Regulayer Enterprise licensing
Main site The engine By problem What is licensed Deployment Assurance The record format What it proves Security review Begin with the problem

The category, defined

What is an AI audit trail?

An AI audit trail is the record of what an AI system did and what a person decided about it, written at the moment it happened. The term is doing quiet work in every serious AI governance conversation in 2026, because record-keeping duties, from Article 12 of the EU AI Act onward, assume one exists.

The definition

A record of events and decisions in an AI system, created as those events occur, that can later be shown to someone who does not trust the operator.

Three words in that sentence carry the weight. Record, because a summary written afterwards is a report, not a record. As those events occur, because contemporaneity is the one property a reconstructed log cannot fake. And someone who does not trust the operator, because an audit trail that only convinces the party who wrote it is a diary.

Five properties decide whether one survives an adversarial reading

Contemporaneous

Written at the moment of the decision, as a byproduct of it. Any trail compiled later can be shaped later, and every examiner knows it.

Tamper-evident

Signed and chained, so a change or a deletion shows. The claim is never that change is impossible. The claim is that the seam is visible to anyone who looks.

Content-free

The fact of the decision, the fingerprint of the material, the identity of the person. Not the material. A trail that stores content becomes a liability of its own and cannot be shown to an outsider without betraying an insider.

Independently verifiable

Checkable by the party you answer to, with public mathematics, without your servers, your account or your permission. A trail that needs you present to verify is evidence about yourself, graded by yourself.

Attributable to a person

Human oversight is a named duty in regulation, including Article 14 of the EU AI Act. A trail of machine events with no person in it answers a question nobody asked. The question is what the system did and what a person decided about it.

Where application logs stop

Application logs are written by the system under question, into databases the operator controls, editable by anyone with sufficient access, and verifiable only by asking the operator. They are operational tooling, and useful as such. As evidence offered to a regulator, an insurer, an opposing party or a court, they fail on all five properties at once.

The Regulayer engine exists to produce the trail that has the five: The Witness for sealed decision memory, Drift for behavioural change per person, HumanMark for authorship, and the record format that makes any of it checkable by anyone, permanently, without us.

Licensing begins with the problem, not the product.

Describe the system, what it decides, and what it would cost you to be unable to prove it. A written scope follows before any call.

Ways to begin:

A scoped pilot, inside your estate, on your machines. An architecture briefing, for your security function, one hour. The diligence pack: the record format and the estate, in writing. The problem itself, in your own words.

hello@regulayer.com