Audit logs for physical actions: what to record when AI acts

When a web agent makes a mistake, you read the log and fix the data. When an AI system moves a machine, the log may be the only account of what happened to a person, a product or a production line. It needs to be good enough for an investigator, a regulator and a lawyer.

Several rules already say what to record. This post collects them, turns them into a field list, and shows a simple way to make the log tamper evident. Safeguard does not operate machines. It does provide audit logs in its own platform, and the design below applies to any system.

What's affected

Anything where software or an AI agent can cause a physical action: motion, heat, pressure, power switching, a vehicle command. The same design covers an agent calling a tool that sends a command to a controller.

What the rules say to record

Machinery Regulation, Regulation (EU) 2023/1230, applies from 14 January 2027. Annex III, section 1.2.1 says control systems must be built so that "the tracing log of the data generated in relation to an intervention and of the versions of safety software uploaded after the machinery or related product has been placed on the market or put into service is enabled for five years after such upload," and that it is used "exclusively to demonstrate the conformity" of the machinery on a "reasoned request from a competent national authority." For machinery with self evolving behaviour, the same section requires that "recording of data on the safety related decision-making process for software based safety systems ensuring safety function" is enabled and the data is "retained for one year after its collection."

Section 1.1.9 adds that machinery "shall collect evidence of a legitimate or illegitimate intervention in the software or a modification of the software installed on the machinery or related product or its configuration."

AI Act, Regulation (EU) 2024/1689, Article 12. High risk AI systems "shall technically allow for the automatic recording of events (logs) over the lifetime of the system," sufficient to identify risk situations, support post market monitoring and monitor operation.

UN Regulation No. 155, paragraph 7.3.7. The vehicle manufacturer must "provide data forensic capability to enable analysis of attempted or successful cyberattacks."

30 CFR 75.1732 for proximity detection on continuous mining machines. Records of checks, defects and corrective actions must be kept "in a secure book or electronically in a secure computer system not susceptible to alteration," for at least one year.

CISA and partners, December 2025. The guidance on AI in operational technology says to "configure logging so AI decisions can be tracked for compliance and forensic analysis, and so the logged AI identity is distinct from any typical machine or user identifiers," and describes an audit trail of "all AI system operating data (including timestamps, inputs, and outputs)."

How to design the log

Read together, those sources give a field list. For each action:

A sample record, illustrative:

{
  "ts": "2026-10-18T09:14:22Z",
  "actor": "agent:maintenance-assistant@v3.2",
  "approved_by": "operator:j.ortiz",
  "tool": "set_speed",
  "args": {"asset": "conveyor-7", "value": 0.4},
  "state_before": {"speed": 0.8},
  "state_after": {"speed": 0.4},
  "target_sw": "plc-fw-5.1.2",
  "prev_hash": "fc7ac0d040cded70996f6e5d4169fddc9da7b07528d7360c0dd73056b70af9e2",
  "hash": "123c104a62ac6acf05514886ed1c5672f6fd847adc5db3b4049b90c7f9ee4858"
}

To make tampering visible, chain the records. Each entry stores the hash of the one before. If anyone edits or deletes a record, every later hash breaks.

import hashlib, json

def append(log, record):
    prev = log[-1]["hash"] if log else "0" * 64
    record["prev_hash"] = prev
    body = json.dumps(record, sort_keys=True).encode()
    record["hash"] = hashlib.sha256(body).hexdigest()
    log.append(record)

def verify(log):
    prev = "0" * 64
    for r in log:
        h = r.pop("hash")
        if r["prev_hash"] != prev or hashlib.sha256(json.dumps(r, sort_keys=True).encode()).hexdigest() != h:
            return False
        r["hash"] = h
        prev = h
    return True

Ship the chain head to a second system, so the machine's own log cannot be rewritten wholesale.

What to do now

1. Write the field list above into your logging spec, and add what your sector requires.
2. Give each agent its own identity, never a person's.
3. Log approvals as separate, signed events.
4. Set retention per source: five years for intervention and safety software version logs under the Machinery Regulation, one year for decision data on self evolving systems, and whatever your sector rule adds.
5. Decide who can read the logs and how privacy is handled. The Machinery Regulation limits use of the intervention log to demonstrating conformity on a reasoned authority request, and vehicle data in R155 monitoring must respect owner privacy and consent.
6. Rehearse an investigation. Pick an action from last week and rebuild what happened from the log alone.

Why it matters

A log nobody can trust is worse than no log, because it invites false confidence. A chain of hashes, a distinct agent identity and recorded approvals turn a debugging aid into evidence.

Try it yourself

Use the incident walkthrough to reconstruct a timeline and see which missing fields stop you.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Regulation (EU) 2023/1230, Machinery Regulation, Annex III 1.1.9 and 1.2.1
• Regulation (EU) 2024/1689, AI Act, Article 12
• UN Regulation No. 155 (OJ L 82, 9.3.2021)
• eCFR, 30 CFR 75.1732
• CISA and partners, Principles for the Secure Integration of Artificial Intelligence in Operational Technology (3 December 2025)