Audit trails for AI decisions: the feature regulators will ask for

Logs are not audit trails

Ordinary logs can be edited, are often incomplete, and ask you to trust that they are accurate. An audit trail is different: it is designed so that any change after the fact is detectable, which is exactly what an auditor needs.

If a record can be quietly altered, it cannot settle a dispute.

What a real audit trail proves

That a specific decision was made, on specific inputs, at a specific time, and has not changed since. Anyone with the open verification procedure can confirm it without trusting you; that independence is the point.

Designing it in

Audit trails cannot be bolted on convincingly after an incident. They have to be part of how decisions are made, so every material action is recorded as it happens.

Building it into the workflow

The reason audit trails cannot be added convincingly after an incident is that trust in a record depends on it being created at the moment of the decision, not assembled afterwards from memory and fragments. A trail reconstructed under pressure is exactly the kind an auditor distrusts.

Building recording into the decision path, so every material action is captured as it happens, is what makes the trail credible. It is a design decision, and the best time to make it is before you need it.