Third Line AI Assurance: Close the Agentic AI Governance Gap

Third line assurance for AI must now deliver independent, continuous, evidence-first oversight that explicitly covers the governance gap created by agentic systems. SR 26-2 carves generative and agentic AI out of formal model risk management, and the NIST AI RMF calls for reviewers independent of development teams. Closing that gap requires tamper-evident, provenance-backed evidence rather than periodic attestations.

TL;DR:

• SR 26-2 excludes generative and agentic AI from formal model risk validation, so auditors must assign coverage through operational risk, vendor, and enterprise governance reviews.
• Keep internal audit independent: reviewers must not design or tune the systems they assess, and they need access to agent logs, documentation, and vendor contracts.
• Monitor agents that act autonomously in critical workflows continuously; validate new or high impact systems before and after launch, especially those affecting credit or underwriting.
• Require logs that reveal tampering, cryptographically signed evidence packs, and provenance linking each output to its inputs; auditors should verify signatures independently.
• Start with a complete agent inventory, rank systems by customer, financial, and regulatory impact, define evidence needs, then pilot continuous checks on one priority workflow.

Table of Contents

• What the third line of assurance covers for AI
• Regulatory and standards landscape shaping third line assurance
• How agentic and generative AI change assurance practice
• Practical assurance methods and evidence: what auditors should test and collect
• Organizing the third line: skills, tooling, and operating model changes
• How to implement continuous assurance for AI: practical steps and quick wins
• Methods for integrating AI governance tools like AETHER Pulse into existing third line assurance frameworks
• Case studies or examples of successful third line assurance implementation for AI systems in regulated financial firms
• How to validate and verify tamper-evident evidence packs
• Cross-functional collaboration between risk, compliance, and third line assurance
• Future trends in AI assurance for third line functions
• What agentic AI assurance actually demands from auditors
• How AETHER Pulse supports non-invasive, evidence-first third line assurance
• FAQ
• Sources

What the third line of assurance covers for AI

The third line exists to give the governing body an independent, organization-wide view of whether AI governance actually works, separate from the people who build or operate the systems. Under The IIA's Three Lines Model, internal audit reports to the governing body, not to management, and that reporting line is what makes its opinion on AI risk credible to boards and regulators.

That independence has to be operational, not just stated in a charter. Auditors reviewing an AI agent's decision logic or escalation controls cannot have helped design that logic. If they did, the assurance opinion becomes a self-review, and self-review is the fastest way to lose standing with a regulator or an audit committee.

A few principles keep this intact in practice:

• Internal audit stays out of AI development, model tuning, or control design work it will later be asked to opine on.
• The third line retains unfettered access to agent logs, model documentation, and vendor contracts, not summarized reports alone.
• Assurance findings go to the governing body on a cadence that matches the risk, not the audit calendar's convenience.

None of this makes the third line a replacement for the first and second lines. Management (first line) owns the controls that govern how AI agents operate day to day, and risk and compliance (second line) set policy and monitor adherence. The third line's job is to test whether those first and second line activities hold up under independent scrutiny, which is a distinct function from either building the controls or policing them in real time.

Regulatory and standards landscape shaping third line assurance

Several reference points now anchor serious conversations about AI assurance scope, and practitioners should be citing them directly in audit work papers rather than paraphrasing secondhand summaries.

SR 26-2 replaced SR 11-7 as the Federal Reserve's foundational model risk management guidance in April 2026, and it explicitly classifies generative and agentic AI as out of scope for formal model risk management validation. That creates what amounts to a two-track control model: traditional quantitative models stay under formal MRM, while agentic and generative systems get governed through third-party risk, operational risk, and enterprise governance frameworks instead. Analysts covering the change have noted that the guidance narrows model definitions without removing the underlying risk, which means agentic components sitting outside formal MRM can still produce downstream effects that remain squarely in scope for third line review.

The NIST AI RMF's Measure 1.3 explicitly mandates that assessments involve reviewers external to the development team, a structural safeguard against conflicts of interest that maps directly onto the independence requirement the third line already carries (NIST).

The IIA's own AI auditing framework ties internal audit's AI work to the Three Lines Model, expecting the function to provide both assurance and advisory input while drawing on other assurance providers when specialist skills are needed.

Together these three anchors tell audit leaders the same thing from different directions:

• Formal MRM no longer automatically covers agentic AI, so coverage has to be deliberately designed.
• Independent review requires reviewers who did not build the system being reviewed.
• Internal audit can and should draw on external assurance providers where internal capability falls short.

How agentic and generative AI change assurance practice

Agentic AI differs from earlier automation in ways that matter directly to assurance design: it acts with a degree of autonomy, often orchestrates multiple models and rule sets together, and can execute decisions rather than merely recommend them. Each trait raises the stakes for what the third line has to verify.

