Search for an AI audit trail and you get nine vendor pages and four academic preprints. Every vendor page starts in the same place: buy a logging layer. For a company of 50 to 500 people that is one purchase too early. The assistants your team already uses write an audit record natively, and what stands between you and that record is usually a seat tier rather than a product you do not own. The order that works: read what your current licenses log, price the Enterprise tier, discover the accounts no console can see, then quote a gateway. Most companies this size never need the fourth step.
What one usable audit record contains
An application log records a deterministic event: this user called this endpoint, it returned a 200. An AI record captures a non-deterministic one, which takes more fields. A record that survives contact with an auditor identifies the person or service account behind the request, not just the workspace. It names the tool and the model family, because a prompt answered by a reasoning model and the same prompt answered by a fast one are different events. It captures the input — typed text, attached files, and any company documents the tool retrieved to ground its answer — the output, and for anything agentic, the tool calls and write operations that followed. It records the policy decision: whether a data rule or guardrail fired, and what it did. And it carries integrity metadata: timestamp, retention class, and some assurance nobody has edited it since.
Two fields get dropped most often. Without the model family you cannot reproduce anything. Without the retrieved context you cannot answer what an auditor actually asks: what company data the system touched.
What your current licenses already log
This step is free, and the vendor guides skip it. Every major assistant publishes its logging capability.
| Platform | What it records | How you get it | Default retention |
|---|---|---|---|
| ChatGPT Enterprise | Time-stamped conversations, uploaded files, workspace GPT configuration, memories, users | Enterprise Compliance API, or an eDiscovery or data-loss-prevention partner integration built on it | Workspace retention settings |
| Claude Enterprise | User actions, system events and data access | Audit logs plus a compliance API and OpenTelemetry monitoring, for routing into a SIEM | Data retention controls |
| Microsoft 365 | Unified audit log across Microsoft services; agent tool execution, invocation, inference calls and guardrail decisions logged as discrete activities | Purview portal search, Audit Search Graph API, Search-UnifiedAuditLog, CSV export, Office 365 Management Activity API |
180 days on Audit (Standard) |
| Google Workspace | Gemini log events under Reporting, Audit and investigation | CSV export, Admin SDK Reporting API, or BigQuery export | Varies by edition |
Two details deserve reading in the primary docs. Microsoft’s audit solutions overview states that Audit (Standard) is on by default with 180-day retention. Audit (Premium) adds retention policies up to a year, keeps Entra, Exchange, OneDrive and SharePoint records for a year by default, and reaches ten years only with a per-user add-on license. If your answer to an auditor has to cover the last fiscal year, Standard does not reach it. The activity list shows how granular agent logging has become, so a Microsoft-centric company can reconstruct an agent’s run from the native log alone.
Google’s log export setup is the quiet winner for anyone who wants real analysis: a BigQuery export turns Gemini log events into something you can query and join against your own data, for a Google Cloud project with billing enabled rather than a platform purchase.
The admin and data-handling differences between the two leading standalone assistants run wider than logging, and we set them side by side in our comparison of ChatGPT Enterprise and Claude for Work.
The gate nobody selling a platform mentions
One fact reorders the whole decision: on the major assistants, audit logging is an Enterprise-tier feature. Anthropic’s help documentation places audit logs on the Enterprise plan only. OpenAI’s Compliance API covers ChatGPT Enterprise and Edu workspaces only. Purview’s longer retention windows require Audit (Premium). Google gates log export to specific Workspace editions.
So if your company runs on Team or Business seats — which most 50-to-500-person companies do, because that is what someone bought with a card when a department asked for access — then “we need an AI audit trail” is a procurement conversation about tiers, not a tooling evaluation. Buying a third-party logging product to compensate means paying twice: a gateway sees traffic leaving your network but cannot read the conversation history held in the vendor’s workspace.
Price the tier upgrade first. It usually bundles single sign-on, SCIM provisioning, role-based access control and retention settings, all on the same questionnaire. The broader case for administered accounts is in our look at enterprise AI accounts versus consumer logins.
