AI Logging and Traceability

Provide and maintain logging capabilities needed for traceability, risk identification, monitoring and investigation.

For a high-risk AI provider, define which events the system should record so operation, material changes and investigations can be traced. For a deployer, identify the logs actually under its control. Assign log owners, protect access and integrity, and test that timestamps, system versions and relevant events are retrievable. Apply the retention rule for the specific actor and record; do not use one blanket period for all logs. Where the biometric logging provisions apply, include their specific information requirements. Coordinate logging capability with the separate monitoring, incident and records-retention controls.

At design and deployment; continuous logging as applicable; after relevant system changes; periodic retrieval and retention checks.

Logging specification and enabled configuration Sample event records identifying the system and relevant use Access controls and retrieval test results Actor-specific retention and deletion settings Investigation records demonstrating use of logs

Generate a safe test event or select an existing event and trace it through capture, storage and retrieval. Check the relevant system version, timestamps, permissions and retention settings. Investigate gaps rather than relying on a screenshot showing that logging is enabled.