Data Security firm Metomic found that nearly 35% of what employees type into ChatGPT contains sensitive data. It’s fair to say most organisations cannot tell you what their people are actually asking AI to do, because they are not logging it.
Today, we are talking about AI logs. What they are, why they matter, and why the EU AI Act has made them a legal requirement for certain organisations.
Let’s start with the basics.
What is an AI log?
An AI log is a record of activities and events that occur within an AI system. According to Credal, in a piece published in September 2024, these logs provide visibility and traceability of AI use across an organisation. They capture the prompts your people are typing in. The data they are sharing. The security policies that get triggered along the way.
Think of it like a paper trail for AI. Every time someone in your organisation opens ChatGPT, Copilot, Claude, or any other tool, that interaction can be logged. Those logs become the foundation of your AI governance.
If you are deploying AI tools without logging, you are flying blind. You do not know what sensitive data is being shared. You do not know which workflows are being automated. And you do not know where your compliance risks are hiding.
- IBM describes log data as falling into three categories.
- Access logs, which record who is using the system.
- Error logs, which record what goes wrong.
- Event logs, which record what happened and when. Each helps your teams monitor behaviour, troubleshoot incidents, and understand activity across the system.
Why this matters now
The Cloud Security Alliance published a report in September 2025 that puts it plainly. Logs are fundamental to Zero Trust security. They capture user activity, device behaviour, network traffic, and application access. But when organisations generate massive volumes of log data, manual review becomes unrealistic.
That is where AI itself comes back into the picture. The same technology that needs to be logged is now being used to analyse the logs. The Cloud Security Alliance says AI models can reduce false positives and help security teams recognise complex attack patterns more quickly.
So you are logging AI. You are also using AI to make sense of logs. Both matter.
The regulatory reality
The EU AI Act is in force, and it has teeth on this. Under the AI Act, providers of high-risk AI systems must enable automatic logging under Article 12. And they must keep those logs for at least six months under Article 19.
What counts as high-risk? Annex III of the AI Act lists categories like AI used in hiring, credit scoring, law enforcement, education, and critical infrastructure. If you are deploying AI in any of those areas, logging is no longer optional.
The logs must demonstrate that your system is functioning as intended. That decisions are explainable. That humans remain in the loop.
If you are in the public sector, pay particular attention. Public bodies often deploy exactly the kind of high-risk systems the AI Act is targeting.
AI logs in the classroom
Here is an interesting one. AI logs are now entering education. The University of Alabama Teaching Academy has published guidance on incorporating AI logs into assignments. Students are being asked to submit a log of their AI interactions alongside their work.
The idea is simple. Make the process visible. If we are teaching students to think critically about how they use AI, the log becomes the evidence of that thinking. And if we are asking students to do this, we should be asking the same of our organisations.
Here is the thing about AI logs. They are dull. They are technical. They are the kind of thing that gets pushed down the priority list because there is always something more exciting to talk about, like agentic AI or the latest model release.
But logs are where the rubber meets the road on governance. You cannot prove your AI is working properly if you cannot show the records. You cannot investigate a problem if you have no audit trail. And under the AI Act, you cannot claim compliance if you cannot produce the logs on demand.
For my public sector clients, this is the conversation I keep having. We talk about AI strategy. We talk about training. We talk about pilots. But the question I always come back to is this. Can you tell me, right now, what your people are doing with AI? Most cannot.
That is the gap. And logs are how you close it.
What to do this week
First, find out which AI tools your people are using. All of them. Including the ones on personal devices, which is your Shadow AI problem.
Second, check whether logging is switched on. For most enterprise plans of ChatGPT, Copilot, and Claude, audit logs are available, but they have to be enabled, and someone has to review them.
Third, if you are deploying anything that falls under the high-risk category in the EU AI Act, get legal advice now. Not next quarter. Now.
And finally, build a routine of review. Logs are useless if no one is reading them.
If you want to build your AI literacy and skills, I can help
📚 Grab AI Playbook on Amazon, the perfect podcast companion.
📰 Subscribe to Human in the Loop, my LinkedIn Newsletter
🎓 Take the CPD Accredited AI Playbook Diploma
📞 Book a call at digitaltraining.ie
Sources
- Credal, The Benefits of AI Audit Logs (Aisling Murray, 20 September 2024): https://www.credal.ai/blog/the-benefits-of-ai-audit-logs-for-maximizing-security-and-enterprise-value
- IBM Think, What is log analysis with AI?: https://www.ibm.com/think/topics/ai-for-log-analysis
- Cloud Security Alliance, Analyzing Log Data with AI Models to Meet Zero Trust Principles (15 September 2025): https://cloudsecurityalliance.org/artifacts/analyzing-log-data-with-artificial-intelligence-models
- EU AI Act, Article 12 (Record-keeping): https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12
- EU AI Act, Article 19 (Automatically generated logs): https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-19
- EU AI Act, Annex III (High-risk AI systems): https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
- University of Alabama Teaching Academy, Incorporating AI Logs in Assignments: https://uateachingacademy.ua.edu/incorporating-ai-logs-in-assignments/
Key Statistics
- 34.8% of what employees type into ChatGPT contains sensitive data (Metomic Q4 2025 research, also cited in NordVPN’s 2026 ChatGPT privacy guide). Rounded in script to “nearly 35%.”
- EU AI Act Article 19: logs from high-risk AI systems must be kept for a minimum of six months.
- High-risk categories under Annex III include AI used in hiring, credit scoring, education, law enforcement, and critical infrastructure.
About the Podcast Host
AI and Communications Specialist | Author | Podcaster | International Speaker
Joanne Sweeney is a recognised leader in digital marketing and digital transformation, specialising in the practical application of AI to enhance communication strategies. The founder of Digital Training Institute, Joanne, empowers leaders and communications professionals to leverage AI responsibly and effectively, ensuring transparency, trust, and tangible results.
She completed the Harvard Kennedy School Executive Programme in AI and Public Policy this summer before launching her fourth book AI Playbook, in September. Joanne has also published two editions of Public Sector Marketing Pro, which were preceded by her first title, Social Media Under Investigation Law Enforcement and the Social Web.
Her books have become go-to resources for governments, public sector and policing agencies, as well as marketing and communications professionals, all navigating the challenges of the changing Internet.
Joanne is the host of the AI SIX Podcast, a daily six-minute podcast that provides actionable insights, expert interviews, and practical advice to help professionals navigate the new world of work.
