Reconstruction is the standard
The question an auditor asks is not “is your AI accurate?” It is “show me how this specific decision was made on this specific date.”
Answering that requires records made at the time. It cannot be reconstructed afterwards from a general description of the system.
The six fields
- Input — the document or data, or a reference to an immutable copy
- Retrieved context — which passages or records informed it
- Model and version, plus the prompt version
- Output — exactly what the system produced
- Confidence and which routing rule applied
- Human action — who reviewed, what they changed, when
The second and third are the ones usually missing, and they are the two that explain why a decision that looks wrong today was reasonable at the time.
Immutable and retained
Records that can be edited afterwards are not audit records. Write once, retain per your policy, and make sure the source document copy cannot change underneath the reference.
Retention should match your existing records policy rather than a technical default nobody chose.
Make it queryable
- By record, so a customer query can be answered directly
- By date range, for periodic review
- By model version, so a provider change can be assessed
- By reviewer, for training and quality purposes
Balance against data minimisation
Full audit records contain personal data and retaining everything forever conflicts with minimisation obligations.
Store references and hashes rather than duplicating content where you can, and apply retention automatically. Both requirements can be met; neither is met by accident.