Purpose & objectives

Logging and traceability ensure that the behaviour of AI systems can be explained, audited, and reproduced. They provide the forensic foundation for incident response, bias analysis, and post-market reviews.

Logging architecture overview

• Data Ingestion Logs (EV-DIL): Capture source, timestamp, checksum, and DPIA link for every data batch.
• Model Version Ledger (EV-MVL): Records model ID, hash, training code commit, hyperparameters, and validation score.
• Decision Trace Logs (EV-DTL): Stores inputs, outputs, model version, confidence scores, and human override flag.
• System Audit Trail (EV-SAT): Tracks configuration changes, API calls, and administrative access events.

Dataset & training traceability

Model versioning & evidence linkage

• Each model deployment is assigned a globally unique Model ID and commit hash.
• Version records include parent model, training dataset version, and evaluation summary.
• All evaluation reports link to Evidence Index entries in the TDF.
• Model lineage chain diagram maintained to show evolution across releases.

Runtime logging & observability

• Real-time capture of input/output pairs with user ID (pseudonymised) and session timestamp.
• Confidence scores and decision rationale saved to structured JSON logs.
• Log aggregation through central SIEM (Google Chronicle / Splunk) for alerting.
• Monthly sampling review to detect drift and bias shift.

Security & data protection

• Logs encrypted at rest (AES-256) and in transit (TLS 1.3).
• Access via RBAC with least-privilege principle; admin actions double-logged.
• Retention policy based on risk level (5–10 years for high-risk systems).
• Integrity verified using SHA-256 hashes and append-only storage.

Retrieval & audit export

• Standard export format: JSON Lines + CSV summary.
• Each record includes link to corresponding EV-ID and TDF section.
• Audit API enables filtered exports (e.g., date range, user segment, incident type).
• Retrieval requests tracked in access log with DPO approval stamp.

Templates & schemas

{
  "log_id": "EV-DTL-2025-0456",
  "timestamp": "2025-11-17T12:34:56Z",
  "model_id": "M-CLF-01-2025",
  "input_hash": "sha256:ab34...",
  "output_summary": "decision=approve;confidence=0.92",
  "user_id": "anon-9482",
  "oversight_flag": false,
  "risk_level": "medium",
  "linked_evidence": ["EV-TRN-052", "EV-RMS-011"]
}
  

System_ID,Log_Type,Storage_Location,Encryption,Retention_Years,Owner,Next_Review,EV_ID
  

Framework alignment

Implementation checklist

• Logging architecture documented and approved by CISO & Compliance Lead.
• EV-ID cross-linking enabled across data, model, decision, and incident logs.
• Audit API deployed with export filtering and retention alerts.
• Monthly integrity verification reports stored in Evidence Repository.
• Traceability tested end-to-end during ISO 42001 internal audit.

© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 17 Nov 2025 • This page is general guidance, not legal advice.