Audit log The record that answers who did what, and when.
Short answer. An audit log is a time-ordered record of events on a system that lets an organisation answer who did what, to what, when, and with what result. NIST SP 800-53 says each record should establish what type of event occurred, when, where, its source, its outcome and the identity of anyone involved. For AI, a useful entry names the user, the app, the model, whether it ran locally or in the cloud, and which documents were used. A log is only as good as its protection: NIST requires protecting audit information from unauthorised access, modification and deletion. In India, CERT-In’s 2022 directions require logs of ICT systems to be kept for a rolling 180 days within the Indian jurisdiction.
01
What a good entry contains
NIST SP 800-92 defines a log as a record of the events occurring within an organisation’s systems and networks. NIST SP 800-53 control AU-3 lists six things a record should establish. The right-hand column shows what that means for an AI system.
NIST AU-3 asks for
For an AI system
What type of event occurred
A model call, a document search, a tool call, an approval, a sign-in
When it occurred
A timestamp from a synchronised clock
Where it occurred
Which app or maker, and which device or address
The source of the event
The user, or the agent acting for the user
The outcome
Answered, refused, failed, approved or rejected
The identity of anyone involved
The named user, and the person who confirmed or approved
02
What AI adds
Beyond the six items, an AI system benefits from a few more fields. NIST’s own discussion of AU-3 warns that audit records can reveal personal information, especially if the trail records inputs, so decide deliberately what to keep.
The model name and version, and whether the call ran locally or in the cloud.
Which documents or passages were retrieved to answer.
Each tool call and its outcome.
Each confirmation: who approved what, and when.
Whether the log holds the full text of prompts or only metadata. Prompts can contain secrets and personal data, so protect them like the documents they came from.
03
Indian rules that touch logs
These are different clocks for different entities and purposes. Which apply to a given office is a question for its adviser. This is general information, not legal advice.
Source
What it says about logs
When
CERT-In directions, 28 April 2022
Service providers, intermediaries, data centres, body corporate and Government organisations must enable logs of all ICT systems and keep them securely for a rolling 180 days, within the Indian jurisdiction. Clocks must be synchronised to the NTP servers of NIC or NPL
Effective 60 days after the date of issue, 28 April 2022
DPDP Rules, 2025, rule 6
Reasonable security safeguards include visibility on access to personal data through logs, monitoring and review, and keeping such logs and personal data for one year unless another law requires otherwise
18 months after publication, around May 2027
DPDP Rules, 2025, rule 8(3)
Personal data, associated traffic data and other logs of processing kept for a minimum of one year for the purposes in the Seventh Schedule, which concern State and Government functions
18 months after publication, around May 2027
04
Protecting the log
Protect audit information and logging tools from unauthorised access, modification and deletion, and alert on attempts (NIST control AU-9).
Keep a copy on a different system from the one being audited, so that compromising one does not compromise the other (AU-9(2)).
Use cryptographic protection for integrity, such as signed hashes (AU-9(3)). See tamper-evident log.
Limit who can manage logging to a small group of privileged users (AU-9(4)).
Keep the clock right. CERT-In asks the entities it addresses to synchronise with NIC or NPL time servers.
05
Where ANVE stands
ANVE logs every model call with the user, the app, the model and whether it ran locally or in the cloud, and a confirmed meeting action records who confirmed it. Its security page (/security) adds that every tool call an agent makes is logged, and every connector call is logged on the box. The governed API, with a key per user or agent and every request in the audit trail, is not on ANVE yet. Whether the log is tamper-evident, and how long it is kept, are questions to settle in writing before a paid pilot. The AI audit trail page covers the idea in an AI setting.
06
Questions people ask
What is the difference between an audit log and an AI audit trail?
An audit log is the general record of system events. An AI audit trail is that record applied to AI use: who asked what, which documents were used and who approved the result. See the AI audit trail page.
How long should we keep audit logs?
It depends on the rule and the risk. CERT-In sets 180 days within India for the entities it addresses, and the DPDP Rules, 2025 set a one-year minimum for certain logs from about May 2027; your own needs may be longer. This is not legal advice.
Can staff see the audit log?
That is a policy choice. Logs can hold personal data and prompts, so most offices limit access to an auditor or administrator role and tell staff what is recorded.
Should the log record the full text of prompts?
Only if you need it and can protect it. NIST notes that audit trails recording inputs can reveal personal information. A common approach is to log who, what and when, and keep content only where a rule or a dispute requires it.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
