What *AI audit trails* actually need to contain, and why logs break down

Why audit trails exist

An audit trail tells you what happened and when. In AI systems, it answers questions like: which version of the model ran, what input it received, what it produced, who reviewed it and who approved the result. When a decision is questioned six months later, the audit trail is what you show.

The idea is the same as a till receipt. Nobody looks at it unless there is a reason to, but when you need it, you really need it.

What a proper AI audit trail contains

Jama Software's article lists five things an AI audit trail should capture ^[1]:

1. The input. Which question, prompt or data the AI received.
2. The output. What the AI produced.
3. The model version. Which model ran, and with which settings.
4. The reviewer. Who checked the output.
5. The approval. Who approved it, and when.

For high-risk AI under the AI Act, Article 12 requires systems to technically allow for the automatic recording of events over their lifetime ^[2]. That applies from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. The law says what to log. It doesn't say how to protect the logs once they exist.

Where audit trails break down

Most organisations log something, but the trail tends to fall apart in three ways.

First, logs sit in systems where the same people who keep them can also change them. An administrator with full access can rewrite a line or delete a file, and unless someone is watching at that exact moment, nobody notices. A log you can quietly edit is a diary, not evidence.

Second, logs get fragmented. One system logs inputs, another logs outputs, and approvals live in an email thread. When an auditor or a supervisor asks what happened on a given day, you end up stitching together pieces from different places, hoping nothing is missing.

Third, logs disappear. Storage gets cleaned up, backups fail or someone forgets to archive before a system is decommissioned. By the time the question comes, the record is gone.

Transformance.ai points out that AI agents acting autonomously make this worse ^[3]. An agent can call a dozen tools, reverse a decision and try again, all in seconds. If the audit trail only shows the final result, you have lost the reversals, the tool calls and the reasoning.

What this means for you

If you run AI systems that make decisions about people, ask these questions now:

• Do we log every decision, input, output, model version and reviewer?
• Can someone with admin rights change a log entry without leaving a trace?
• If an auditor or a supervisor asks what our AI did on 14 March, can we show them a complete record?
• Do our logs cover the full chain of events, including reversals and tool calls if we use agents?
• Where are the logs stored, who has access and for how long do we keep them?

For high-risk systems, Article 12 applies soon. Even if your system isn't high-risk, you still need to answer these questions if anyone ever challenges a decision.

How a digital witness makes logs hold up

A digital witness seals each log entry, or batches of entries at short intervals, as they are written. Here is what that looks like in practice.

Say a lender's AI scores a loan application. The system writes a log entry: applicant reference, model version 2.4.1, score 620, reviewer Olivia Chen. As that entry is written, the system sends a fingerprint of it to WitniumChain through the REST API, the SDK or the MCP server. The fingerprint is sealed, and the system gets a witness ID back. The record itself never leaves your systems.

Six months later, the applicant asks why they were declined. You pull the log and share the entry along with the witness ID. The applicant, or their lawyer, calculates the fingerprint again and compares it with the sealed one. If it matches, the entry is exactly what was written on the day. Change a single character and it won't match.

A digital witness doesn't show that the decision was right, fair or lawful. It doesn't show that the log is complete. What it does show is that the entry you are looking at is the one written at the time, even if someone with full access could have changed it.

Internal audit, supervisors and courts can check the same way. The first 2,000 witnesses a month are free. Read the docs.

What to watch

The high-risk logging requirements in Article 12 apply from 2 December 2027 for Annex III systems (credit scoring, employment, law enforcement, critical infrastructure and others) and from 2 August 2028 for Annex I systems (biometric identification, emotion recognition and biometric categorisation). By then, you need to be logging automatically, and it is worth deciding now how you will protect those logs.