Why would an office keep a record of AI use? Because sooner or later someone will ask who used what, on which data.
Short answer. Because logs are how an office answers “who accessed what, and when”. India’s Digital Personal Data Protection Rules, 2025 list logs, monitoring and review of access to personal data among the minimum security safeguards and refer to keeping logs and personal data for one year; CERT-In’s 2022 directions require organisations to keep logs of all ICT systems for a rolling 180 days within India. A record also shows which AI output a person relied on, supports an audit or a dispute, and tells you where unapproved tools are in use. The record itself holds sensitive material, so restrict access to it and decide how long to keep it. This is general information, not legal advice.
01
Five reasons
Security and breach response. The Rules require visibility on access to personal data through logs, monitoring and review, so that unauthorised access can be detected, investigated and remedied (rule 6(1)(c)). Rule 6(1)(e) refers to retaining such logs and personal data for one year. The Rules’ safeguard provisions start eighteen months after 13 November 2025.
Logs the law already asks for. CERT-In’s directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate and government organisations to enable logs of all ICT systems and keep them securely for a rolling 180 days within India.
Professional accountability. ICAI’s Code of Ethics asks an accountant to take reasonable steps to ensure that personnel under their control comply with the duty of confidentiality. A record shows what staff did.
Reliance and disputes. When an answer proves wrong, a record shows the prompt, the sources, the model and who approved the result. After the Supreme Court’s July 2026 order on AI-invented precedents, that matters more in legal work.
Governance. NIST’s AI Risk Management Framework includes a subcategory (GOVERN 1.6) on mechanisms to inventory AI systems. A record of use shows which systems are actually in use.
02
What to record
Item
Why it helps
Who: the named user
Accountability and access reviews
When
Reconstructing events
Which app and model, and whether it ran locally or in the cloud
Knowing whether data left the building
What went in: the documents used
Showing the basis of an answer
What came out, and who approved it
Reliance and sign-off
Changes to model versions, settings and policy
Explaining differences over time
03
What the tools you may use let you see
Tool
What the office can see
Personal ChatGPT account
Nothing: the user alone sees their chats
ChatGPT Business
Admins can view, access, export and delete members’ conversations
ChatGPT Enterprise
Admins can reach an audit log of conversations and GPTs through the Compliance API
Microsoft Copilot
Admins can view stored interactions with Content search or Purview and set retention policies
A private AI system
Whatever it logs. Ask what is logged, who can read the log and for how long
04
Keep the record, and protect it
Logs contain personal data themselves. Limit who can read them and decide how long to keep them. The Act requires erasure of personal data once the purpose is no longer served unless retention is necessary for compliance with a law (section 8(7)), while the Rules refer to one year for logs kept to detect unauthorised access, and CERT-In to 180 days for ICT system logs. Settle the periods with counsel and write them into your policy.
05
Where ANVE fits
ANVE logs every model call on the box with the person, the app, the model and whether it ran locally. Every confirmed meeting action records who confirmed its owner and keeps the quote it came from. Tools an agent can use must be approved by an administrator, a tool that changes is switched off, and every tool call is logged. Roles today are administrator and user; single sign-on is not on ANVE yet. The governed ANVE API, with a key per user or agent and every request in the audit trail, is not on ANVE yet. Details such as how long records are kept and whether administrators can read other people’s chats should be obtained in writing before a paid pilot. ANVE is pre-release. See the security page for the published positions.
06
Questions people ask
Is keeping AI logs required by law in India?
We found no rule written for AI use alone. The DPDP Rules’ safeguards, from about May 2027, and CERT-In’s 2022 directions require logs of access to personal data and of ICT systems, and those duties apply to the organisation whatever tools it uses. Ask counsel.
Do logs have to include the full text of prompts?
The sources do not say. Many offices log metadata, such as who, when, model and documents used, and keep full text only for approved uses, because the text can itself contain personal data. Decide with counsel.
How long should we keep AI logs?
The DPDP Rules refer to one year for logs and personal data kept to detect unauthorised access, and CERT-In to a rolling 180 days for ICT system logs, unless other law requires otherwise. Your sector rules may add periods.
Does a private AI system keep these records automatically?
Only if it is built to. Ask what it logs, who can read the log and how long it is kept, and get the answers in writing.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