Autonomy means an agent can take an action, say approving a transaction or adjusting a credit limit, without a human in the loop at the moment of decision. That shifts assurance from reviewing a sample of past decisions to needing continuous visibility into what the agent is doing as it does it, with a clear trace of which action led to which outcome and what triggered any escalation.

Orchestration compounds the problem. When an agent chains together a language model, a rules engine, and a third-party data feed, a control failure in any one component can surface as a seemingly unrelated error somewhere downstream. EY's guidance on re-architecting assurance for agentic AI points out that agents can analyze the full population of transactions in real time rather than a sample, but auditors still need to apply professional skepticism and build genuine capability in AI transparency, not just trust the agent's own output.

Vendor dependency is the third pressure point. Many agentic deployments lean on external model providers or data services, and the third line needs assurance over those relationships too, not just the internal wrapper around them.

Practical implications for audit teams can be enhanced by adopting AI network monitoring methods that provide real-time insight and anomaly detection across infrastructure components.

• Build continuous monitoring into high-autonomy agents rather than relying on quarterly sampling.
• Map orchestration chains so a control failure can be traced to its actual source component.
• Extend vendor assurance procedures to cover any external model or data service an agent depends on.

Pro Tip: Treat every orchestration chain as a single control environment, even when it spans internal systems and third-party services, because a failure anywhere in the chain is a failure of the whole decision.

Practical assurance methods and evidence: what auditors should test and collect

Credible assurance over AI systems depends on evidence that was captured as the system operated, not reconstructed afterward from memory or management narrative. EY has found that agentic systems can support analysis of 100% of transactions rather than a sample, which raises the bar for what counts as sufficient audit evidence (EY).

A workable testing program for agentic and generative AI typically includes:

1. Control design review, confirming that escalation paths, override rights, and approval thresholds exist and match documented policy.
2. Results validation, comparing a sample of agent decisions against expected outcomes under defined scenarios.
3. Explainability checks, confirming the system can produce a human-readable rationale for a given decision on demand.
4. Bias and fairness testing, particularly where agent decisions affect credit, pricing, or eligibility outcomes.
5. Model drift monitoring, tracking whether performance or decision patterns shift meaningfully from the validated baseline.
6. Vendor assurance, extending the same scrutiny to any third-party model or data service the agent relies on.

The evidence that makes these tests defensible has specific characteristics: tamper-evident logs that cannot be quietly edited after the fact, cryptographically signed evidence packs that an auditor can verify independently of the system that generated them, deterministic provenance metadata showing exactly what inputs produced a given output, versioned model artifacts, and records of the testing itself.

Not every agent warrants the same intensity of scrutiny. High-frequency, mission-critical agents, the ones making decisions continuously and at scale, justify continuous monitoring. Newly deployed models and agents tied to high-impact decisions, like credit or underwriting, justify deeper point-in-time validation before and after launch, in addition to ongoing checks.

Organizing the third line: skills, tooling, and operating model changes

Auditing agentic AI well requires skills that many internal audit functions have not traditionally needed: enough ML literacy to question a model's design assumptions, familiarity with explainable AI (XAI) techniques, data forensics to trace an agent's decision back through its inputs, comfort configuring continuous monitoring tools, and the regulatory fluency to apply SR 26-2 and the NIST AI RMF correctly to a specific agent's risk profile.

Several operating model patterns are emerging among audit functions tackling this:

• A central AI audit center of excellence that develops methodology once and deploys it across business units.
• Embedded specialists who sit within audit teams covering high-AI-exposure business lines.
• Judicious use of external independent assurance providers where internal capability or independence is insufficient, consistent with what The IIA's framework explicitly allows.

Building this capability is rarely a single move. Most functions combine upskilling existing auditors on AI fundamentals, hiring a smaller number of dedicated data and ML specialists, and bringing in external experts for specific engagements where scale or independence requirements exceed internal bandwidth.

Pro Tip: Start capability-building with the auditors who already own your highest-risk business lines, since domain knowledge of the process being automated matters as much as technical AI fluency.

How to implement continuous assurance for AI: practical steps and quick wins

Moving from point-in-time reviews to continuous assurance does not require rebuilding the audit function overnight. A practical sequence looks like this:

1. Build a complete inventory of AI agents operating across the organization, including shadow deployments that business units may have stood up without formal sign-off.
2. Prioritize that inventory by impact, weighting agents that touch customer outcomes, financial exposure, or regulatory obligations above lower-stakes automation.
3. Define the specific evidence types required for each priority tier, from basic activity logs for low-risk agents to full provenance-tracked evidence packs for high-risk ones.
4. Instrument metadata-only provenance collection wherever possible, capturing what an agent did and why without needing direct access to the underlying production data.
5. Establish monitoring and alerting thresholds so the third line is notified of anomalies rather than discovering them during the next scheduled review.

