audit log
An audit log is a chronological, protected record of who (human or AI agent), when, and what actions were performed in a system, created so it cannot be altered unnoticed afterward.
In plain terms
An audit log is like a doorman's guest book or a ship's log: it records every important event so that what happened can be reviewed later. It does not show what should have been done, but what actually happened.
It serves to determine, if something goes wrong, who did it, when, and with what authority. Problems can include, for example, data disappearing, an erroneous transfer going out, or an unauthorized person viewing a patient record. It also serves as evidence: the company can use it to prove to authorities or clients that it acted in accordance with regulations.
In the era of AI agents, it has taken on a new role. The agent opens files, sends emails and runs commands on its own. The log is therefore the most important tool for establishing afterwards what the agent did in your name and who approved each of its steps.
What distinguishes it from a plain error log is that it is not created for developers to debug, but to serve accountability. Therefore, its most important property is that it cannot be modified or deleted unnoticed.
How it works
- The system automatically creates an entry for every significant event. Such events include login, opening, modifying, or deleting data, changing permissions, and every agent operation, such as opening a file or executing a command.
- An entry typically records who (user or agent), when (exact timestamp), what action was taken, on what, from where, and whether it succeeded.
- Entries can only be appended, not rewritten. They are protected by separate storage, strict access control, or cryptographic chaining, so manipulation becomes detectable.
- The log is retained for the prescribed period. Monitoring systems search it for suspicious patterns, such as mass data downloads at night.
- In case of an incident, complaint, or regulatory inspection, the log is used to reconstruct step by step what happened.
An everyday example
In the EESZT, the state system for your health data, you can see which doctor or institution accessed your data and when. This is an audit log view for you. Your online banking's 'previous logins' list is similar.
Who is affected
A common misconception
Limits and risks
- You only see what the system was configured to log; anything omitted cannot be recovered later.
- The log itself is sensitive data: it may contain personal data and even the text of instructions given to the agent, so it must be protected and cannot be kept indefinitely.
- In an AI agent, the log shows what it did, but not reliably why – the model's own reasoning is not proof.
- Too many entries are just as unusable as too few, because important events get lost in the noise.
Similar, but not the same
- error log – The error log helps developers locate technical faults, while the audit log proves who did what.
- observability – Observability is the tracking of system operation and performance using logs, metrics, and tracing. The audit log serves a different purpose: a protected, evidentiary list of who did what.
- audit – The audit is the inspection itself, while the audit log is one of the raw materials the auditor works with.
Related concepts
logging, information security, compliance, accountability
access log, agent tracking, changelog
observability, authorization management, human oversight, transparency, incident management
A brief history
The concept came to IT from auditing: an audit trail originally meant the traceability of accounting entries. The EU AI Act, adopted in 2024 (Article 12), requires high-risk AI systems to technically allow automatic logging of events. Deployers of these systems must also retain the logs for a specified period. The obligations start to apply gradually, in several stages.
Where things stand
Long a basic requirement in banking, healthcare, and corporate systems. By the end of 2026, the main question is how to log the steps of autonomous AI agents uniformly, tamper-proof, and in compliance with data protection.
In the news
Also known as
audit log · audit trail · Audit log · audit log · audit trail · audit log · audit-nyomvonal
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.