---
title: "AI Tool Usage Tracking: Why CASB & DLP Miss Shadow AI"
description: "Learn why CASB and DLP miss shadow AI usage and what tools actually work for tracking employee AI tool usage."
canonical: "https://axipro.co/ai-tool-usage-tracking/"
language: "en-US"
modified: "2026-08-11T05:26:55+00:00"
generator: "WordPress 7.1.1"
---

[Home](https://axipro.co)

/ [AI](https://axipro.co/category/ai/)

/ AI Tool Usage Tracking: Why CASB & DLP Miss Shadow AI

# AI Tool Usage Tracking: Why CASB & DLP Miss Shadow AI

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- August 10, 2026

Copy Link

One in five breached organizations last year traced the incident to [shadow AI](https://axipro.co/shadow-ai-policy-template/), and those breaches cost an average of $670,000 more than standard incidents, according to [IBM’s 2025 Cost of a Data Breach Report](https://www.ibm.com/reports/data-breach). The worst part is that most of those organizations already ran a CASB, a DLP program, or both. The tools were on, but **the traffic still got through**.

That’s the visibility gap this article is about. AI tool usage tracking isn’t the same problem as SaaS discovery, and the security stack built for the SaaS era misses most of what matters about AI. Below, we break down what tracking actually requires, where CASB and DLP fail, which categories of AI usage slip through, and what a stack that works looks like in 2026.

![AI Tool Usage Tracking](https://axipro.co/wp-content/uploads/2026/08/AI-Tool-Usage-Tracking-1024x535.png)

## **What AI Tool Usage Tracking Actually Means**

Most teams that say they “track AI usage” mean they can see that someone visited chat.openai.com. That is app discovery, and it answers almost none of the questions a security or governance team actually needs answered.

### Beyond App Discovery: Tracking Prompts, Data Flows, and Model Interactions

Real tracking covers three layers.

- First, **which tools are in use:** chatbots, copilots, coding assistants, embedded SaaS features, agents.
- Second, **what data moves:** the content of prompts, uploaded files, and pasted context, mapped against data classifications.
- Third, **how models behave in your environment:** which endpoints get called, which OAuth grants exist, which agents hold standing permissions.

Seeing that an employee opened ChatGPT gets you nowhere. What you actually need to know is whether they pasted a customer contract into a personal account while they were there.

### The Difference Between Detection, Monitoring, and Continuous Tracking

*Detection* is a point-in-time answer to “what AI is here?” *Monitoring* watches known tools on an ongoing basis. *Continuous tracking* is broader: it assumes the inventory changes weekly, correlates identity, data, and endpoint signals over time, and feeds a governance program rather than a one-off report. Frameworks such as the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) and [ISO 42001](https://www.iso.org/standard/81230.html) assume the third mode. A discovery scan from last quarter won’t satisfy an auditor, and it certainly won’t slow down an attacker.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## **Why Traditional SaaS Monitoring Falls Short for AI**

SaaS monitoring was built around a stable premise: an app is a destination with a domain, a login, and an admin console. AI breaks that premise in several ways at once. The risky activity is the content of an interaction, not the visit. The tool often isn’t a destination at all but a feature inside an app you already sanctioned. And increasingly the “user” isn’t a person but an agent acting on delegated credentials.

## **Why CASB Misses Shadow AI Usage**

The [Cloud Access Security Broker](https://en.wikipedia.org/wiki/Cloud_access_security_broker) sits between users and cloud services to enforce policy, and for classic SaaS governance it still earns its keep. AI has structural blind spots that no amount of tuning can fix.

### CASBs Were Built for SaaS Apps, Not Model Endpoints

A CASB catalog maps domains to applications with risk scores. AI usage doesn’t resolve neatly to a domain. The same api.openai.com endpoint serves a sanctioned enterprise deployment, a developer’s weekend experiment, and a data-leaking browser extension, and the catalog sees one “app”. Meanwhile, new model endpoints, wrappers, and niche AI tools appear faster than any vendor catalog can keep up with. [Gartner research from late 2025](https://www.gartner.com/en/newsroom) found **69% of organizations already suspect or have evidence that employees use prohibited public generative AI tools**, catalog or no catalog.

