Can we reconstruct what the system did, without creating a new privacy problem by doing so?
Baseline: 1Enhanced: 23 controls
Who it applies to
Enter for every AI system. Go as deep as your system letter, and implement in your mode.
Why it exists
Keep records detailed enough to reconstruct and audit the system’s behaviour, at a depth proportionate to the stakes — and no deeper, because the logs themselves become a store of personal data you must then protect and delete. There is a real tension here: accountability wants everything kept forever; privacy wants the minimum kept for the shortest time. Resolve it deliberately per system, rather than defaulting to logging everything and discovering later that your audit trail is also your largest uncontrolled personal-data store.
What to actually do
Log what an audit would need, scaled to the stakes. For a high-stakes system, that is the inputs, outputs, versions, and human involvement needed to reconstruct decisions (connecting to the Accountability trails). For a low-stakes one, far less. Decide the depth from the stakes, not from what is technically easy to capture.
Govern the logs as the personal-data stores they are. Apply the retention limits and deletion rules of the Privacy domain to the logs themselves: they hold personal data, they must not be kept indefinitely, and erasure must reach them. The audit trail is not exempt from privacy simply because it serves accountability.
Controls
Baseline1 controls
Control 207
Log AI interactions at a basic depth.
BaselineDetectiveall rolesthe whole organisation
What it is
Who, when, which system and version, and input and output identifiers — using the provider’s audit logs where available and exporting them to storage you control.
How to implement it · Minimum content
Who: the user account that made the interaction
When: date and time
Which system, and its version where available
Input and output identifiers: references, not necessarily the full content
Source and storage: the provider's audit log where available, exported regularly to storage the organisation controls
How to start
Check each AI tool's administration settings for an audit log, switch it on, and schedule a monthly export to company storage.
Evidence
The exported interaction logs covering all AI tools in use.
Mode: light / standard / full
light
The administrator downloads each provider's log monthly to a company folder; tools without logs are noted in the inventory.
standard
Scheduled automatic export of provider logs to central storage, managed by IT.
full
Logs streamed continuously into the central logging platform and correlated with other security logs.
Enhanced2 controls
Control 205
Log at a depth proportionate to the stakes, sufficient to reconstruct and audit.
EnhancedDetectiveall rolesper system
What it is
Decided per system, not defaulted to maximal capture.
How to implement it · Minimum structure
Stakes level of the system and the reason for it
What is logged: for high stakes, inputs, outputs, versions and human involvement; for low stakes, metadata only
What is deliberately not logged, e.g. full prompts containing personal data where not needed
Where the logs are kept and who can access them
Reconstruction test: one decision rebuilt from the logs
How to start
Write the logging decision for this system on one page, then check it by reconstructing one recent decision from what is actually logged.
Evidence
The per-system logging decision with its rationale and a demonstrated reconstruction.
Mode: light / standard / full
light
A short note per system, written by its owner, relying on the provider's logs.
standard
A logging decision per system agreed by the system owner and IT, with a reconstruction check.
full
A logging standard by stakes level, applied per system and verified by internal audit.
Control 206
Apply privacy retention and deletion to the logs.
EnhancedPreventiveall rolesper system
What it is
The audit trail is a governed personal-data store.
How to implement it · Minimum rules
Retention period per log type, set from the audit need, never indefinite
Automatic deletion or anonymisation when the period ends
Erasure requests reach the logs: searchable by person identifier
Personal data fields not needed for audit masked at capture
Access restricted to named roles, and access itself logged
Deletion suspended for logs tied to an open dispute or incident
How to start
Find where this system's logs are stored, set a retention period for each type, and switch on automatic deletion.
Evidence
The retention schedule for the logs and evidence of deletion and of erasure requests applied to them.
Mode: light / standard / full
light
The provider's log-retention setting configured, and exported logs deleted by the owner on a calendar reminder.
standard
Retention and deletion rules configured in log storage, managed by IT with the privacy lead.
full
Logs included in the data-retention programme, with automated deletion, erasure workflows and periodic audit.
Evidence
The per-system logging decisions and their rationale; the logs’ retention and deletion governance; a demonstrated reconstruction from them. The basic interaction logs and their export.