What to Log for Every AI Decision
The record shape auditors actually want, and the fields that will save you when a decision is challenged months later.
A useful decision record is the one that survives a regulator's request twelve months from now. Log too little and you cannot defend the decision; log too much and retention costs balloon. Here is the minimum set that consistently holds up.
The eight fields
1. decision_id — stable, opaque identifier. 2. timestamp — ISO-8601 with timezone. 3. model — id, semver, and content hash. 4. inputs_hash — sha256 of the canonical inputs; never the raw PII. 5. output — the machine-consumable result, not a rendered string. 6. confidence or score where the model exposes one. 7. explanation_ref — pointer to the full explanation payload. 8. chain_hash — the hash linking this record to the previous.
What NOT to log inline
Raw personal data, plaintext prompts with PII, and large tensors. Hash them, store the payload in encrypted object storage, and reference by pointer. This is what makes the record safely queryable years later.