A few moves generate disproportionate value early. Requiring tamper-evident metadata capture for the organization's most critical agents closes the biggest evidence gap fastest. Adding verifiable evidence requirements into vendor contracts means third-party dependencies do not become blind spots later. Piloting continuous checks on a single high-risk workflow, rather than attempting enterprise-wide rollout immediately, proves the model before scaling it.

Collaboration matters throughout this process. The third line should ask the second line for its existing control documentation and risk assessments as a starting point, and ask management for direct, unfiltered access to agent activity rather than curated summaries. Preserving independence means the third line defines what evidence it needs and when, rather than accepting whatever the first or second line chooses to provide.

Methods for integrating AI governance tools like AETHER Pulse into existing third line assurance frameworks

Governance platforms built for AI agent oversight tend to work best when they slot into an audit function's existing testing cycle rather than replacing it. The integration pattern that holds up involves mapping the tool's evidence outputs against the evidence types your audit program already requires, confirming the tool's access model does not create independence conflicts, and building a review cadence that matches the tool's monitoring frequency rather than the audit calendar's.

A metadata-only governance layer, one that connects via OAuth grants rather than embedding agents into production systems, fits naturally into this because it does not require the third line to grant it privileged access to the systems being audited. That matters for independence: a tool that touches customer data or sits inside the production pipeline raises the same self-review concerns as an auditor who helped build the system.

Practically, this means the third line can treat a governance tool's output, an agent inventory, a risk concentration map, a signed evidence pack, as one input into its own testing rather than as the audit opinion itself. The tool surfaces where to look; the auditor still forms the judgment. That division of labor keeps the assurance opinion independent while making the underlying evidence far more complete than manual log review alone could produce.

Case studies or examples of successful third line assurance implementation for AI systems in regulated financial firms

Regulated firms that have moved furthest on AI assurance tend to share a common pattern rather than a single playbook: they treat agent inventory as a prerequisite, not an afterthought. EY's recent work on enterprise-scale agentic AI emphasizes embedding agentic capability into audit workflows while explicitly preserving human judgment, a design choice that reflects how firms furthest along in AI assurance have structured their programs.

The common thread across firms that have made this work is sequencing: inventory first, risk tiering second, evidence requirements third, and only then does the audit methodology itself change. Firms that skip straight to buying monitoring tools without first establishing what the third line actually needs to see tend to end up with dashboards nobody on the audit team trusts enough to rely on for an opinion.

PwC's assurance work for AI frames this as services aligned to recognized standards like those from the AICPA, built specifically to evaluate control environments and give executives and regulators a credible basis for inquiry. That alignment to established standards, rather than a bespoke internal methodology invented from scratch, is what has let the furthest-along firms defend their AI assurance opinions under regulatory scrutiny.

How to validate and verify tamper-evident evidence packs

A tamper-evident evidence pack is only as useful as the third line's ability to independently confirm it has not been altered. The core mechanism to check is cryptographic signing, typically HMAC-SHA256 or an equivalent, which lets an auditor verify offline, without any dependency on the platform that generated the pack, that the contents match what was originally signed.

Verification in practice involves a few concrete checks: confirming the signature validates against the expected key, confirming timestamps in the pack are internally consistent with the events described, confirming the provenance metadata traces each output back to a specific, identifiable input, and confirming the evidence pack format is deterministic, meaning the same underlying event always produces the same evidence record rather than a reconstructed approximation.

The value of this approach is that it does not require the auditor to trust the vendor's dashboard or narrative. A deterministic, cryptographically signed pack can be handed to a regulator or an external auditor and checked independently of the system that produced it, which is precisely the kind of defensible evidence that formal model risk management historically demanded and that agentic AI, carved outside that formal scope under SR 26-2, now needs through other means.

Cross-functional collaboration between risk, compliance, and third line assurance

AI oversight breaks down fastest when risk, compliance, and internal audit each build separate pictures of the same agents using different inventories and different definitions of risk. Closing that gap starts with a shared agent inventory that all three functions reference, even though each function uses it differently: compliance for regulatory mapping, risk for exposure quantification, and audit for independent testing.

Second line risk and compliance teams typically own the ongoing monitoring and policy-setting for AI systems, while the third line tests whether that monitoring and those policies actually function as intended. That division only works if the second line shares its control documentation and monitoring output with audit proactively, and if audit, in turn, communicates back which gaps it finds without being drawn into fixing them directly.

