ISO/IEC 24970:2025 (E) - Artificial intelligence - AI system logging

0.1 General

This document describes common capabilities, requirements and a supporting information model for logging of events in AI systems. It supports transparency, auditability, accountability, risk management, debugging, and post-market monitoring.

Example: High-risk AI systems (e.g., in recruitment or credit scoring) use logging to demonstrate compliance and enable traceability of decisions.

0.2 Relationship with EU AI Act

This standard provides concrete guidance for implementing Article 12 (Logging) of the EU AI Act for high-risk systems. It is designed to be used together with ISO/IEC 42001, ISO/IEC 23894, and prEN 18228 / prEN 18286.

This document specifies common capabilities, requirements and a supporting information model for logging of events in AI systems. It applies to providers and deployers throughout the AI lifecycle.

It does not define specific log formats or technologies but provides risk-based, flexible requirements.

- ISO/IEC 22989 (AI concepts and terminology)
- ISO/IEC 23894 (AI risk management)
- ISO/IEC 42001 (AI management system)

Key terms: AI system log, logging, event, tamper-evident log, traceability, etc.

AI, ML, DIS, RMS, etc.

Defines purpose, responsibilities, and how logs support various objectives (compliance, debugging, audit, etc.).

The logging system must be reliable, secure, and integrated into the AI lifecycle with appropriate traceability.

Risk-based triggers for normal operation, errors, anomalies, security incidents, configuration changes, etc.

Timestamp, event type, actor, input/output summaries, model version, confidence scores, etc.

Provides a standardized information model (often JSON/schema-based) for interoperability and machine readability.

Requirements for confidentiality, integrity (tamper-evidence), availability, retention periods, and controlled access to logs.