR-Lex, and the European Commission's NIS2 policy page.
FAQ
What is the first step when a customer demands an audit?
Acknowledge the request in writing within the timeframe your contract sets, note the date, and read the audit clause literally before agreeing to anything.
Which deadline is already running?
Whatever response window the contract fixes for audit or information requests starts running from the date the demand arrives, not from the date you begin working on it.
Who decides, and on what evidence?
The audit clause decides scope if it is clear. Where it is silent, the written record of what was requested, proposed, and provided becomes the evidence the parties argue from.
Related
A parallel failure mode sits upstream of the audit itself: see When records of processing are incomplete: what it costs.