ISO 42001 Annex A 6.2.8 AI system recording of event logs
What it says
The organization shall determine at which phases of the AI system life cycle, record keeping of event logs should be enabled, but at the minimum when the AI system is in use.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation decides, and writes down, at which stages of an AI system's life its event logs (automatic records of what the system did and when) are switched on, and they must be on at least while the system is in use.
An event log is an automatic record an AI system keeps of what it did and when, for example which inputs it received, what it produced, who used it, and any errors or warnings. This control asks your organisation to make a deliberate decision about when those logs are turned on across the AI system's whole life, from building and training it, through testing, into everyday use, and on to retraining, major changes and eventually shutting it down. You do not have to log at every single stage, but you must consciously choose which stages need logging and record that choice. The one stage you cannot skip is when the AI system is in use: logging must be enabled at the minimum during live operation. Picture an AI chatbot that tells a customer something that is not true. If logging was switched on during use, you can look back at exactly what the customer asked, what the system answered, and what data it drew on, so you can work out what went wrong. Without that record, you are guessing.
Free. Save your status, tasks and notes.
Why it matters
If logging was never turned on during live use, and an AI loan tool wrongly declines a cohort of applicants, you have no record of the inputs or decisions and cannot reconstruct what happened, so you cannot prove fairness, fix the fault, or answer an OAIC complaint. The organisation may have to suspend the system rather than defend it, because there is nothing to investigate. Failing to even decide which life-cycle phases need logging is itself an audit finding against this control.
How to implement
The AI lead writes a short phase-determination record that walks through each stage of the AI system's life, development, training, testing, in-use operation, retraining or major change, and decommissioning, and marks for each stage whether event logging is switched on, making sure the in-use stage is always on.
When deciding what the in-use logs should hold, the AI lead specifies the detail needed to reconstruct an event later, for example the inputs received, the output produced, a timestamp, the user or system involved, and any errors or warnings the AI raised.
For any life-cycle phase where the team decides not to log, the AI lead records the reason in the same document, so a reviewer can see the gap was a conscious choice rather than an oversight.
The AI lead assigns one named owner for this decision and links it to the AI system inventory, so whenever a new AI system is introduced its logging phases are decided up front rather than after a problem appears.
Whoever owns an AI system revisits the phase-determination record when the system moves to a new phase, such as going live, being retrained, or being decommissioned, and updates which phases are logged so the record keeps matching what the system is actually doing.
Keep it running
Capture the phase-determination decision in a short written record that names each life-cycle stage (development, training, testing, in-use operation, retraining or major change, and decommissioning) and states whether logging is on or off for each, with in-use always on. Revisit that decision whenever you add a new AI system, change how an existing one is used, or move it to a new phase, so the logging stays matched to what the system is actually doing. Keep enough detail in the logs to reconstruct an event, but record the reasoning for any phase where you chose not to log.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the written record that determines at which AI system life-cycle phases event logging is enabled.
Look at
Whether it lists the life-cycle stages (such as development, training, testing, in-use operation, retraining and decommissioning) and marks logging on or off for each.
Good evidence
A documented decision names each life-cycle phase and states whether event logging is enabled at that phase, rather than leaving it unstated.
- Check 2 of 5What an auditor asks for
Ask for
Ask which phases were chosen for logging and confirm the in-use phase is included.
Look at
Whether logging is enabled at the minimum during live operation, not only during development or testing.
Good evidence
Event logging is enabled at least while the AI system is in use, and this is stated in the phase-determination record.
- Check 3 of 5What an auditor asks for
Ask for
Request a sample of actual event logs captured from an AI system while it was in use.
Look at
Whether the logs genuinely contain events from live operation, such as inputs, outputs, timestamps and any errors.
Good evidence
The logs show real recorded events from the in-use phase, matching the phases the organisation said it would log.
- Check 4 of 5What an auditor asks for
Ask for
Ask who owns the decision on which phases are logged and how it is kept current.
Look at
Whether a named person or role is responsible and whether the decision is revisited when an AI system changes phase or a new system is added.
Good evidence
A named owner maintains the phase-determination decision and updates it when AI systems are added or move to a new life-cycle phase.
- Check 5 of 5What an auditor asks for
Ask for
Ask to see the reasoning for any life-cycle phase where logging was deliberately switched off.
Look at
Whether a justification exists for non-logged phases, rather than logging simply being absent by oversight.
Good evidence
Each non-logged phase has a recorded reason, showing the choice was deliberate rather than an unconsidered gap.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of activities and events, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.15.
Annex A 6.2.8 requires the organisation to determine at which AI system life cycle phases event logging should be enabled, at minimum when the AI system is in use. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, stored, protected, and analysed for relevant activities and events, which is directly applicable to AI systems as information systems. Annex A 6.2.8 is AI-specific and lifecycle-phase focused, while Annex A 8.15 is broader and adds expectations for storage/protection/analysis that 6.2.8 does not explicitly mandate.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-AC-ML2.6.
Annex A 6.2.8 requires the organisation to enable event logging for AI systems during defined life cycle phases, at minimum when the AI system is in use. E8-AC-ML2.6 requires event logs to be protected from unauthorised modification and deletion, which is a key integrity control for any AI system logs once collected. Annex A 6.2.8 is about enabling/recording logs, while E8-AC-ML2.6 is about safeguarding those logs against tampering.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0585.
Annex A 6.2.8 requires enabling event logs for AI systems at defined life cycle phases, at minimum during operational use. ISM-0585 specifies the required content of each logged event (e.g. time, user/process, filename, description, and equipment), which complements the AI system logging requirement by defining what good event logs should contain. Annex A 6.2.8 focuses on when logging is enabled, while ISM-0585 focuses on the minimum fields/attributes captured once logging exists.
This control partially overlaps ISM-2159.
Annex A 6.2.8 requires the organisation to determine and document the AI lifecycle phases in which AI system event logging is enabled, with a minimum of logging when the AI system is in use. ISM-2159 directly covers the 'in use' phase for a specific AI class (agentic AI) by mandating central logging of tool invocations, external requests and outputs to support investigations. ISM-2159 is more prescriptive about what must be logged during operation, while Annex A 6.2.8 is primarily about governance decisions regarding when across the lifecycle logging is enabled (which ISM-2159 does not address).
This control supports ISM-2089.
Annex A 6.2.8 requires enabling AI system event logging at defined lifecycle phases (at least during operational use) to ensure traceability of system activity. ISM-2089 requires monitoring AI model performance metrics and investigating anomalies, which is enabled by having event logging turned on during the operational phase and often during testing/validation phases to establish baseline behaviour. ISM-2089 focuses on monitoring and investigation actions, while Annex A 6.2.8 focuses on the lifecycle decision and minimum operational enablement of logging.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents