AI system recording of event logs

Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use. The artefact behind the answer is logging decision per life cycle phase. For ai system recording of event logs the evidence sits at the gate it belongs to.

What it asks

Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use.

Where generative AI changes the answer

Event logs for a generative system need the input, the output, the version and the reviewer, or an incident cannot be reconstructed.

Who it binds

The AI system owner and the delivery team at each life cycle gate. For A.6.2.8 the named role is the owner of logging decision per life cycle phase.

Evidence an auditor normally samples

• Logging decision per life cycle phase
• Operational event logs supporting traceability and detection of operation outside intended conditions
• Log content such as time of use, production data and out-of-range outputs
• Log retention aligned with intended use, retention policy and law

The test you can run

Ask for logging decision per life cycle phase and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• No logging while the system is in use
• Logs kept for less time than legal requirements
• Out-of-range outputs not captured

Before the draft publishes

For A.6.2.8, walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first. The first artefact to produce is logging decision per life cycle phase.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.6.2.8 (ai system recording of event logs) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.