The evidence regulators and auditors actually ask for

What a defensible record contains

A run record that survives scrutiny tends to include all of the following. Missing any of them creates a gap that an investigator will notice.

• The agent identity and the policy version in force at the time.
• The model and version used for each inference step.
• The tools called, the systems reached and the scope that permitted each call.
• Any approval: who requested, who approved, when, and on what basis.
• Guardrail and personal-data detections, including what was blocked.
• An integrity property that lets you show the record has not been altered.

Why after-the-fact logging fails

Logs added around an application capture what the application chose to say. They miss policy decisions, denied actions and the model-level detail, and they usually cannot demonstrate integrity. When the record is produced by the runtime that enforced the decision, the evidence and the control are the same thing.

After-the-fact logs are also vulnerable to gaps. If the application was changed, if the log format evolved, or if a component was not instrumented, the record becomes incomplete. The more systems involved, the more likely a gap becomes.

A control-plane record is authoritative because it is produced at the point of enforcement. If the policy denied an action, that denial is recorded. If a model was used, the version is recorded. If personal data was detected and blocked, that detection is recorded.

Regulatory contexts where this appears

Different sectors phrase the requirement differently, but the underlying ask is consistent. They want to know that AI-driven decisions are explainable, accountable and under control.

• Financial services — model risk management, algorithmic decision-making, senior manager accountability and audit trail requirements.
• Healthcare and life sciences — clinical safety, data protection, evidence for governance review and research ethics.
• Public sector — transparency, procurement accountability, data handling and citizen rights.
• General data protection — lawful processing, purpose limitation, automated decision-making safeguards and subject access.

Retention and retrieval

A record is only useful if it can be found. That means indexed, queryable, with predictable retention periods and a clear ownership model. It also means the organisation knows how long to keep records and when to dispose of them.

Retention policies should be explicit. Keeping everything forever is not a policy; it is a liability. Disposing too early is also a risk, especially if a regulator asks for historical records.

Retrieval should not require engineering support for every request. Compliance and audit teams should be able to search by case, by agent, by date, by model and by outcome. If every audit request becomes a ticket, the system is not ready for routine assurance.

Make exports routine

Scheduled evidence exports turn assurance from a project into a report. The teams that find audits uneventful are the ones who were never assembling evidence in the first place.

Exports should be tamper-evident, with checksums or signatures, and they should be stored in a system separate from the runtime that generated them. That separation protects against both accidental deletion and suspicious modification.

Routine exports also surface drift. If the volume of blocked personal-data detections changes suddenly, or if an agent starts calling a new model, the export will show it. Exports become a control mechanism as well as an assurance one.

Incident response and the record

When something goes wrong, the first question is always: what happened? The organisations that can answer quickly are the ones whose records are already structured for investigation.

A useful record lets you reconstruct the chain: the trigger, the agent that acted, the policy that applied, the model that produced the decision, the tools that were called, the data that was read, the approvals that were obtained, and the detections that fired.

Without that chain, incident response becomes a manual archaeology project across multiple consoles. With it, the team can focus on remediation rather than discovery.