ALCOA+ — attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available — predates AI by decades, but it describes exactly what a trustworthy record has to look like, and it applies to an AI system's output with no modification needed. The trouble isn't the principle. It's that most AI systems weren't built with it in mind.
Current as of September 2026 — confirm current record-keeping expectations against the specific regulatory regime and system category that applies to your deployment.
What a complete AI audit trail actually contains
Six elements, and a record missing any of them has a hole an inspector will eventually find. The original request — what was asked, by whom, when. The model version and configuration in force at that moment, since behaviour can shift between versions with no code change at all. Any evidence retrieved and passed to the model, so a claim in the output can be traced to its source. Intermediate steps for any multi-step or agentic process — the plan, the tool calls, the order they ran in. The verification results from any independent check that ran before a human saw the output. And the human review decision itself — attributable to a specific identity, timestamped, and recording approval, rejection or modification as a first-class event rather than an email reply.
Where the hole usually is
Three patterns account for most of it. Logging bolted on after the fact — the system was built, then someone added logging, and the logging captures what was easy to capture rather than what a reconstruction actually needs. Model version not tied to output — outputs are stored, but not which exact model version produced them, so a behaviour change between versions can't be traced. Review happening outside the system — a person looks at the output and approves it by replying to an email or a chat message, which means the actual decision event lives somewhere the audit trail never reaches.
The test that actually matters
Pick an arbitrary sentence from an arbitrary output produced eighteen months ago. Can you reconstruct, today, exactly how it came to exist — which request, which model version, which retrieved evidence, which reviewer, which decision? If the answer is "mostly" or "we'd have to piece it together from three systems," the audit trail is not complete, regardless of how thorough the logging looked at build time. This test is worth running against your own systems before an inspector runs it for you.
Where Eclypse sits: every deployment emits a single immutable record per output — request, model version, retrieved evidence, tool calls, verification results, and the attributable human decision — designed to pass the eighteen-months-later reconstruction test from day one.
This is the same discipline behind human-in-the-loop AI in healthcare and the validation approach in GxP validation for AI systems — an audit trail is only as good as the review process feeding it.
Common questions about AI audit trail requirements.
What is ALCOA+?
Data integrity principles — attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available — describing what a trustworthy record looks like, applied directly to AI output.
What does an AI system's audit trail need to capture?
The original request, model version and configuration, retrieved evidence, intermediate steps, verification results, and the attributable human review decision.
Why do AI audit trails commonly have gaps?
Logging added after the system was built, model versions not tied to stored outputs, or human review happening outside the system of record.
Does the audit trail need to store the exact model version used?
Yes — behaviour can change between model versions with no code change, so reconstructing an output requires knowing precisely which version produced it.
Is a chat log sufficient as an audit trail?
Generally not on its own — it rarely captures model version, retrieved evidence, verification results, or a structured, attributable review decision.
Run the eighteen-months-later test against your own systems — we'll show you what ours produces.
Book a working session
ECLYPSE
AI
Our proprietary AI orchestration platform for healthcare: one engine, a registry of reusable task modules and domain agents, and a governed knowledge base — deployed inside your walls and run by your team.