International Standard | First edition 2025 | Version: Illustration
This document specifies common capabilities, requirements, and a supporting information model for logging of events in AI systems. It is intended to support transparency, auditability, risk management, and compliance with regulations such as the EU AI Act (particularly Article 12 on logging for high-risk AI systems).
Example: Providers of high-risk AI systems (e.g., in employment or credit scoring) can use this standard to implement event logging for traceability and post-market monitoring.
The following documents are referred to in the text:
- ISO/IEC 22989, Artificial intelligence — Artificial intelligence concepts and terminology
- ISO/IEC 23894, Information technology — Artificial intelligence — Guidance on risk management
- ISO/IEC 42001, Artificial intelligence — Management system
Example: Refer to ISO/IEC 23894 when determining risk-based triggers for logging events.
Key terms include:
- AI system log: Record of events generated during the operation or lifecycle of an AI system.
- Logging: The process of recording events in a systematic and structured manner.
- Event: Occurrence of a significant action, state change, or condition within an AI system.
Example: "Tamper-evident log" refers to logs protected against unauthorized modification.
Common abbreviations used in this document, such as:
- AI: Artificial Intelligence
- ML: Machine Learning
- RMS: Risk Management System
Defines the purpose, scope, and responsibilities for maintaining logs to support traceability, debugging, compliance, and continuous improvement.
Describes architectural components involved in generating, collecting, storing, and analysing logs.
Example: Integration of logging into the AI system pipeline for real-time event capture.
The logging system shall be designed to support the objectives of the AI system and applicable risk management processes.
Logs must enable linking events to design decisions, data flows, and governance controls.
Requirements for documenting the design and implementation of the logging mechanism.
Risk is the primary driver for determining which events must be logged. Logging shall cover normal operations and deviations.
Routine activities such as input processing, inference, and output generation.
Errors, anomalies, security incidents, and performance degradations.
Minimum information that shall be recorded for each logged event.
Timestamp, event type, severity, system context, user/actor identifiers, and outcomes.
Additional details for training, inference, and model updates (e.g., parameters, version, performance metrics).
Example: Logging model version and confidence scores in a high-risk decision-making AI.
Provides a structured information model (e.g., using schemas or data formats) to ensure consistency and interoperability of logs across systems and stakeholders.
Example: JSON-based log schema with standardized fields for easy parsing and analysis.
Requirements for log protection (confidentiality, integrity, availability), retention periods, and controlled access. Logs shall be tamper-evident and protected through strict access controls.
Example: Encryption and role-based access for logs containing sensitive personal data in compliance with GDPR and EU AI Act.