### Blind Spots in Encrypted API Traffic to LLM Providers

Prompt content travels over TLS. Without full TLS inspection, a CASB sees connection metadata: destination, volume, timing. It can’t see that the payload contained source code or patient records. And full TLS inspection is harder than the datasheet implies. Certificate pinning breaks it for many native apps and CLI tools, legal and works-council constraints limit it in the EU, and most organizations carve out broad exemption lists that AI traffic happily rides through.

### The OAuth and Embedded AI Problem CASBs Can’t See

When an employee grants an AI meeting-notes tool access to their calendar and mailbox via OAuth, no proxy is involved at all. The vendor’s servers communicate directly with Microsoft’s or Google’s APIs using a persistent token. The same applies to AI features embedded inside sanctioned SaaS, think Notion AI, Slack AI, or Salesforce Einstein. The CASB sees approved traffic to an approved app, while the AI processing happening inside it, and whichever sub-processor it forwards data to, stays invisible.

### Personal Accounts and BYO-AI Bypass CASB Proxies

[Netskope’s 2026 Cloud and Threat Report](https://www.netskope.com/netskope-threat-labs/cloud-and-threat-report) found that **nearly half of employees who use generative AI at work do so through personal accounts**. Personal accounts on managed devices are hard enough; personal accounts on personal devices, home networks, and mobile connections never touch the corporate proxy path at all. Tenant restrictions help for a handful of major providers and do nothing for the long tail.

### Browser-Based and Extension-Delivered AI Escape Network Inspection

AI browser extensions read page content and form inputs locally, then exfiltrate via their own backend, often to generic cloud infrastructure that categorizes as “technology” rather than “AI”. From the network’s view, it is routine HTTPS to a CDN. The riskiest interaction, an extension scraping everything an employee views, produces the most boring traffic signature.

**Insider Note:** In [AI governance readiness assessments](https://axipro.co/services/gap-analysis/), the OAuth grant review is where clients get the biggest surprise. We routinely find dozens of AI tools holding live mail, calendar, or drive scopes that nobody in IT ever approved, granted by employees who abandoned the tool (and sometimes the company) months earlier. The tokens keep working anyway.

## **Why DLP Fails to Catch Shadow AI Data Exposure**

DLP has the opposite problem. It can sometimes see content, but it doesn’t understand it, and AI interactions defeat the pattern matching it depends on.

### Prompt-Based Data Loss Doesn’t Match DLP Signature Patterns

DLP fires on signatures: credit card regexes, SSN formats, keyword dictionaries, file fingerprints. Sensitive prompts rarely look like that. *“Summarize why we’re losing the Meridian account and draft talking points for the board”* contains no pattern a regex engine recognizes, yet it hands an external model your strategy and a customer’s identity in one sentence. The [2026 Verizon DBIR](https://www.verizon.com/business/resources/reports/dbir/) analyzed over 858,000 DLP events involving uploads to generative AI tools and found **source code the most frequently exposed data type by a wide margin**, and source code is precisely what signature-based DLP handles worst.

### DLP Can’t Distinguish Between Sanctioned and Unsanctioned AI Endpoints

An enterprise ChatGPT tenant with a zero-retention agreement and a free personal account are, to a DLP engine, the same destination. The risk difference between them is nearly the whole risk model, and DLP has no concept of it. So policies end up blocking both, which pushes users to their phones, or allowing both, which governs neither.

### Copy-Paste, Screenshot, and Contextual Leakage Blind Spots

Endpoint DLP can watch clipboard events into a browser, but it can’t evaluate what a paste means inside an ongoing AI conversation. Screenshots pasted into multimodal models bypass text inspection entirely. And context accumulates: ten individually harmless prompts across a session can jointly disclose a confidential deal. **No DLP engine evaluates a conversation. They evaluate events.**

### Lack of Semantic Understanding of AI Conversations

The core failure is semantic. Whether an AI interaction is risky depends on meaning, intent, and the sensitivity of information in context. That judgment requires language understanding, which is to say it requires AI. Regex-era DLP inspecting LLM traffic is a typewriter auditing a printing press.

