An audit trail for decisions made with AI
What to record, how long to keep it, and how to answer an auditor, a customer or a regulator without depending on your vendor's goodwill.
*Eighth article in our series on enterprise AI, legacy integration and information governance.*
Executive summary
Every significant AI-assisted decision needs a trail that answers three questions within minutes: who decided, based on what, and who approved. That is not bureaucracy — it is the difference between demonstrating diligence and relying on a vendor's word. The trail must live in the company's own infrastructure, with defined retention, protected integrity and controlled access.
The required fields
For each interaction that supports a business decision, record:
| Field | Why it matters |
|---|---|
| Requester identity | Ties the decision to a person and their access level |
| Effective prompt and system instruction | Reproduces the exact generation conditions |
| Retrieved context and source | Shows which document and version the answer relied on |
| Generated output | Records what the system actually returned |
| Human edit and approval | Separates suggestion from decision |
| Model, version and parameters | Explains variation over time |
| Date, time and cost | Enables chronological reconstruction and cost control |
Missing the pair "retrieved context" and "human approval", the trail is just a technical log: it proves something happened, not that it was handled with diligence.
Integrity and retention
Three operating principles:
- 1.Immutability. Decision records cannot be edited; corrections are new records referencing the previous one.
- 2.Retention aligned to the process. The period follows the business document the decision produced — contract, report, proposal — not a generic log standard.
- 3.Restricted, audited access. The trail concentrates sensitive information from many departments; whoever reads it also leaves a trace.
Independence from the vendor
If the trail exists only in the AI platform's dashboard, three risks appear: history loss when changing vendors, export limits in unusable formats, and dependence on external availability precisely during an investigation. Keep a canonical copy in your environment, in the format your audit systems already consume.
How to answer a request
Audit requests usually arrive in three shapes, and each deserves a rehearsal:
- By decision. "Show how this proposal was produced." Retrieve the full chain for that identifier.
- By period and process. "All AI-assisted credit analyses last quarter." Requires indexing by process and date.
- By data subject. "Where did this person's data appear." Requires tracing by subject identifier, including inside prompts — a point connected to Data privacy in the age of AI.
Rehearse before opening night
Run a quarterly exercise with a real case and a stopwatch. The metric is the time to produce a complete trail readable by someone outside the technical team. If it exceeds one business day, the architecture must change before the next audit — not during it.
What to do on Monday
- Pick the most exposed process and define the seven required fields for it.
- Align retention periods with legal, by type of document produced.
- Ensure a copy of the trail exists outside the vendor's platform.
- Schedule the first audit rehearsal in 90 days, with a stopwatch and a written result.
Conclusion
Auditability is what makes it possible to use AI in processes that matter. Companies that record decisions — not just traffic — can defend the outcome, fix what failed, and keep moving when someone inevitably asks for an explanation.
Further reading
Engineering track:
- Immutable AI decision log with hash chaining — the technical deep dive on this topic.