audit logging

**Audit logging** for AI systems is the practice of recording a comprehensive, tamper-evident trail of **all interactions with and operations on** machine learning models. It provides **accountability, forensic capability, and regulatory compliance** by documenting who did what, when, and what the outcome was. **What to Log** - **Inference Requests**: User identity, timestamp, input prompt (or hash), model version, response (or hash), token usage, and latency. - **Model Operations**: Training runs, fine-tuning events, deployments, rollbacks, configuration changes, and weight updates. - **Access Events**: Authentication attempts (successful and failed), authorization decisions, API key usage. - **Safety Events**: Content filter activations, refused requests, rate limit triggers, and flagged outputs. - **Administrative Actions**: User permission changes, model access grants/revocations, system prompt modifications. **Key Properties of Good Audit Logs** - **Immutability**: Logs should be stored in **append-only, tamper-evident** systems. No one should be able to modify or delete log entries. - **Completeness**: Every relevant event is logged — gaps in the audit trail undermine its value. - **Searchability**: Logs must be efficiently queryable for incident investigation and compliance audits. - **Retention**: Logs are retained for the required period (typically **1–7 years** depending on regulations). - **Privacy**: Audit logs themselves may contain sensitive data — ensure they are **access-controlled** and PII is handled appropriately. **Regulatory Requirements** - **GDPR Article 30**: Requires records of processing activities. - **EU AI Act**: High-risk AI systems must maintain logs sufficient to trace system behavior. - **SOC 2**: Requires audit trails of system access and changes. - **HIPAA**: Requires audit controls for systems handling protected health information. **Implementation Tools** - **Cloud Services**: AWS CloudTrail, Azure Monitor, Google Cloud Audit Logs. - **SIEM Systems**: Splunk, Elastic SIEM, Datadog for centralized log analysis. - **Custom Logging**: Structured JSON logging with correlation IDs linking related events across services. Audit logging is not optional for production AI systems — it is a **regulatory requirement, security necessity, and operational best practice** that enables accountability and incident response.