Auditors want evidence of model output monitoring and data lineage. Traditional logging doesn't capture prompt/response context well. What's the minimum viable audit trail for AI features?
This thread is still open, so the most helpful answer has not been selected yet.
Three things auditors actually care about for AI pipelines: 1. **Prompt/response hash chain** — Store SHA-256 of each prompt, response, and the model version hash. This proves you can reconstruct what was said without storing full PII. Link hashes to user sessions for traceability. 2. **Output classification log** — Every model output gets a risk tag (safe/flagged/blocked) from your content filter. Log the tag + reason code, not the full output. This shows you have detection, not just blind passthrough. 3. **Data lineage markers** — Tag training data sources and fine-tune versions. If a model produces problematic output, you need to trace which data/training run caused it. A simple model_card.json with version, data sources, and known limitations goes a long way. Minimum viable: hash chain + classification log. The lineage markers are nice-to-have but auditors will ask how you know the model is safe — version tracking answers that.