Salesforce shows what transparency can look like for platform providers

What Salesforce reported

Salesforce's transparency report, published through the OECD AI Policy Observatory in April 2024, describes the company's approach to managing security vulnerabilities, assessing risks and meeting compliance requirements.^[1] The report is part of a wider initiative by the OECD to collect transparency information from AI system providers.

The report covers how Salesforce identifies and remediates vulnerabilities, how it conducts risk assessments across its AI offerings and how it responds to regulatory obligations.^[1] It also describes the company's internal governance structures and the processes it uses to monitor AI system performance.

For organisations using Salesforce's AI tools, the report offers insight into what the platform provider does. That matters, because under emerging regulations, the user of an AI system is often responsible for proving what the system did, even when the system runs on someone else's infrastructure.

Why transparency matters for users

Under Article 26.6 of the AI Act, users of high-risk AI systems must keep the automatically generated logs they control for at least six months, unless another law requires a longer period.^[2] Article 19 places the same obligation on providers.^[3]

The AI Act defines a user as any person or organisation using an AI system under its authority, except where the system is used for a personal non-professional activity.^[4] That definition covers organisations deploying AI tools from platform providers like Salesforce.

The logs must allow the user to show what the system did. A transparency report from the provider helps the user understand how the platform works and what data it collects, but it does not replace the user's own records of what happened in their specific deployment.

For high-risk systems under Annex III of the AI Act, the logging requirements apply from 2 December 2027. For systems under Annex I, they apply from 2 August 2028.^[2][3]

The gap between provider transparency and user evidence

A transparency report describes what a provider does in general. It does not prove what happened in a particular case. When a decision made by an AI system is questioned, the user must be able to show what the system did at that moment, with which input and which version.

That distinction matters in disputes, audits and regulatory reviews. A supervisor or a court will ask what the system did on a given day, not what the provider's general practices are.

The user's evidence must therefore come from the user's own records. If those records are kept by the provider, the user must be able to obtain them and show that they have not been altered since the event in question.

What logs must show

Article 12 of the AI Act requires high-risk AI systems to technically enable the automatic recording of events over the system's lifetime, to allow for traceability, monitoring and post-market follow-up.^[5] The article specifies what must be logged but does not prescribe how to protect the logs.

Under DORA, financial firms must protect log systems and log information against tampering, deletion and unauthorised access.^[6] That requirement applies to all ICT systems, not just AI, and has been in force since 17 January 2025.

The evidential value of a log depends on whether it can be shown to be unchanged. A log that someone with access could quietly edit is harder to rely on in a dispute than one with an independent record of what it contained at a given time.

What this means for you

If you use AI tools from a platform provider, consider these questions:

• Do you know what logs your AI deployment generates, where they are stored and how long they are kept?
• Can you obtain the logs when you need them, and can you show they have not been altered since the event you are investigating?
• Does your contract with the provider specify who controls the logs, who can access them and under what conditions you can retrieve them?
• If the AI Act's high-risk requirements apply to your use case, have you confirmed that the provider's logging meets Article 12's technical requirements, and that you can keep the logs for at least six months as Article 26.6 requires?
• If a regulator, auditor or court asks what your AI system did on a specific day, could you provide an answer with evidence?

Transparency reports give context, but they do not substitute for your own records. The party responsible for proving what happened is the one deploying the system, not the one providing the platform.

What to watch

The AI Act's high-risk requirements for systems under Annex III, including the logging obligations in Articles 12, 19 and 26.6, apply from 2 December 2027. For systems under Annex I, the date is 2 August 2028.

The OECD AI Policy Observatory continues to collect transparency reports from AI system providers. Salesforce's report is one of the first from a major platform provider, and it may prompt others to follow.

For organisations using AI from platform providers, the question is not whether the provider is transparent, but whether you can prove what your deployment did when it matters.