The three options, compared
| Option | Coverage | Cost shape | Suits |
|---|---|---|---|
| Native platform logs | The assistants you administer, at the granularity the vendor publishes | Included in an Enterprise or Premium tier; configuration plus an export route | Almost every company of 50–500 with two or three sanctioned tools |
| Identity and network discovery | Which AI services your people reach from managed devices, sanctioned or not | Often already owned inside an identity provider, web gateway or endpoint tool | Any company that wants an honest inventory |
| Dedicated AI gateway or governance platform | Prompts, responses, tool calls and policy decisions across many tools in one schema | Per-seat or per-call, rarely published; adds a proxy to maintain | Regulated firms, teams building their own agents |
The default at this size is options one and two, in that order, with three deferred until something forces it: a regulator naming records you cannot produce, an agent writing to customer systems, or a client demanding a unified trail. Our survey of AI governance tooling for mid-market companies covers when it is the right purchase.
What no admin console can see
Native logs are bounded. They cover the tenant you administer and nothing else, leaving the exposure most likely to reach an incident report unrecorded: a personal account on a personal phone, a free browser extension, an assistant inside a tool another department pays for.
IBM’s Cost of a Data Breach 2026 found workers using unapproved AI tools figured in 43% of security incidents, more than double the previous year, and close to seven in ten breached organizations had no governance policy for managing AI.
You close that gap with discovery, not more logging. Three sources, in order of effort: identity provider sign-in records, which show every service your people authenticate to; a web gateway or endpoint tool, which shows the domains they reach; and an expense-report search for unapproved subscriptions. Then ask directly, with amnesty framing, and expect more than you provisioned. Inspecting what moves through the sanctioned path is a separate control, covered in data-loss prevention for AI assistants.
Choosing the retention number
Most compliance checklists on this topic anchor on the EU AI Act, which is the wrong anchor for a company deploying general-purpose assistants. Article 12 requires that high-risk AI systems “technically allow for the automatic recording of events (logs) over the lifetime of the system,” and Article 26 obliges deployers of those systems to keep the logs under their control. If you are not deploying a high-risk system, those articles are context rather than obligation.
Your real number comes from commitments you already carry.
| Obligation | What it implies for AI logs |
|---|---|
| PCI DSS v4.0.1, requirement 10.5.1 | 12 months of history, with the most recent three months immediately available |
| HIPAA, 45 CFR § 164.316(b)(2)(i) | Six years for security documentation, usually read to include the records evidencing those activities |
| SOC 2 | No fixed period; your auditor holds you to what your own policy states |
| Client contracts and insurer questionnaires | Often the binding constraint, and the one read last |
The practical answer: match your existing security log retention policy, because a shorter window for AI events than for everything else is the inconsistency an auditor will find. If that policy says a year and your tier gives you 180 days, you have found a budget line.
The log is a liability as well as an asset
Verbatim prompt logging creates a new repository of the most sensitive unstructured text in the company: draft contracts, salary discussions, unreleased numbers, client detail. That does not reduce exposure; it concentrates it, in a system whose access controls you have probably not reviewed.
Four design decisions keep it defensible. Scope access narrowly and log access to the log itself. Store a reference or hash rather than full prompt text where you do not need to read it back. Set a retention ceiling as well as a floor. Separate duties, so the administrators who operate the AI tools cannot edit the record: the control that makes the trail evidence rather than a claim.
The workforce dimension is not small either. A log your team reads as surveillance produces careful behavior in the logged tool and a migration to the unlogged one, so announce what is recorded, why, who can see it and for how long before switching anything on. The gap between a written policy and what people actually do is the central failure in this area, and closing it is the subject of our safe AI use playbook.
What a complete log still cannot evidence
A perfect audit trail answers one question: what happened. It cannot answer the one that follows, which is whether anyone checked.
The record shows that an analyst asked an assistant to summarize a client agreement and that an answer came back in nine seconds. It does not show whether she read the source clause, or whether the summary went into a client email unverified. For the failures that cost real money — a wrong number in a board pack, a hallucinated citation in a filing, a client told something untrue — the log is where you discover the damage, not where you prevent it. Which is why the evidence package an auditor, insurer or enterprise client asks for has three parts: the log, the policy, and the training record. Two of the three are about people.
Treated properly, the log becomes an AI enablement instrument rather than a compliance artifact. Usage records show which teams adopted which tools and where adoption stalled — the input for deciding who needs training next. That is the argument running through the case that buying licenses is not the same as building capability: a dashboard reports consumption, and only the people tell you about capability.
