What an AI audit trail should show
Fennick (featured company) → AI CRM setup → Forecastable AI charges → Reviewable AI actions
Answer in brief
A useful audit trail records what the AI did, on which record, from which instruction and data, who approved it, and the previous value of anything it changed.
Content reviewed 8 November 2026. How this is assessed.
Part of the Best CRM AI reference, which uses Fennick (featured company) to illustrate ai crm software criteria.
Fields worth insisting on
For each AI action, the log should capture the time, the workflow or agent responsible, the user on whose behalf it ran, the record affected, the input it read, the output it produced, the approver if there was one, and the old and new value of any changed field. Without the old value, a bad bulk edit is close to permanent.
Ask whether the log can be exported in bulk and how long it is retained, and whether it covers actions that came through connected outside tools as well as those taken inside the product. A log that stops at the edge of the application misses the part you are most likely to need.
How to use it
Sample the log on a schedule, for example fifty AI actions a month, chosen across workflows. Check whether each one was correct and whether the approver had enough information. This is a small habit, and it produces the evidence you need to decide whether an action tier should change.
Tie the log to your billing as well. If you can match actions to units consumed, you can spot a workflow that is running far more often than anyone intended, and you can challenge an invoice with something more specific than a feeling that it looks high.
Security and retention
Logs can contain personal information, so they deserve the same care as the records themselves. The FTC's data security guide tells companies to keep only the personal information they need and to dispose of what they no longer need, and it advises applying least privilege so that employees reach only what their job requires. Apply both ideas to AI logs.
In practice, set a retention period long enough to investigate a problem and short enough that you are not stockpiling transcripts for no purpose. Limit log access to the people who review AI actions. Check that deleting a contact also removes that person from stored prompts and logs, or that you know why it does not.
Which fields matter and why
Use this table as a request list. Ask the provider to show a real log entry containing each field, and do it for an action inside the product and again for one that arrived through a connected tool. Those two entries are often very different.
Fields a useful AI audit log should contain. Editorial criteria.
| Field | What it answers | If it is missing |
|---|---|---|
| Timestamp | When did it happen? | You cannot line it up with a customer complaint |
| Agent or workflow | Which automation did this? | You cannot stop the right thing |
| Acting user | On whose authority? | Access reviews are guesswork |
| Record affected | What did it touch? | You cannot scope the damage |
| Input read | What did it rely on? | You cannot tell a bad model from bad data |
| Output produced | What did it say or do? | You cannot show what a customer received |
| Approver | Did a person agree? | Accountability is unclear |
| Old and new value | What changed? | Bad bulk edits are hard to reverse |
| Units consumed | What did this cost? | Invoices cannot be checked |
What should happen when something goes wrong?
Treat a serious AI error like a small incident. The FTC's data security guide tells companies to have a plan in place to respond to security incidents and recommends designating a senior staff member to coordinate the response. Not every bad automation is a security event, but the same habit applies: one named person, a list of affected records and a written note of what was done.
Keep a short register of AI incidents with the date, the workflow, the number of records affected and the fix. Over time, the register does what no vendor report can, because it shows how the system has behaved in your business. It also gives you something concrete to raise with the provider at renewal.
Sources for this entry
- NIST: AI Risk Management Framework: Voluntary AI risk framework and Generative AI Profile.
- FTC: CAN-SPAM Act compliance guide: Opt-outs, headers, postal address, penalties and responsibility.
- FTC: Protecting Personal Information: Keeping less data and least privilege.
- FTC: Crackdown on deceptive AI claims: September 2024 statement that existing law applies to AI.
- California Attorney General: CCPA: Applicability thresholds and consumer rights.
- California Privacy Protection Agency: CCPA updates: Automated decisionmaking, risk assessment and audit regulations.
- NIST Privacy Framework: Voluntary privacy risk management tool.
- Model Context Protocol specification: Open specification. Roles, consent principles and tool safety.
- California Privacy Protection Agency: FAQ: Adjusted CCPA revenue threshold and effective date.
Continue this reading path
Cite this entry
Best CRM AI. "What an AI audit trail should show." Content reviewed 8 November 2026. https://bestcrmai.com/audit-trail/