# A.6.2.8 AI system recording of event logs

Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use. The artefact behind the answer is logging decision per life cycle phase. For ai system recording of event logs the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.8
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use.

## Where generative AI changes the answer

Event logs for a generative system need the input, the output, the version and the reviewer, or an incident cannot be reconstructed.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- Logging decision per life cycle phase
- Operational event logs supporting traceability and detection of operation outside intended conditions
- Log content such as time of use, production data and out-of-range outputs
- Log retention aligned with intended use, retention policy and law

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- No logging while the system is in use
- Logs kept for less time than legal requirements
- Out-of-range outputs not captured

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.