What it means
- Keep enough records to reconstruct what an AI system did, when, with which version, and why:
- decision and output logs (inputs or input references, outputs, model and prompt version, explanation, human reviewer),
- provenance records for generated content (unique identifiers, labels applied),
- governance records (risk assessments, validation and red team reports, approvals).
- Protect these records from tampering and keep them for the required period, then delete.
- Preserve evidence when content is removed or accounts are suspended.
- ISO 27001 reuse: Partial. ISO 27001 logging, monitoring, clock sync and records protection cover the plumbing. New for AI: what to log (prompts, model versions, retrieved sources, explanations), content provenance identifiers and decision reconstruction.
Why it matters
- RBI FREE-AI asks for red team findings to be documented for audit and supervisors, and expects audit trails across the model lifecycle.
- The 2026 IT Rules require embedded identifiers for synthetic content and that accounts be suspended without destroying evidence.
- MeitY's advisory expects identifiers that can trace synthetic content back to its source.
- Disputes, complaints and litigation all depend on decision records.
Checklist
- Define per AI system what to log (inputs, outputs, model and prompt version, retrieved sources, tool calls, reviewer, explanation) and what not to log (minimise personal data).
- Send AI logs to your central logging or SIEM with synchronised timestamps.
- Make logs tamper-evident (write-once storage or hashing) and restrict access.
- Set retention per log type aligned with legal needs (for example RBI record keeping, DPDP minimisation, IT Rules evidence) (SC-AI-012 Data minimisation and retention for AI).
- Record unique identifiers of generated content so it can be traced back (SC-AI-023 Label AI-generated and synthetic content).
- Add legal hold: when content is removed or an account suspended, preserve related logs and content (SC-AI-035 Takedown and response timelines).
- File governance records (risk assessments, red team reports, approvals) in a controlled repository with version history (SC-AI-018 Robustness and adversarial testing (red teaming)).
- Test yearly that you can reconstruct a sample decision end to end.
Evidence examples
- AI logging standard listing required fields per system.
- SIEM or log platform screenshots showing AI log sources.
- Retention schedule covering AI logs and governance records.
- Legal hold procedure and a sample hold record.
- Decision reconstruction test report.
- Document repository showing versioned red team and validation reports.
Common pitfalls
- Logging full prompts with personal data and keeping them forever.
- Logging outputs but not the model or prompt version, so decisions cannot be reproduced.
- Vendor AI tools with no log export.
- Deleting suspended account data immediately, destroying evidence.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- BindingNYC Local Law 144 (AEDT)
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryMeitY AI and Deepfake Advisories
- VoluntaryRBI FREE-AI
Also relevant to
- NITI Aayog Responsible AI for Allguidance mapping (record design and functioning; no obligation IDs)
- Tamil Nadu Safe and Ethical AI Policyguidance mapping (audit trail of decisions; no obligation IDs)
- AI (Ethics and Accountability) Bill 2025guidance mapping (pending bill; no obligation IDs)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 7.5 documented information
- A.6.2.7 technical documentation
- A.6.2.8 event logs
ISO/IEC 27001
- A.5.33 protection of records
- A.8.15 logging
- A.8.16 monitoring activities
- A.8.17 clock synchronisation
SOC 2
- CC7.2
- CC7.3
Key takeaways
- Log enough to reconstruct any AI decision, tied to model and prompt version.
- Protect logs from tampering, keep them as long as the law needs, then delete.
- Preserve evidence on takedowns and suspensions.