Audit trail · requirements
AI agent audit trail requirements.
What does an AI agent audit trail need to record to satisfy a regulator or an auditor? This page answers that directly, then maps the answer to the frameworks that ask for it.
The answer
What an AI agent audit trail must record.
To satisfy a regulator or an auditor, an AI agent audit trail needs to record who acted, under whose authority, what they did, in what order, with integrity you can prove and retention you can honour. Each of those six clauses maps to a concrete field in the record, not a paragraph of policy prose: an actor identity, an approval or delegation, the action and its inputs, a correlation across the steps of one run, a hash chain that breaks visibly if a row is altered, and a store that keeps the chain for as long as the applicable rule requires.
That is the whole test an assessor applies, whether they are working from the EU AI Act, a SOC 2 control matrix, or an internal change-management review: can you produce the record, and can you prove it has not been edited since it was written.
In plain words
What it is, where it lives, when to reach for it
- What is it
- A requirements map: what an AI agent audit trail must record to satisfy a regulator or an auditor.
- Where do I use it
- Against the frameworks an assessor works from: EU AI Act, GDPR, SOC 2, ISO 27001, NIST AI RMF.
- When would I use it
- When you are specifying or evaluating an audit trail and need the six fields that actually get checked.
- How do I use it
- Read the answer above, then the framework-by-framework mapping below; none of it is legal advice.
The anatomy
What the trail must record, field by field.
These are the fields an evidence row needs, in the vocabulary an evidence platform actually uses. See how the receipt is built for a worked example of one row end to end.
- actor
- Who acted: the specific agent identity, not a shared service account. If an auditor cannot name the actor behind a row, the row is not evidence of accountability.
- aocl layer
- Which stage of the pipeline produced the row (for example L3 policy.gate or L7 delegate.execute), so a reviewer can place the event in the sequence of what the system actually did, not just that it did something.
- correlation
- The identifier tying every row in a multi-step run together, so a single user-facing request can be reconstructed end to end from its component actions.
- hash
- A digest of the row itself: the action and its inputs, fixed at write time.
- prev_hash / chain_hash
- Each row links to the one before it (chain_hash = sha256(prev_hash : hash : id : created_at) in Quox’s own implementation), so altering or deleting a past row breaks the chain at that exact point and the break is detectable by recomputing hashes, not by trusting an admin's word.
- signature
- A cryptographic signature over the row, so the record can be attributed and checked without relying on the storage system's own access controls.
- witness
- An external anchor for the chain (Quox's WARD publishes signed hash-chain tips, with RFC-3161 timestamps, to a store outside the system that produced them), so the chain's integrity can be checked from outside the system under audit, even if that system itself is compromised.
Requirement families
Where each framework maps to the anatomy above.
Every framework below is a target your auditor maps evidence to. None of this is a certification claim: Quox is not certified against any framework named here, and mapping evidence to a control is not the same thing as passing an assessment against it.
EU AI Act
Article 12 asks for automatic recording of events over a high-risk system’s lifetime, and Article 26 requires deployers to retain those logs for at least six months. Article 14 requires that the system can be effectively overseen by natural persons.
Mapped to the anatomy above: actor and witness answer who acted and whether a human could have intervened, the hash chain answers whether the record was automatic and tamper-resistant, and retention is a property of where the chain is stored, not of any single row. See the full EU AI Act requirement map for the article-by-article detail.
GDPR accountability
GDPR's accountability principle asks a controller to demonstrate compliance, not merely assert it. A trail with a named actor, a correlation across the steps of one request, and a hash chain an auditor can recompute is evidence of what was done with personal data and by whom, which is what an accountability demonstration is actually made of.
SOC 2 and ISO 27001
Both frameworks ask for evidence of change management and access control: who changed what, who could act, and whether that access was reviewed. The actor and aocl layer fields map directly to an access-control control point, and the hash chain gives an assessor a way to sample and verify rather than take a spreadsheet's word for it.
ISO/IEC 42001 and NIST AI RMF
These are AI-specific management frameworks: they ask for evidence that an AI system's behaviour is governed on an ongoing basis, not documented once and filed away. A trail that records every governed action, including the ones a policy gate held for approval, is the operating evidence an AI management system review actually consumes.
Not legal advice
What this page is, and is not.
This page maps common audit trail requirements to the fields an evidence record needs. It is not legal advice and it is not a compliance guarantee. Whether your deployment satisfies the EU AI Act, GDPR, SOC 2, ISO 27001, ISO 42001 or the NIST AI RMF is a determination for you, your counsel and your assessor.
What Quox provides is the evidence substrate: the actor identity, the approval gate that holds an action until a named human decides, and the hash-chained, externally witnessed record those decisions land in. The gate fails closed: an action it cannot evaluate is held, it does not proceed by default.
See the evidence, not a description of it.
Read how the receipt above is built and verified, check the EU AI Act requirement map for the article-by-article detail, or read the protocol docs behind the chain and the witness.