AI audit trail
Audit trail · Decision log · AI agent logs
An AI audit trail is the preserved, verifiable record of the decisions an AI system or agent has taken. For each decision it shows what was proposed, the rule applied, the outcome retained, the person responsible and the exact time, so that all of this can be shown afterward.
Technical logs do not make an audit trail
Technical logs describe what a system did, in the language of the system: a call, a timestamp, an error code. An audit trail answers the questions an auditor, a judge or an insurer will ask: who allowed this, under which rule, who was responsible? Logs are often an ingredient and rarely enough. Many agent incidents reveal the same gap: the trace exists somewhere and cannot be used after the fact.
What the AI Act requires
Article 12 requires high-risk systems to allow the automatic recording of events over their lifetime. Articles 19 and 26(6) require providers and deployers to keep the logs under their control for a period appropriate to the purpose and at least 6 months, unless other law provides otherwise. The text sets a floor, and litigation can arise well after 6 months.
Two levels of proof
Start with the first level, and add the second where you know who will ask for it. ACF sets a required property rather than a required tool: the trace must be impossible to alter without detection.
| Level | What it takes | What it gives you |
|---|---|---|
| 1. Ordinary register | An append-only register, with a date issued by the system and not by the person writing | You defend your proof, which works in most situations |
| 2. Sealed trail | Ed25519 signature and SHA-256 hash chain, verifiable by a third party | The proof defends itself, when the trail itself is contested |
What signing does not do
A seal guarantees the integrity of what was written and says nothing about what should have been written. A perfectly signed chain over a register with gaps authenticates the gaps. The value of a trail comes from what is decided upstream: the criticality, the level of autonomy, the rule and the person responsible. A signature also establishes that the holder of a key signed; tying that key to a person remains the job of the organization that manages it, and this is the condition the law examines.
Keep a copy too. Proof stored only with the supplier whose behavior it documents can be lost at the very moment you need it.
Frequently asked questions
How long should an AI audit trail be kept?
At least 6 months for high-risk systems under the AI Act, unless other law says otherwise. In practice, align with the limitation periods and sector rules that apply to the decisions concerned, while respecting data protection rules.
Is a blockchain necessary for an audit trail?
No. A hash chain and a public-key signature are public standards that offer integrity which can be checked independently, without a distributed ledger.
Can an audit trail prove why an agent made a decision?
It can prove what the agent decided, under which rule and with which signature. It cannot establish what inclined the model internally, which is one more reason to focus governance on what the agent is allowed to do.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .