What is an AI audit trail? What a good one records

An AI audit trail is a record, kept in the order things happened and protected from being altered, of what an AI worker read, what it proposed, who approved it, what it then changed or sent, when, and in which system. Like any audit trail, it shows who did what and on whose authority. Its purpose is that when a client, a manager or a regulator asks "who did this, and why?", the business can answer from the record instead of from memory.

What should a good audit trail record?

For each piece of work an AI worker does, a useful trail holds six things, each with its time.

• The trigger. What started the work: the email that arrived, the date that came due, the instruction a person gave.

• What it read. The documents and records it looked at, so that its reasoning can be checked against the source.

• What it proposed. The draft, the update or the action, as it stood before anyone approved it.

• The approval. Who confirmed or cancelled it, and when. Where a standing instruction covered the step, which instruction.

• What happened. The record that was changed and its values before and after, or the message that was sent and to whom.

• What it could not do. The item it stopped on and handed to a person, with the reason.

Two properties matter as much as the content. Entries are added and never edited, so the trail cannot be tidied after the event. And each entry names an actor: the worker, or the person who approved.

Why does an audit trail matter to an owner?

When a member of staff does something unexpected you can ask them. When software does, the only witness is the record. Three practical reasons follow.

You stay able to answer for the work. The UK GDPR's accountability principle, which applies across the UK, says a controller is responsible for complying with the data protection principles and must be able to demonstrate that it does. A business that hands work involving personal data to an AI worker is still the one that has to demonstrate that.

You can put things right. If a wrong value was written to forty records, the trail shows which forty, what they held before and what led to it. Without it, the correction is guesswork.

You can see misuse. The National Cyber Security Centre calls logging the foundation of security monitoring and tells organisations to protect logs from tampering, so they can be confident the logs show what really happened. In a December 2025 blog post on AI systems, the NCSC says to log enough to identify suspicious activity, potentially including the model's full input and output and its use of tools.

The Information Commission's Office, in its report on agentic AI, says technical approaches already exist that let organisations review what an agent is doing in real time or afterwards. It adds that it is not clear whether, in practice, organisations will be able to monitor a growing number of agents effectively.

How do you see what an AI worker did?

A wholesaler's customer rings to say an order was acknowledged at last year's price. Somebody in the sales office opens the order's history. It shows the order arriving by email at 08:14 with the customer's PDF attached; the AI worker entering it as held, with a note that line three differed from the price list; a named member of the team releasing it at 09:02 with the difference accepted; and the acknowledgement going out afterwards. The answer is in one place and blames nobody wrongly: the worker raised the difference and a person accepted it, so the conversation with the customer can be about the price list.

The same record feeds the monthly review of the role. How many items the worker handled, how many it handed over and why, how many proposals a person changed before approving: all of it is counted from the trail. That makes it the worker's performance record as well as its safety net.

What is not an audit trail?

• A chat history. A transcript shows what was said to an assistant. It does not show what was changed in your systems, or who approved it.

• The history inside one application. Your order system or practice software records its own changes. An AI worker's trail joins the steps across systems: the email it read, the record it updated, the message it sent.

• A financial audit. An auditor's examination of the accounts is a separate thing, though auditors of all kinds rely on trails like this one.

• An explanation from the model. Asking an AI system afterwards why it did something produces a plausible account, not evidence. The trail is what was recorded at the time.

What should you ask before an AI worker starts?

1. Is every action recorded, or only the ones that succeeded?

2. Can an entry be edited or deleted, and by whom?

3. Does each entry show the person who approved, by name?

4. Who in my business can read the trail, and how?

5. How long is it kept, and does that fit my own retention policy?

The answers to the last two depend on your own policies and on your contract with whoever runs the worker, so settle them in writing at the start.

An audit trail makes a mistake findable and fixable, and preventing one is the job of guardrails, which limit what the worker can do, and of human approval, which decides what waits for a person. The role in this example is order processing, and how The AR Dept manages its AI workers is set out on our homepage.

Each worker's role would be agreed in writing, and you would be able to see what was done, when and on whose say. If you would want to see exactly what an AI worker had done in your systems before trusting it with more, talk to our agent.