ai-audit-logging

AI Audit Logging

Implement compliance-ready audit trails for AI system decisions and outputs.

When to Use

• Meeting regulatory requirements (EU AI Act, SOC2, HIPAA)
• Tracking AI decisions for accountability
• Debugging AI system behavior
• Investigating incidents involving AI
• Demonstrating AI governance

Regulatory Context (2026)

EU AI Act Requirements

• High-risk AI systems must maintain logs that enable:

  • Traceability of AI decisions
  • Recording of reference data
  • Logging of events throughout lifecycle
  • Logs must be kept for appropriate period

• Effective August 2026 with fines up to 7% of global revenue

SOC2 AI Considerations

• Processing Integrity: AI outputs must be accurate and complete
• Confidentiality: AI must not expose confidential data
• Availability: AI systems must maintain audit logs

Audit Log Schema

interface AIAuditLog {
  // Identification
  id: string;
  timestamp: Date;
  correlationId: string;
  sessionId: string;

  // Actor
  actor: {
    type: 'user' | 'system' | 'automated';
    id: string;
    name?: string;
    ip?: string;
    userAgent?: string;
  };

  // AI Operation
  operation: {
    type: 'inference' | 'generation' | 'classification' | 'analysis';
    model: string;
    modelVersion: string;
    provider: string;
  };

  // Input/Output
  io: {
    inputHash: string;        // Hash of input for privacy
    inputTokens: number;
    outputHash: string;       // Hash of output
    outputTokens: number;
    inputSummary?: string;    // Optional human-readable summary
    outputSummary?: string;
  };

  // Decisions
  decision?: {
    action: string;
    confidence: number;
    alternatives?: { action: string; confidence: number }[];
    reasoning?: string;
  };

  // Safety
  safety: {
    contentFiltered: boolean;
    filterReasons?: string[];
    humanReviewRequired: boolean;
    humanReviewCompleted?: boolean;
    reviewerId?: string;
  };

  // Performance
  performance: {
    latencyMs: number;
    queueTimeMs?: number;
    tokensPerSecond?: number;
  };

  // Cost
  cost: {
    inputCost: number;
    outputCost: number;
    totalCost: number;
    currency: string;
  };

  // Context
  context: {
    application: string;
    environment: 'production' | 'staging' | 'development';
    feature?: string;
    tags: string[];
  };

  // Metadata
  metadata: Record<string, unknown>;
}