Event logs

The requirement, in our words

Decide in which life-cycle phases the system records event logs, and make sure it records at least while it is in use, with enough content to support traceability and to detect operation outside the intended conditions.

What it means for human oversight

The log is the evidence that oversight happened. It should capture the output, the human decision, the override, the time and the identity needed to reconstruct the event.

How to evidence it

Attach the artefacts above to the Event logs row with the system name, the owner and the date. The first one is the anchor: A logging decision per life-cycle phase. The OH-26 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Operational logs with traceability. If that artefact for OH-26 cannot be produced, the row is a gap, whatever the policy says.

OH-26 carries 3 evidence items and 3 common gaps. For event logs, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-26 statement above is ours, written from ISO/IEC 42001:2023, A.6.2.8, not a reproduction of the licensed text.

Common gaps

• No logging while in use
• Retention shorter than the legal requirement
• Out-of-range outputs not captured

Related units

• AI risk assessment
• Operational planning and control
• Context and the role you play