### The Agentic AI and MCP Server Problem

Agents make it worse. An agent connected through [MCP (Model Context Protocol)](https://en.wikipedia.org/wiki/Model_Context_Protocol) servers reads files and calls APIs on service credentials, with no human in the loop per action. These non-human identities generate traffic that looks like any other service-to-service integration. The [Cloud Security Alliance’s May 2026 research on shadow AI applications](https://labs.cloudsecurityalliance.org/research/csa-research-note-shadow-ai-apps-enterprise-20260530-csa-sty/) found 53% of organizations have already experienced [AI agents exceeding their intended permissions](https://axipro.co/secure-ai-agent-vendor-certifications/). Gartner projects the average Fortune 500 enterprise will run more than 150,000 AI agents by 2028. DLP was designed for humans moving files. This is neither.

![Categories of AI Usage](https://axipro.co/wp-content/uploads/2026/08/Categories-of-AI-Usage-1024x683.jpg)

## **The Categories of AI Usage That Slip Through CASB + DLP**

Put the two failure modes together and a consistent set of blind spots emerges.

- **Public LLM chatbot sessions.** ChatGPT, Claude, Gemini, and the long tail, especially on personal accounts and unmanaged devices, where neither proxy nor endpoint agent is present.
- **AI features embedded in sanctioned SaaS.** Copilots inside productivity suites, AI summarization in CRMs and ticketing tools. The app is sanctioned; the AI processing inside it never was.
- **AI coding assistants and IDE plugins.** Assistants ship code context to model endpoints from inside the IDE, over pinned TLS, in developer environments that security tooling touches least. Given what the DBIR data says about [source code exposure](https://axipro.co/github-breach-may-2026/), this is arguably the single highest-value blind spot.
- **Browser extensions with AI capabilities.** They install locally, ask for broad permissions, and leave almost nothing behind on the network.
- **Autonomous agents and MCP server calls.** These run at machine speed on non-human identities, and their traffic blends into legitimate integration activity.
- **API-direct access to foundation models.** Developers and power users calling model endpoints from scripts, notebooks, and internal tools with personal API keys, bypassing every user-facing control.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## **What Actually Works: A Modern AI Tool Usage Tracking Stack**

No single tool replaces CASB and DLP for AI. What works is a **layered stack that moves inspection to where AI interactions are actually legible.**

### Browser-Level Telemetry for Prompt and Response Visibility

The browser is where most AI interactions become plaintext. Enterprise browsers and browser extensions for security capture prompts, pastes, and uploads before encryption, tied to the logged-in identity, with no TLS inspection required. This is the fastest-growing layer of the AI visibility market for a reason. The honest downside is that it only covers browser-based usage on managed profiles, and rollouts meet real employee-privacy resistance, particularly in European works-council environments. Scope it to business identities and be transparent about what you’re capturing.

### Identity-Centric Tracking via OAuth and SSO Signals

Your identity provider already logs a large share of AI adoption. New SSO registrations to AI tools, [OAuth consent grants with mail, file, or calendar scopes](https://axipro.co/iam-solutions-comparison/), and token activity for [departed users](https://axipro.co/employee-offboarding-checklist/) are all queryable today, with no new agents deployed. **Reviewing OAuth grants is the single highest-yield first step in most environments** and the cheapest.

### Endpoint Signals for Local Model and Agent Detection

Endpoint telemetry (EDR or dedicated sensors) catches what the browser layer can’t: IDE plugins, CLI tools, local models running via Ollama or similar, and agent processes making API calls. Process lineage plus destination gives you the non-browser half of the inventory.

