Auditability
Auditability is the ability to reconstruct what an AI system did, which artifacts were in force, why the action was allowed, and who approved the relevant controls. It connects operational observability with compliance: logs are useful only if they answer a later accountability question.
A logged decision event
For high-risk systems, the EU AI Act includes record-keeping and logging obligations; NIST AI RMF also treats systematic documentation as part of managing risk. A minimal decision event should identify both the model path and the governance path:
{
"event_id": "evt_2026_07_11_00042",
"decision_type": "loan_review_recommendation",
"model_version": "credit_triage_v3.2.1",
"feature_snapshot_id": "fs_8b7c",
"policy_version": "lending_policy_2026_05",
"threshold_id": "thr_high_risk_0.72",
"input_hash": "sha256:9ef...",
"output_hash": "sha256:a41...",
"reason_codes": ["recent_delinquency_count", "utilization_ratio"],
"human_review": { "required": true, "reviewer_id": "risk_ops_17", "outcome": "approved" },
"retention_class": "regulated_decision_7y"
}The important design choice is indirection: store immutable IDs and hashes, not unlimited raw personal data. If the incident involves PII leakage, the audit trail should still let investigators locate the evidence without spreading sensitive content through every log sink.
What auditors ask
An audit usually asks: which model and knowledge base change introduced the behavior, which policy enforcement rule allowed it, whether human oversight occurred, and whether the same issue appears in similar decisions. That requires joining release records, decision logs, evaluation results, approvals, and appeal outcomes.
Caveats
Audit logs fail when they are either too thin or too invasive. A final score without input, version, threshold, and policy IDs cannot explain a decision. Raw prompts, documents, and user identifiers copied into every trace create privacy risk. Define retention, access control, and redaction at the same time as the audit schema.
References
Nav