What this costs
The tier upgrade is the main number, and it is a delta on a renewal rather than a new line item. Enterprise tiers are negotiated and seldom published, so get a quote at your real seat count and ask whether audit logging, the compliance API, single sign-on and retention controls are included at the tier offered.
Discovery is usually already paid for; the cost is a few days of someone’s attention to turn the reporting on and read it. A BigQuery or SIEM export adds tens of dollars a month in storage and query costs. Dedicated governance platforms price per seat or per call and rarely publish a rate, so expect a quote that scales with headcount plus implementation.
On the capability side, facilitated AI enablement workshops sit in a $2,000–15,000 market range per engagement, and the verification habits that make a log meaningful are a training outcome rather than a tooling one.
Where to start
This week, open the admin consoles you actually use and write down what each records and for how long. Most teams find both more and less than expected: granular agent telemetry in Microsoft 365, nothing at all on the Team-tier assistant two departments live in.
Next, run discovery from your identity provider and expense reports to build the tool inventory, then take the tier question to procurement with a retention requirement attached — the number from your own security policy, not one from a compliance blog. Publish what is logged and why before enabling it, and defer the gateway conversation until a named obligation or an agent with write access forces it.
Then spend the remaining budget on the half a log cannot cover. Book a free AI-readiness call and we will go through your console inventory with you. We run hands-on LLM fluency sessions against a team’s own documents and daily work, and we will say plainly when a tier upgrade and an afternoon of configuration beats a monitoring product.
Frequently asked questions
What is an AI audit trail?
A time-stamped record of who used which AI tool, what they put in, what came back, what company data it touched, which tool calls followed, and whether any policy control fired. It differs from an application log because the behavior is non-deterministic, so the model family and retrieved context must be captured to make the event reproducible.
Do we already have an AI audit trail?
Partly, depending on your seat tier. On Microsoft 365 the unified audit log is on by default with 180-day retention and already records agent operations. On Google Workspace, Gemini log events sit in the Admin console. On ChatGPT or Claude Enterprise plans you have a compliance API. On Team or Business seats you usually have usage analytics only.
What is the cheapest option an auditor will accept?
Native platform logs from an administered tenant, exported on a schedule, with a written retention policy you can meet and documented access controls on the log itself. Auditors want a complete, consistent, tamper-resistant record, not a particular product name.
When is a dedicated AI governance platform worth buying?
When a regulator or contract names records your native logs cannot produce, when you run agents that write to customer systems, or when reconciling separate logs costs more than a unified schema. Below that, the Enterprise tier and a discovery pass serve this size of company better.
How long should we keep AI logs?
Match your existing security log retention policy, then check it against any obligation that sets a floor: 12 months under PCI DSS v4.0.1 with three immediately available, six years of security documentation under HIPAA. Set a ceiling too.
Does logging prompts create a privacy problem?
Yes, and it needs designing rather than ignoring. Scope access tightly, log access to the log, store references or hashes where you do not need the content back, set a retention limit, and tell staff what is recorded before switching it on.
How do we log the AI tools we have not approved?
You do not log them; you discover them, then sanction or remove them. Identity provider sign-in records, web gateway or endpoint telemetry, and an expense-report search surface most of it. The inventory, not more telemetry, is the control here.
Will an audit trail satisfy a SOC 2 or client security questionnaire?
It covers one of three sections. Reviewers also ask which tools are sanctioned and who approved them, what the AI use policy says, and what training staff received. A complete log with no training record reads worse than a modest log paired with evidence that people were taught to verify output.
Key takeaways
- Read your admin consoles before pricing a product. Microsoft 365, Google Workspace, ChatGPT Enterprise and Claude Enterprise all publish what they log, and for most companies this size that is the answer.
- Audit logging is an Enterprise-tier feature on the major assistants. On Team or Business seats this is a renewal negotiation, and a gateway cannot recover the conversation history held in the vendor’s workspace.
- Native logs end at the tenant boundary. Close the rest with discovery from your identity provider, gateway and expense reports.
- Take the retention number from obligations you already carry — your own policy first, then PCI DSS, HIPAA or client contracts, not the EU AI Act’s high-risk record-keeping articles.
- The log proves a prompt happened, never that anyone verified the answer. Auditors, insurers and clients ask for the log, the policy and the training record together, and only the third changes behavior.
Dirk Jan van Veen, PhD
