Control A.6.2.8: AI system recording of event logs
Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use.
What control A.6.2.8 asks
Decide in which life cycle phases the AI system records event logs, and make sure it does so at least while it is in use.
Why it matters for privacy
A log is the only way to answer what happened to a person's data. It is also a store of personal data in its own right, which is the tension the control has to manage.
Where the draft lands: accountability in operation. The abstract's treatment of risk needs evidence of what happened. The log is that evidence, and a privacy decision in itself.
Basis for A.6.2.8: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Operating, monitoring and telling people.
Evidence for control A.6.2.8
The list below is what a reviewer will want produced, not described. For control A.6.2.8 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Event logging Logging decision per life cycle phase
- Event logging Operational event logs supporting traceability and detection of operation outside intended conditions
- Event logging Log content such as time of use, production data and out-of-range outputs
- Event logging Log retention aligned with intended use, retention policy and law
Where control A.6.2.8 commonly fails
- No logging while the system is in use
- Logs kept for less time than legal requirements
- Out-of-range outputs not captured
What to do about control A.6.2.8 before the draft lands
Record events that matter for accountability, set a retention period per log, restrict access, and test that a subject request can be answered from the log.
Do not rebuild around a draft. Control A.6.2.8 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.6.2.8
- Control A.3.3, Reporting of concerns
- Control A.6.2.5, AI system deployment
- Control A.6.2.6, AI system operation and monitoring
- Control A.8.2, System documentation and information for users
← Control A.6.2.7 | Control A.7.2 →
Open the full index. The public record behind control A.6.2.8 shows the scope and the lifecycle.
The record behind control A.6.2.8 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.