Audit Trail
The record an AI system or workflow keeps of each run: the input, what the model returned, what was approved and by whom, and what changed downstream. It is what lets any single run be reconstructed after the fact.
What it means in practice
The workflow article makes the record the fifth of its five tests: ask what is kept after a run. The running cost article gives a worked example in which governance is a log of what was read, what was matched and who approved each exception, and says controls like this are cheaper to design in than to add later.
How we use it
The banning article shows the other side: use on a company-approved tool can be reviewed, logged and improved, while use on a personal account leaves no record anywhere the business runs. The ownership article sets out the log-keeping duty a deployer of a high-risk system carries.
FAQ
Questions about Audit trail
What should an AI Audit trail record?
The workflow article lists the input, what the model returned, what was approved and by whom, and what changed downstream. A real workflow can reconstruct any single run from that record.
How long must AI logs be kept?
For a high-risk system under the EU AI Act, the ownership article says a deployer must keep the system's logs for at least six months, alongside monitoring it and assigning competent people to oversee it.
What it means for a Business
A chatbot keeps a transcript, which shows what was said, not what was done. A workflow a business can answer for keeps a record of the work itself. For a smaller organisation that can be light: a log, a named owner and a person checking the risky steps.
Ready to put this to work?
Tell us where your team is with AI and we will tell you honestly what would make the biggest difference.