Control · C-001 · Monitoring, Assurance & Incidents
AI system monitoring and logging
Every production AI system is instrumented to record its inputs, outputs, errors and usage, with thresholds that raise alerts to a named owner who must act.
- Control type
- Detective
- Risks addressed
- 13
- Audience
- Heads-of · Practitioner
- Frameworks
- Principle 12 · Article 12 · Article 26 · Clause 9
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it does
It lets the organisation see what its AI systems are doing. Each system emits telemetry on what it received and returned, how it performed, what its safety filters did, how much it was used and what people overrode. Thresholds turn that data into alerts, and each alert has an owner and a response. This is the base layer: specialised monitoring of model performance, fairness, abuse and customer outcomes is built on the data it collects. The system owner is accountable; engineering builds it and operations respond. It runs continuously.
How to implement it
- Instrument at design, so that every request and response can be logged with its version and context.
- Monitor what the system produces as well as whether it is running.
- Set thresholds for error, refusal, override and filter rates, and for unusual input patterns.
- Route each alert to a named owner with a defined response time.
- Sample live outputs for human review where quality cannot be measured automatically.
- Review thresholds and alert volumes periodically, and prune alerts nobody acts on.
Evidence it operates
Design: a monitoring standard and, for each system, a list of measures, thresholds and owners. Operation: live dashboards; alert history with responses; sampling records; incidents first detected by monitoring.
Where it fits
From deployment through operation, beneath the other detective controls. It is the primary control for AI monitoring and alerting gap. Drift and performance monitoring builds on it for model quality, and AI record-keeping and audit trail governs what is retained. It feeds AI incident response and rollback.
Limits
Telemetry shows that something changed and seldom why. Output quality is hard to measure automatically, so the most important signal is often the weakest. Too many alerts are ignored as surely as none. Logging full content creates its own data protection exposure.
Risks this mitigates
Primary mappings
- AI monitoring and alerting gap High
- Collects the operational signals. A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident.
- Algorithmic collusion and market manipulation High
- Surveillance of algorithm behaviour in the market. Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so.
Supporting mappings
- Adversarial evasion attacks High
- Shows unusual input patterns in production. An input is crafted so that a model misclassifies or mishandles it while it looks unremarkable to a person, defeating the decision or the safeguard the model was there to provide.
- AI model drift and degradation High
- Supplies the operational data that shows degradation. A deployed model's performance declines as the world it operates in moves away from the data it was trained and validated on, with no change to the model itself.
- AI system lifecycle controls gap Medium
- Covers the operating stage of the lifecycle. The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired.
- Cascading failures in agent workflows High
- Detects abnormal activity across the chain. An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene.
- Deepfake impersonation and synthetic identity fraud Critical
- Flags anomalous verification attempts. Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication.
- Excessive agency in autonomous agents High
- Logs what the agent did for review. An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved.
- Model extraction and inference-API abuse High
- Provides the query logs that detection relies on. Systematic querying of a model through its normal interface lets an attacker build a functional copy, taking the intellectual property and gaining a private replica to attack.
- Record-keeping and logging failure High
- Operational logging supplies much of the record. The system does not automatically record the events needed to reconstruct what it did, or the logs are not retained for as long as they may be needed.
- Sensitive information disclosure Critical
- Logs show when and how a disclosure occurred. An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it.
- Training data bias and discriminatory outcomes High
- Logged decisions supply the outcome data that fairness monitoring analyses. Bias in the data a model learns from, whether from history, sampling or labelling, is reproduced or amplified in its outputs and in the decisions that rely on them.
- Unbounded resource consumption Medium
- Shows abnormal consumption as it builds. With no limit on the volume, size or cost of requests, a user or attacker drives inference far beyond what the system was sized or budgeted for, degrading service or running up charges.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Code of Practice for the Cyber Security of AI | Principle 12 | Monitor your system's behaviour Monitoring of system behaviour. |
| EU AI Act | Article 12 | Record-keeping Recording of events. |
| EU AI Act | Article 26 | Obligations of deployers of high-risk AI systems Deployers monitor operation and keep logs. |
| ISO/IEC 42001:2023 | Clause 9 | Performance evaluation |
| MITRE ATLAS | AML.M0024 | AI Telemetry Logging and Monitoring The corresponding mitigation. |
Related terms
How to cite
Axiom Verity (2026). AI system monitoring and logging. Reference Library, C-001. https://axiom-verity.com/controls/ai-system-monitoring-logging. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.