Compliance
AI Agent Audit Trails: What to Log, a Template and the EU AI Act
What an AI agent audit trail must record, a record template to copy, the logging duty in Article 12 of the EU AI Act — and three examples from practice.
When an agent misbehaves, "what happened?" needs an exact answer. A chat transcript will not give you one — an audit trail will.
Transcripts are not audit logs
A conversation log tells you what the model said. It does not reliably tell you what the system did: which tool call actually executed, with which final parameters, under whose authority, and what came back. Those live in your execution layer — and if they are not recorded there, they are gone.
The minimum viable record
For every consequential action, capture the actor (which agent, which workspace, which underlying model), the intent (the requested action, in the terms the policy engine evaluated), the parameters (the exact payload executed, or a hash of it if it contains sensitive data), the decision (auto-approved by which rule, or manually approved or denied by whom, when) and the outcome (success, failure, error, and the follow-up if any).
Actor, intent, decision, outcome — with timestamps. Anything less and you are reconstructing incidents from guesswork.
What to log, field by field
The five parts of the minimum record become about a dozen fields. Log them in one place and in the same shape for every agent — otherwise nobody can compare two incidents.
Field | What it records | Example |
|---|---|---|
Event ID | Unique, never reused | evt_8f3a2c |
Timestamp | UTC, to the second | 2026-09-26T09:14:03Z |
Agent | Which agent acted, in which workspace | billing-bot / finance |
Model | Model and version behind the agent | claude-sonnet-5 |
Action | Tool and operation, as the policy saw it | gmail.send |
Action type | Read, write, financial or admin | write |
Parameters | Exact payload, or its hash if it holds personal data | sha256:9b2e… |
Policy rule | Which rule allowed, blocked or escalated it | external-email-approval |
Approver | Who decided, and when | a.meier, 09:13:51 UTC |
Outcome | Succeeded, failed, blocked or undone | succeeded |
Undo reference | What it takes to reverse the action | msg_18c2 |
Correlation ID | Links request, approval and execution | req_51a2d0 |
A record template you can copy
One JSON object per event, the same shape for every agent. Write it to append-only storage that the agent itself cannot reach:
Tamper-evidence and retention
An audit trail an agent — or an attacker — can edit is a diary. Records should be append-only, timestamped and stored outside the agent's own reach. Retention should match how long questions can arrive: customer disputes and compliance reviews rarely respect your log-rotation schedule.
How long is long enough? For high-risk AI systems, the EU AI Act sets a minimum of six months. Disputes and audits often reach further back, so a year is a sensible default for agents that touch money or customer data.
The EU AI Act: what Article 12 requires
Article 12 requires high-risk AI systems to record events automatically over their entire lifetime. The logs must make it possible to identify situations in which the system poses a risk or is substantially modified, to support post-market monitoring and to monitor its operation.
It applies to providers and deployers of high-risk systems — for example agents that screen job applicants, assess creditworthiness or decide on access to essential services. Providers must keep the automatically generated logs for at least six months (Article 19), and so must deployers, as far as the logs are under their control (Article 26).
Since the Digital Omnibus of July 2026, these obligations apply from 2 December 2027 to stand-alone high-risk systems and from 2 August 2028 to AI built into regulated products. If you build agents today, log as if the rules already applied: adding logging later costs more than recording from the start. Whether your use case counts as high-risk is a question for your legal team.
Undo is part of the trail
The best incident response is reversal. When actions support it, record enough to undo them — the message recalled, the record restored, the payment voided. A trail that ends in a one-tap undo turns a bad morning into a footnote. That is why AgentLock pairs every logged action with universal undo where the underlying service allows it.
Three examples from practice
Approved: an agent wants to email an invoice to a customer. The rule for external email requires approval, the finance team approves in the mobile app, and the email goes out. The trail shows request, rule, approval and execution — plus the message ID for undo.
Blocked: an agent tries to trigger a payment. For this agent, financial actions are blocked by policy, so nothing happens. The trail still shows the attempt and the rule that stopped it.
Undone: an agent deletes a CRM record by mistake. The team restores it from the timeline. The trail shows the deletion and the undo, each with who and when.
How AgentLock keeps the trail for you
Every request, approval decision, execution and undo is recorded automatically — agents cannot skip it
Append-only: audit events cannot be edited or deleted in the app, and the database enforces it
A timeline with status, agent, action and time for every execution — with undo for reversible HTTP actions on Pro and Team
Export of all workspace data, audit events included, as JSON
Audit events are kept for 30 days on Free and, on paid plans, until you set your own retention period
Read next:
Who will ask for this
Your future self, first. Then customers who want proof the agent did not email their data, auditors whose access reviews now include non-human identities, and incident responders who need a timeline in minutes. Agents do not get the benefit of the doubt humans do — the record is your credibility.
More articles
Security
How to Keep API Keys Out of Your AI Agents' Hands
Every key an AI agent can read is a key it can leak. Why credentials don't belong in prompts or agent environments — and how the gateway pattern fixes it.
Read article →
Operations
Human-in-the-Loop for AI Agents, Without the Bottleneck
Full autonomy is reckless, approving everything is unusable. How to risk-tier agent actions and design approvals that take seconds, not meetings.
Read article →