Requirement
"The organization shall determine at which phases of the AI system life cycle, record keeping of event logs should be enabled, but at the minimum when the AI system is in use."[1]
Explanation
AI systems must automatically record event logs, at minimum while the system is in use, so the organization can trace what the system did and detect operation outside intended conditions. Auditors verify logging is enabled at the defined life cycle phases and that logs are retained per policy and legal requirements.
Implementation Guidance
- The organization should ensure logging for AI systems it deploys to automatically collect and record event logs related to certain events that occur during operation. Such logging can include but is not limited to:
- traceability of the AI system's functionality to ensure that the AI system is operating as intended;
- detection of the AI system's performance outside of the AI system's intended operating conditions that can result in undesirable performance on production data or impacts to relevant interested parties through monitoring of the operation of the AI system.
- AI system event logs can include information, such as the time and date each time the AI system is used, the production data on which the AI system operates on, the outputs that fall out of the range of the intended operation of the AI system, etc.
- Event logs should be kept for as long as required for the intended use of the AI system and within the data retention policies of the organization. Legal requirements related to data retention can apply.
- Other information: Some AI systems, such as biometric identification systems, can have additional logging requirements depending on jurisdiction. Organizations should be aware of these requirements.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.2.8
- ISO/IEC 42001:2023 Annex B, B.6.2.8 (implementation guidance)
