When a customer demands an audit: what to do first
A customer's demand for an audit is a formal trigger, not an administrative request. Before any date is agreed, confirm the legal basis for the demand, locate the clause or notice that authorises it, and identify who inside your organisation owns the response. Nothing is produced, and no access is granted, until scope and basis are confirmed in writing.
Where the demand usually comes from
Most audit demands trace back to a clause inside the services agreement itself, not to a regulator acting directly. If your customer falls under Directive (EU) 2022/2555 (NIS2), its own supply chain risk management obligations require it to assess suppliers, and an audit of your organisation may be exactly that assessment. The deadline you are feeling did not originate with you; it originated with the customer's own regulator.
Where no contractual clause and no such regulatory driver exist, the demand still deserves a written basis before you respond. Ask the customer to state, in writing, which obligation or which clause the audit rests on. A verbal request, however senior the source, is not a basis for opening your systems or your records.
What changes once the demand lands
Once a customer raises an audit demand in writing, an internal clock usually starts, even where no statute sets a deadline. The applicable notice period is defined in the clause itself; it is a contractual term, not a statutory one, and its length varies from agreement to agreement. Read that clause before you calculate anything else.
If the audit is tied to a suspected security incident, separate breach-notification timelines may already be running under the applicable data protection framework, independent of anything the audit clause says. Treat those two clocks as separate from the outset. Confusing them is the most common cause of a late notification.
Reading the demand
Not every audit demand means the same thing, and the correct first move depends on what actually triggered it. The table below sorts the common patterns.
| Type of demand | What it usually signals | Immediate step |
|---|---|---|
| Contractual audit clause invoked | Customer exercising a right written into your agreement | Read the clause before replying to anything |
| Security questionnaire escalated to a full audit | Customer's own supply chain review, often driven by NIS2 | Ask which of the customer's own obligations is driving it |
| Audit request relayed from a regulator | Customer passing on a supervisory enquiry, not raising its own request | Treat as regulatory correspondence, not commercial correspondence |
| Audit tied to a suspected incident | Customer investigating a breach or a near-miss involving your systems | Preserve every record; delete nothing |
What to do first
- Locate the clause or written request that authorises the audit, and read its scope, notice period and confidentiality terms in full.
- Confirm who actually requested it — the customer's own compliance team, its regulator, or an external assessor acting on its behalf.
- Notify your data protection contact and legal counsel before a single document leaves the building.
- Map what the audit actually covers: processing records, security controls, a subprocessor list, or all three at once.
- Agree the format in writing — remote review, on-site visit, or written questionnaire — and confirm that agreement back to the customer in writing.
- Set a single point of contact, so answers stay consistent and nothing gets disclosed twice, or contradicted later.
Who decides, and on what evidence
The audit clause itself decides scope and format. Where the demand originates from a supply chain obligation such as one under NIS2, the customer's own compliance function is accountable for the outcome, not yours. Internally, whoever owns the contract — usually the account lead, together with whoever is responsible for data protection — decides how the response is coordinated and staffed.
Evidence produced should match the written request exactly: nothing broader, and nothing narrower. Volunteering material that was never asked for widens the audit's scope without widening its notice period, which is rarely to your advantage.
Where this splits
If the system or product under audit qualifies as a high-risk AI system under Regulation (EU) 2024/1689 (AI Act), the audit will also need to cover conformity documentation, not only data protection records. Confirm classification before you scope the response.
If the audit request also touches limits on how the customer may use technology you have licensed to it, that is a separate licensing question, not a data protection one — see When field-of-use limits are ignored and its limits.
If the customer's audit is followed by a claim that your distributor infringed a patent, keep the two files separate from the start — see A distributor is sued over your product patent in.
If your agreement assigns ownership of improvements the customer raises during the audit, resolve that question on its own terms, not as part of the audit response — see When a customer wants ownership of improvements in practice.
If the product under audit is a tokenised offering, its white paper may need an update once the audit closes and any findings are addressed — see When a white paper needs an update step by.
What this page does not resolve
This page does not replace the audit clause written into your own contract, and it does not tell you what a specific regulator will accept as sufficient evidence. Where the demand touches personal data at scale, or a security incident is already suspected, treat this page as a starting point for legal advice, not as a substitute for it.
Checked
Checked against the official texts of Directive (EU) 2022/2555 (NIS2) and Regulation (EU) 2024/1689 (AI Act), as published by the European Commission and EUR-Lex. No case law and no national implementing measure is cited on this page, since neither is confirmed in the register for this topic. Contractual audit clauses vary by agreement and are not standardised at EU level; verify the specific clause in your own contract before acting on any of the above.
Related situations
An audit demand sometimes surfaces alongside gaps in your own processing records. If your records of processing are incomplete, close that gap first, ideally before the audit begins — see When records of processing are incomplete in practice.
Frequently asked questions
What is the first step when a customer demands an audit?
Locate the clause or written request that authorises the audit, and confirm its scope and notice period before agreeing to any date or format.
Which deadline is already running?
Any notice period is contractual, set by your own agreement, not by statute. Where a security incident is suspected, separate breach-notification timelines under the applicable data protection framework may already be running independently of the audit clause.
Who decides, and on what evidence?
The clause decides scope and format. Your contract owner and your data protection contact decide how the response is coordinated internally, and the evidence produced should match the written request exactly — no more, and no less.