Make Every Significant AI Decision Reconstructable
If we had to prove what happened and who was responsible, could we?
Baseline: 1Enhanced: 23 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where it decides about people (B2). Go as deep as your system letter, and implement in your mode.
Why it exists
Keep a record complete enough to reconstruct any significant AI decision and locate the responsibility for it. When a decision is questioned — by the person affected, a regulator, or a court — you must be able to show what was decided, on what basis, by which version of the system, and what human was involved at what point. This builds on the traceability of the Explainability domain and turns it toward a different question: not only why the system produced the output, but who is answerable for acting on it.
What to actually do
Record the decision, its basis, its version, and the human involvement. For significant AI-influenced decisions, keep an account of what was decided, the input and system version behind it, and — critically — where a human reviewed, approved, or overrode it. The human involvement is what connects the decision to an accountable person; a record that omits it cannot locate responsibility.
Make the trail resistant to convenient loss. A record that can be quietly altered or deleted after a bad outcome is not an accountability record. Protect these trails from tampering and from casual deletion, proportionate to the stakes, so that the account you can produce is the account that actually occurred.
Controls
Baseline1 controls
Control 185
Keep a minimal decision record for every person-affecting AI output.
System, model version, date, and the human involvement — who reviewed, who overrode. One line per decision is enough at Baseline.
How to implement it · Minimum content
System name and model version, or the provider's version label where shown
Date of the decision and a case reference, not the person's full details
What the AI produced: recommendation, score or draft, in a few words
Human involvement: who reviewed it and whether they accepted or overrode it
Final outcome communicated to the person
How to start
Put a one-line-per-decision sheet next to the process where the AI output is used, and have the reviewer fill in a line each time.
Evidence
The decision record covering every person-affecting AI output in the period.
Mode: light / standard / full
light
A shared spreadsheet with one row per decision, filled in by whoever reviews it.
standard
Mandatory fields in the case or personnel system, completed before the decision is closed.
full
Captured automatically by the application and fed into the full decision audit trail.
Enhanced2 controls
Control 183
Keep an audit trail of significant AI decisions, including the human involvement.
EnhancedDetectiveall rolesper system
What it is
What was decided, on what basis, by which version, with which human review or override.
How to implement it · Minimum content
Decision reference, date and time, and the case or person it concerns
Input used, or a reference to it, and the system and model version that produced the output
AI output: recommendation, score or draft, with any confidence shown to the reviewer
Human involvement: who reviewed, approved or overrode, when, and the reason for any override
Final decision taken and the date it took effect
How to start
List which decisions of this system count as significant (affecting a person, money or a contract), then add the missing fields where those decisions are made.
Evidence
The trail itself and one past decision reconstructed from it, naming the responsible person.
Mode: light / standard / full
light
A structured log in the case system or a shared spreadsheet, filled in at the moment of decision.
standard
Fields captured automatically by the application, with the reviewer's action recorded by the workflow.
full
A central decision-trail service fed by every significant system, searchable by case and version.
Control 184
Protect the trails from tampering and premature deletion.
EnhancedPreventiveall rolesper system
What it is
Proportionate to the stakes of the decisions they record.
How to implement it · Minimum rules
Write access: only the recording process writes; nobody, administrators included, edits an entry after creation
Corrections are added as new entries referencing the original, never overwriting it
Deletion blocked before the retention period ends; any early deletion needs two named people and is itself logged
High-stakes trails: append-only or write-once storage, or periodic integrity hashes kept separately
Backups of the trail held apart from the production system
How to start
Check who can currently edit or delete this system's trail and remove that right from everyone except the recording process.
Evidence
The access list, the retention setting and the log of attempted changes or deletions.
Mode: light / standard / full
light
A locked or read-only copy of the log saved weekly to storage only the owner can delete.
standard
Append-only storage with restricted deletion and backups kept separately, managed by IT.
full
Write-once storage with integrity checks and alerts on tampering attempts, monitored by the security function.
Evidence
The decision audit trails; evidence of their tamper-resistance and retention; a demonstrated reconstruction of a past decision with its responsible human. The minimal decision records.