ISO/IEC 42001:2023, Annex A

What ISO 42001 requires in terms of AI system event logs, and what Logsiegel contributes

ISO 42001 is the management system for AI, meant as the counterpart to ISO 27001 for information security. It explicitly asks for event logs for AI systems. Logsiegel is such a log, with the addition that its integrity can be proven.

Who this applies to

Organizations building or certifying an AI management system to ISO/IEC 42001, as providers or as users of AI systems. Increasingly also as evidence for customers who ask for AI governance in tenders, and as a building block toward conformity with the AI Act.

What the regulation requires in terms of records

The relevant controls from Annex A:

Reference	Requirement
A.6.2.8	AI system recording of event logs: the organization determines at which phases of the life cycle event logs are kept, at least during use of the AI system.
A.6.2.6	AI system operation and monitoring: the operation of the AI system is to be monitored in line with the documentation; deviations are to be detected.
A.6.2.5	AI system deployment: requirements for deployment, including the conditions under which the system is operated.
A.8.4	Communication of incidents: procedures to communicate incidents involving the AI system to users, affected people and authorities; that presupposes solid records.
A.9.4, A.10.3	Responsible use and suppliers: requirements for responsible use and for suppliers, compliance with which has to be demonstrable.
Clauses 9.1, 9.2	Monitoring, measurement, analysis; internal audit. The auditor needs records they can trust.

What Logsiegel contributes today

Event log during use (A.6.2.8). The LiteLLM adapter records every model call with time, model, token counts and hashes; model changes, human interventions and anomalies are event types of their own. The attributes follow the OpenTelemetry GenAI conventions.
Unaltered records, verifiable. Every entry is hash-linked to the one before it; at intervals a Merkle root is formed and signed with Ed25519 (a checkpoint). Any later edit, reorder or truncation makes logsiegel verify fail. For the auditor under clause 9.2, that means: they check the record instead of believing it.
Evidencing deviations (A.6.2.6). Errors and outliers are recorded as an anomaly and are thus part of the provable chain, not of a separate, editable error list.
Communication of incidents (A.8.4). logsiegel receipt builds a file for one single action, made of the entry, an inclusion proof and a signed checkpoint. An auditor, customer or court verifies it offline against your published key, without access to your systems and without seeing the rest of the trail.
Retention you can prove. A signed checkpoint shows that at a given moment the trail had a certain length and a certain content. Anyone who truncates it later stands out against every checkpoint or receipt handed out earlier.
A readable dossier. logsiegel export writes the trail as a Markdown dossier for people who do not want to touch a command line.
Metadata only in the trail. What enters the chain is event metadata and salted hashes; inputs and outputs are kept separately, encrypted per entry. The content of an entry can be deleted by deleting its key (crypto-shredding), without breaking the chain.

What is in progress planned

An event taxonomy for agents mapped onto ISO/IEC 24970 (AI event logging, under development) and prEN 18229-1, so that the logs speak the language of the coming standards.
MCP proxy for tool calls, independent witness for checkpoints.

What Logsiegel does not do

The management system. AI policy, roles, risk and impact assessment (A.5), data management (A.7), life cycle documentation (A.6.2.2 to A.6.2.4): separate work.
Monitoring as an activity. A.6.2.6 requires that somebody actually looks. Logsiegel supplies unaltered records, not the analysis.
Completeness. What is proven is that the recorded material is unaltered, never that everything was recorded. That is an integration question: the adapter has to sit at a point every action must pass (LiteLLM today, MCP proxy in progress).
Protection against the operator itself. Whoever holds the signing key could rewrite the trail and sign it again. That comes to light precisely when somebody else holds an earlier checkpoint or receipt. So hand your checkpoints out; counter-signing by an independent witness is the next stage of the project.
Time. Timestamps in the trail are a claim by the operator until they are counter-signed by a witness or by a qualified timestamping service.
Legal assessment. Whether your system falls under the regulation, which duties apply in detail and whether a receipt is enough in a given case is decided by your legal or compliance review, not by this tool.

How to put it to work

1. Install it and create a trail

The SDK is Python, Apache 2.0, no server and no account. The origin (origin) names the system whose actions are being recorded.

pip install logsiegel
logsiegel init ./trail --origin "acme.example/support-agent"

2. Plug the adapter in at the point every action must pass

If your AI traffic runs through LiteLLM, every completion becomes a signable inference entry, and errors are recorded as an anomaly. Human interventions you record explicitly, as an event of their own.

import litellm
from logsiegel.integrations.litellm_logger import LogsiegelLogger

litellm.callbacks = [LogsiegelLogger("/var/lib/logsiegel/prod", store_payload=True)]

3. Record life cycle events explicitly

A.6.2.8 speaks of phases of the life cycle. Besides use, record model changes and deployments as events of their own, and the phase becomes readable in the trail.

logsiegel log ./trail --event model_change \
  --attr gen_ai.request.model=gpt-5 --attr previous=gpt-4.1 --attr approved_by="ml-board"

4. Create checkpoints and hand them out

Create checkpoints regularly (via cron, for instance) and put them outside your own infrastructure: with the auditor, with the customer, in someone else's repository. Only a checkpoint you no longer control alone makes the trail hold up against yourself.

logsiegel checkpoint ./trail
logsiegel verify ./trail

5. Hand out the receipt when someone asks

Instead of database extracts you hand out a single receipt. The other side verifies it in the browser at logsiegel.com/verifier or on the command line, both offline.

logsiegel receipt ./trail --seq 1284 --out receipt.json
logsiegel verify-receipt receipt.json --pubkey logsiegel.pub

More regulations: EU AI Act GDPR DORA NIS2 / critical infrastructure ISO/IEC 27001 GoBD eIDAS Overview

Legal status September 2026. This page is a technical assessment by the project, not legal advice and not a conformity statement. Please check the references against the current text of the law. Corrections welcome via GitHub issue.