Regular, structured touchpoints, not ad hoc requests, keep this collaboration from drifting into either duplication or blind spots. A regular cadence where risk, compliance, and audit jointly review the AI agent inventory and flag new or materially changed agents tends to catch governance gaps earlier than any single function working alone.

Future trends in AI assurance for third line functions

Regulatory expectations around AI are still moving, and the direction is consistent: more scrutiny on autonomous decision-making, not less. SR 26-2's carve-out for generative and agentic AI from formal model risk management is better read as a reallocation of oversight than a reduction in it, and firms should expect that reallocated oversight, through third-party risk, operational risk, and enterprise governance channels, to keep tightening.

Continuous assurance is likely to become the baseline expectation rather than a differentiator. EY's assurance research points to growing demand from stakeholders for independent verification of AI governance, fairness, data reliability, and explainability, which suggests boards and regulators alike will expect ongoing evidence rather than annual attestations.

Academic and practitioner frameworks are also converging on integrated models that combine predictive risk indicators, governance controls, and continuous assurance layers into a single structure rather than three separate programs, an approach described in recent EDPACS research on AI-governed audit assurance. For third line functions, the practical takeaway is to build evidence infrastructure now that can flex as specific regulatory requirements solidify, rather than waiting for a final rulebook that may never fully arrive.

What agentic AI assurance actually demands from auditors

The uncomfortable truth about agentic AI assurance is that most third line functions are still organized around a model of risk that agentic systems have already outgrown. Point-in-time testing assumes a system's behavior is stable enough to characterize with a sample, and agentic systems built to adapt and act continuously break that assumption by design. The real failure mode is not a lack of frameworks, there are now several credible ones, but a lag between how fast agentic deployments scale inside an organization and how fast the third line can build the technical fluency to question them credibly.

The received wisdom that independence means staying at arm's length from technical detail no longer holds. An auditor who cannot read a provenance trail or question a drift metric is not independent in any meaningful sense; they are simply uninformed, which is a different and more dangerous thing. The firms getting this right are not the ones with the most elaborate AI audit charter. They are the ones that gave their auditors enough technical grounding to ask a genuinely hard question and enough evidence infrastructure to get a verifiable answer.

— Eleye

How AETHER Pulse supports non-invasive, evidence-first third line assurance

Closing the gap SR 26-2 opened does not require inserting new tooling into production systems that the third line already has to treat carefully. We built AETHER Pulse as a read-only, metadata-only layer that gives regulated firms visibility into their AI agents without touching customer data or sitting inside operational pipelines.

What we generate are tamper-evident, cryptographically signed (HMAC-SHA256) evidence packs that an auditor or regulator can verify independently, exactly the kind of defensible artifact that agentic AI's exclusion from formal model risk management now demands through other channels.

We offer a few ways to get started:

• Free, Pro, and Enterprise plans, available through our product page, for teams at different stages of AI governance maturity.
• Design Partner and Production engagements, along with an Article 26 readiness audit, detailed on our pricing page, for firms preparing specifically for EU AI Act Article 26 obligations.

If your third line needs verifiable, audit-ready evidence over agentic AI without expanding your production risk surface, explore our plans and find the option that matches where your governance program stands today.

FAQ

What does third party assurance mean?

Third party assurance refers to an independent review performed by a party outside the organization being assessed, often used interchangeably with external audit or vendor assurance. In the context of AI governance, it typically means an outside firm or specialist verifies controls, evidence, or compliance claims that internal teams cannot credibly verify themselves due to independence concerns.

What are the 1st, 2nd, and 3rd lines of defense?

The first line is management and operational staff who own and run the controls day to day. The second line is risk and compliance functions that set policy and monitor adherence, and the third line is internal audit, which provides independent assurance to the governing body on how well the first two lines are actually working, per The IIA's Three Lines Model.

What is an AI assurance?

AI assurance is the independent verification that an AI system's governance, controls, data, and outcomes meet defined standards for safety, fairness, and compliance. It typically covers explainability, bias testing, drift monitoring, and evidence that decisions can be traced back to their inputs, often guided by frameworks like the NIST AI RMF.

What are the four types of assurance?

Assurance can be described along a spectrum from management self-assessment, to second line monitoring and testing, to third line independent audit, to external third-party assurance from outside the organization entirely. Each type offers a different degree of independence, with external third-party assurance generally considered the most independent and internal self-assessment the least.

How does AETHER Pulse fit into third line AI assurance work?

We provide a metadata-only, read-only layer that builds an agent inventory and generates tamper-evident, cryptographically signed evidence packs auditors can verify independently of our platform. Because we never access production data or embed agents into live systems, our evidence collection does not create the kind of independence conflict that invasive governance tooling can introduce for a third line team.

Sources

• Airc
• Re-architecting assurance with agentic AI | EY - US