For every action, an AI audit trail should record what the system saw, what it decided and the alternatives, which rule or policy permitted it, who owns that rule, and whether a human checkpoint applied and who cleared it. It should be written at the moment of action and readable by a compliance officer, not just an engineer.
George McKenna, Chairman and CTO, ETT Group. Updated 15 October 2026.
A raw technical log is not an audit trail. It answers what the software did, not whether it was allowed to and who was accountable.
A useful record answers five questions for every action:
- Inputs. What the system saw, as it was at that moment.
- Decision. What it decided, and what the alternatives were.
- Authority. Which policy or rule permitted the decision.
- Ownership. Who owns that rule, by name or role.
- Human checkpoint. Whether approval was required, and if so who gave it and when.
ETT calls this the Evidence File. The test is simple: pick any automated decision from last Tuesday and see whether you can answer those five questions within an hour.
Regulators are moving the same way. Singapore's framework for agentic AI (January 2026) puts human accountability at its centre, and the EU AI Act sets record-keeping and human oversight duties for high-risk systems.
Show Your Working
A fortnightly piece on building and buying AI that pays its way. What I'm building, what it costs, and the questions to ask before you sign anything.