The Agent Audit Trail Is Becoming a Standard
Every organisation running autonomous agents is about to be asked the same question: what did the agent actually do, and how do you know?
Dashboards answer with claims. Logs answer with self-reports. Regulators, auditors and courts are starting to ask for something stronger, and the standards bodies have noticed. In the second half of 2026, three separate tracks have converged on a remarkably consistent answer.
The three tracks
ISO/IEC 24970, AI system logging. A joint ISO/IEC JTC 1/SC 42 and CEN-CENELEC JTC 21 standard devoted entirely to how AI systems record events. It entered its final draft ballot on 28 August 2026. When it publishes, it becomes the international baseline for what an AI logging capability has to be.
prEN 18229-1, AI trustworthiness framework, Part 1: logging. The European twin, drafted in CEN to sit inside the EU AI Act's regulatory framework. Its public hearing closed on 20 August 2026.
IETF draft-sharif-agent-audit-trail. An Internet-Draft specifying a logging format for autonomous AI agents specifically. Now at revision -03, updated 5 September 2026. It explicitly maps to the EU AI Act, SOC 2, ISO/IEC 42001, ISO/IEC 24970, prEN 18229-1 and PCI DSS.
None of these is law yet. Together they show where the law is heading, because they answer the same question Article 12 of the EU AI Act will ask from December 2027: what does a compliant agent record look like?
The shape everyone is converging on
Strip the jargon from all three documents and six requirements keep appearing.
Automatic capture of what happened. Not "the agent can log if asked". The system must record events over its lifetime, with no human in the loop deciding which events matter. Action taken, decision made, outcome observed.
Tamper-evident chaining. Records link to each other cryptographically. Altering any past record breaks the chain visibly. This is what turns a log file into evidence: the difference between "someone wrote this down" and "nobody could have edited this without leaving a mark".
Independent timestamping. For high-assurance records, the moment of finalisation is sealed by an external time authority. The draft agent audit trail recommends RFC 3161 timestamp anchoring for its top assurance tiers; that is the same mechanism public key infrastructure uses to prove a record existed at a point in time.
Pre-execution recording. The most interesting convergence. The IETF draft added this in revision -01: denied and escalated decisions must be recorded before the action runs, not reconstructed afterwards. A denial that was never captured is a denial that never happened. The EU framework has the same logic in a different form: the log must record situations that might present a risk, which only makes sense if capture starts at evaluation time.
Recording independence. At low assurance an agent may write its own records. At higher assurance an independent component should record on its behalf. An agent self-attesting its own behaviour is the weakest form of evidence; the standards push toward a recorder that is not the actor.
Humans identifiable in the record. The EU Act's Article 12 is explicit that logs must identify the natural persons involved in verification of results. Who approved this action, and when, is not optional metadata. It is a first-class field.
Why this matters if you run agents
The EU AI Act's automatic logging obligations for high-risk systems were pushed to December 2027 by this summer's omnibus regulation. That sounds like runway. It is not.
Litigation, investigations and audits run on their own calendar. The first party that asks what an agent did on a particular afternoon will not wait for a standards publication date. Courts are already treating agent outputs and prompts as discoverable records. By the time the logging obligation is enforceable, the question of whether your existing records can survive an evidence challenge will already have been answered, one way or the other, in someone else's case.
The organisations that come out ahead are the ones that treat agent records as evidence from day one, not as telemetry to be retrofitted later.
What good looks like
An agent record that will hold up has six properties, matching the convergence above:
- it exists automatically for every governed action, including denials
- it is hash-chained so tampering is visible
- high-assurance records carry an independent timestamp
- capture starts at policy evaluation, before the action runs
- the recorder is independent of the agent acting
- the human who approved is identified in the record
None of this requires waiting for the standards to finalise. The shape is visible now. Building to it early means the audit trail is already there when the regulator, the auditor or the court asks, instead of being a remediation project with a deadline attached.
WitnessOS is built to this shape: policy is evaluated before action, approvals are recorded with the approver identified, and receipts are hash-chained with independent RFC 3161 timestamps, re-verifiable offline with zero trust in the operator. The evidence ladder grades how strong a record is, from declared to independently anchored, and the grade is earned by configuration, never claimed.
The standards are converging on the evidence question. The organisations that answer it early are the ones that will not be scrambling in 2027.
WitnessOS is the runtime governance layer for autonomous agents, developed by Empire Labs Pty Ltd. Public repository: github.com/narko4u/witnessos.
Top comments (0)