AI Audits with the Three Zones Framework
Which decisions may your AI take alone, which may it only propose, and which must stay human? We audit the answer, and the evidence behind it.
The Three Zones Framework
Our audits are built on the Three Zones Framework (in French, « le Modèle des 3 Zones »), created by Michel Fotsing in his book L’Architecte Numérique : Orchestrer les intelligences à l’ère de l’IA (2026). It sorts every decision an organization makes into three zones, each with its own rule and its own controls. The reference definition is published in French.
Automated Zone
“The human does not touch.”
The machine decides, in milliseconds. Repetitive, measurable and reversible decisions, where an error can be corrected without lasting harm.
What we audit: We test monitoring, error thresholds, reversibility, drift detection and the ability to stop the system.
Augmented Zone
“AI proposes, the human decides.”
Human and machine work together. The AI widens the field, speeds up and proposes; the decision belongs to an identifiable person.
What we audit: We test whether human review is real: named decision owners, override rates, evidence of review, and signs of rubber-stamping.
Sanctuary Zone
“Zero algorithm.”
The human alone decides: empathy, ethics, long-term vision. The legitimacy of the decision comes from the person who takes it.
What we audit: We verify that no algorithm has crept in, including AI features added by vendors and tools staff use on their own.
Audits we perform
Led by Michel Fotsing, CISSP and PECB-certified ISO/IEC 42001 Lead Auditor.
AI System Audit
One AI system, end to end: its purpose, data, decisions, controls and the evidence behind them.
AI Agent Audit
Agents that book, buy, approve or change things: permissions, thresholds, escalation, logs and the boundary between what they do alone and what they only propose.
Third-Party AI Audit
AI embedded in the software you buy: what it decides on your behalf, and whether your contracts and controls cover it.
Pre-Certification Internal Audit
An internal audit of your AI management system against ISO/IEC 42001 before the certification audit, with the Three Zones map as supporting evidence.
How the audit works
Map
Inventory the decisions your AI touches and place each one in a zone, as it is today and as it should be.
Test
Test the controls each zone requires, with interviews, sampling and evidence review.
Report
Findings graded by severity, including “zone drift”: decisions sitting in the wrong zone.
Fix
A remediation roadmap mapped to ISO/IEC 42001 Annex A and the NIST AI RMF.
What you receive
- Three Zones decision map of your AI use
- Audit report with graded findings and evidence
- Mapping of findings to ISO/IEC 42001 and the NIST AI RMF
- Remediation roadmap, prioritized
- Executive briefing for leadership or the board
Independence
An audit is only useful if the auditor did not build what is being audited. We do not audit systems we designed or implemented for you.
An IOA-Tech audit is not a certification: ISO/IEC 42001 certificates are issued only by accredited certification bodies. Our work is technical and organizational; it is not legal advice. For the full path to certification, see AI Governance & ISO/IEC 42001 Readiness.
Is your AI in the right zone?
Book a 30-minute call. We will pick one AI system or agent and show you how the audit would map it.
Book an Audit Call