The AI audit trail: if something went wrong, could you trace it back?

A customer disputes an invoice. You pull the file and find the figure came from an AI draft nobody checked. Now you have a question you cannot answer: who approved this, and on what basis?

That gap is the real risk of AI at work. Not that the model gets something wrong. That you cannot reconstruct what happened when it does.

An audit trail closes the gap. It does not need to be heavy. It needs to exist.

What an AI audit trail is, and what it is not¶

An AI audit trail is a short record of where AI shaped a decision. One row per event. Plain language.

It is not a compliance binder. It is not a logging system you have to build. It is not something a regulator handed you.

It is the answer to one question, written down before you need it.

The one question that defines it: could you trace it back?¶

Run the test on your own business. Pick the last thing AI helped produce. An email to a client, a number in a report, a draft policy.

Now trace it. What model or tool produced it? What decision did it feed? Who looked at it before it went out?

If you can answer all three in under a minute, you have a trail. If you cannot, you have exposure.

Three things every entry needs to capture¶

Skip the metadata. Three fields carry the weight.

• What AI touched. The tool, the input, and the output. "Drafted the renewal quote for Account 114."
• What decision it informed. The action a person took because of it. "Sent the quote to the client."
• Who signed off. A named human, not a role. "Approved by Dana before send."

Three fields. That is the whole record.

The one-page template you can start today¶

Open a shared sheet. Make five columns: Date, What AI touched, Decision it informed, Who signed off, Link or note.

Add one row every time AI output leaves the building or changes a decision. Internal brainstorming does not count. Client-facing work, financial figures, and policy do.

Keep entries to one line. If a row takes more than thirty seconds, the field is too detailed. Cut it back.

That is a working audit trail. No software purchase required.

Where the log lives and who keeps it current¶

A log nobody owns goes stale in a week. Assign one person to keep it current, the same way you assign a runbook.

Store it where the work happens. The sheet sits next to the process it tracks, not in a separate governance folder nobody opens.

Review it monthly. Ten minutes. Look for AI output that went out with no name in the sign-off column. Those are the gaps to close next.

What to do the day the trail catches something¶

The trail earns its keep when something breaks. A wrong figure ships. A client flags a tone-deaf email.

Pull the row. You now know the tool, the decision, and the approver in under a minute. The conversation shifts from "who do we blame" to "where did our check fail."

That is the point. The trail does not prevent every error. It makes every error traceable, and a traceable error is a fixable process.

Keep exploring¶

A clear sign-off column only works when the approval step itself is real, which is why the audit trail pairs well with approval gates that actually hold. If you want to map where AI touches your decisions before you build the log, start the AI Readiness Audit or contact FIT.