My thoughts are similarly to SOC 2 type 2, which is that you can do different types of independent audits, whether it be financial, internal controls, cyber security.

But you still need to build the bounds of what you want and what the expectations are.

If you're going to audit software, you need to know what the expectations were when building the software.

Also, AI Assurance is becoming a large field in where these issues are being addressed and it is being performed by independent people.

Part of this auditing story is that it has also introduced lines of defense, so large companies have line 1, line 2 and line 3, all being different degrees of independence.

Basically this article is simply reminding us that you need independent review and verification and you can't trust the product to verify itself. It's nothing new, you need to review the outputs and the mechanics of everything that is important to the organisation. You must trust but verify all outputs and the tools should be able to provide you with that information AND someone must check it.