AI Auditability

An audit needs to identify the object being reviewed and the evidence behind relevant claims. For AI, that object includes data transformations, model versions, prompts, retrieval settings, decision thresholds and the human workflow. Auditability links these components to evaluation results and deployment events while preserving their provenance. Documentation states intent and limitations; operational records show what actually happened. The distinction matters because a model card can describe a different configuration from the one serving users. Auditability also includes access to evidence and clear responsibilities for maintaining it, not simply collecting large volumes of logs.

The practitioner defines which questions a review must answer, then selects records that support those questions without unnecessarily retaining personal data. They tie releases to immutable artifacts, preserve evaluation protocols and record approvals, exceptions and material changes. Useful outputs include a system inventory, evidence index and reproducible evaluation report. For individual decisions, the team may need traceable inputs and review actions; for broader assessments, aggregate records may suffice. Access, retention and integrity protections are designed alongside collection so audit evidence does not become an uncontrolled disclosure channel.

More logging does not automatically create better evidence. Missing version identifiers, mutable datasets and inaccessible proprietary components can prevent reconstruction, while excessive content logging creates privacy and security costs. An audit trail also records a decision without proving that it was justified. Good auditability makes the limits of reconstruction explicit and lets a reviewer distinguish observed facts, declared intentions and assumptions that could not be verified.