What must an AI audit trail record?
Enough to answer one question under pressure: who used which model, on what data, and who approved the result. If your log can't reconstruct a single published piece end to end, it isn't an audit trail — it's a rumour. Here's the minimum set of fields, with an example log.
Rules & compliance
“An audit trail earns its name the day a regulator asks 'what happened here?' and you answer in one lookup.”
The answer in 30 seconds
- →An AI audit trail must let you reconstruct any published piece: who ran it, which model, on what data, with what prompt, and who approved the output.
- →Record the data class (e.g. “customer PII”), not a copy of the data itself — the log should prove what happened without becoming a second breach surface.
- →Entries must be timestamped, tamper-evident and immutable. A log you can quietly edit proves nothing to a regulator.
- →The test: pick one piece of content and try to answer “what happened here?” in a single lookup. If you can't, add fields until you can.
What must every entry capture?
Six things, every time. The actor (a real identity, not “the AI”). The model and version. The input data class. The prompt or task. The output and where it went. And the human decision — approved, edited or rejected, by whom. Miss any one and the story breaks: a model with no version can't be traced after an update; an output with no approver can't answer “who signed off?” Each field exists to close one question a regulator, a customer or your own team will eventually ask.
| Example — one log entry | |
|---|---|
| entry_id | evt_8f3a91c4 |
| timestamp | 2026-07-24T09:14:03Z |
| actor | mara.j@studio · role: content-lead |
| model | claude-opus-4-8 · training: off |
| data_class | customer-PII (pseudonymised) |
| task | draft onboarding email · brief #214 |
| output | asset a91f · dest: review-queue |
| decision | approved · by quincy@ · 09:22Z · 2 edits |
| hash | sha256:4c1a…e07b (prev: 9d02…) |
Note: data_class names the sensitivity, never the data. The chained hash makes silent edits detectable.
What should the trail let you reconstruct?
The whole life of one piece of content, backwards. Start from a published email and the log should walk you to the approval, the edits, the prompt, the data class and the person — without opening five systems. That's the difference between an audit trail and scattered logs: a trail is joined. When a customer invokes their right to know how a decision about them was made, or a regulator asks who approved a claim, you follow one thread instead of assembling a case file from memory.
[ figure — the approval: the moment a human took responsibility, and the log remembered who ]
How long do you keep it, and who can read it?
Long enough to match your legal retention and any sector rules — and no copy of personal data inside the log, so it doesn't inherit a shorter deletion clock. Access is least-privilege: the log records everyone, but only a small, named set can read it, and reading it is itself logged. An audit trail that everyone can browse becomes a surveillance tool; one nobody can reach becomes theatre. The balance is narrow, reviewable access with the trail itself under the same tamper-evidence as the entries.
Questions your team will ask
Should the log store the actual prompt and data?
Store a reference and a data class, not the raw personal data. You want provable lineage, not a second copy of everything sensitive.
What makes it “tamper-evident”?
Each entry hashes the one before it. Change an old record and every later hash breaks — so edits are visible instead of silent.
Isn't this a lot of logging overhead?
It's automatic when the gate produces the log. The overhead is only painful if you try to reconstruct it after the fact, from tools that never recorded it.
Does the EU AI Act require this?
For higher-risk systems it expects record-keeping and traceability. Even where it's not mandated, this is the log that makes every other obligation answerable.
The whole point
If you can't reconstruct it, you can't defend it.
Six fields, tamper-evident, one lookup away. That's an audit trail — and it's the record that makes every other rule answerable.