### Prompt-Aware Content Inspection (Not Just Regex-Based DLP)

Once prompt text is visible, classify it with models, not regexes. Semantic classifiers can flag strategy discussions, unreleased financials, and source code exposure that no signature would catch, and can evaluate conversation context rather than isolated events. *This is DLP rebuilt for language.*

### Behavioral Analytics for AI Interaction Patterns

UEBA-style baselining applies cleanly to AI: a finance user suddenly pushing large volumes to a new model endpoint, an agent identity querying systems outside its historical scope, prompt volume spiking before a resignation. **Behavior catches the tools your catalog has never heard of.**

### Continuous SaaS-to-AI Integration Discovery

SSPM-style scanning of sanctioned SaaS reveals which AI integrations, plugins, and sub-processors are attached to your tenants, closing the embedded-AI gap that network tools can’t see. Run it continuously, because the integration list changes monthly.

### Pro Tip: Sequence by cost.

Sequence by cost. Week one: pull OAuth grants and SSO logs from your IdP, free. Month one: turn on SaaS integration discovery. Quarter one: pilot browser telemetry with a high-risk group such as engineering or finance. Endpoint and semantic layers come after, once the inventory tells you where the actual risk concentrates.

## **Building an AI Usage Tracking Program That Scales**

Tooling without a program produces dashboards nobody acts on. Four elements make tracking operational.

### Establishing a Baseline of AI Interactions Across the Workforce

Run discovery across all layers for 30 to 60 days before enforcing anything. Expect the inventory to come back several times larger than anyone predicted. Knowing that in advance keeps leadership from reaching for a panicked blanket ban, which mostly drives usage further underground. The baseline also gives you the denominator for every metric that follows.

### Defining Risk-Tiered Tracking Policies by Tool and Data Type

Not all AI usage deserves the same scrutiny.

A workable model uses three tiers:

- **Sanctioned tools** with enterprise agreements (light-touch logging),
- **Tolerated tools** (monitored, with data-type restrictions), and
- **Prohibited tools** (blocked where feasible, alerted everywhere else).

Tier by data sensitivity as well: marketing copy in a chatbot and customer PII in a chatbot are different events, and under [GDPR](https://axipro.co/gdpr-compliance/) the second may be a reportable one.

### Correlating User, Data, and Model Signals

The value is in the joins. Browser telemetry says what was pasted; the IdP says which identity; SSPM says which integrations that identity authorized; endpoint data says which agents run under it. Correlated, these answer the question that matters: **which people and which agents are moving which data into which models.**

### Feeding AI Tracking Data Into SIEM and Governance Workflows

Route high-severity events into the SIEM alongside everything else, and route the aggregate picture into governance. ISO 42001 and the EU AI Act both presuppose that you know what AI systems are in use, and tracking data is the evidence base for the AI asset inventory, impact assessments, and audits those frameworks require. IBM’s 2025 data found **97% of organizations that suffered AI-related breaches lacked proper AI access controls.** Tracking is how you find out whether you’re one of them before an incident does. If you are building that governance layer, our guide to [implementing ISO 42001 step by step](https://axipro.co/step-by-step-iso-42001-implementation-guide-axipro/) covers how the AI asset inventory and risk register fit together, and for organizations deploying agents, [AIUC-1 AI agent certification](https://axipro.co/aiuc-1-certification/) extends that governance into auditable agent-level controls.

## **Evaluation Criteria: Choosing an AI Usage Tracking Solution**

The market is crowded and the marketing is uniform, so evaluate on architecture rather than adjectives.

- **AI-native detection vs. retrofitted CASB/DLP.**
Ask vendors to show detection of an unlisted tool, a personal-account session, and an embedded SaaS AI feature. Retrofitted platforms typically pass the first test and fail the other two, because catalogs and signatures are still doing the work underneath.
- **Depth of prompt and response visibility.**
Some tools log that an AI site was visited, some capture prompts, and only a few capture responses and file uploads with data classification attached. Know which layer you’re buying, and check retention and redaction options, since prompt logs are themselves a sensitive data store.
- **Coverage across browser, endpoint, API, and SaaS.**
No vendor covers all four well. Decide which gaps you will accept or fill with a second product, and weight coverage by where your risk sits: engineering-heavy companies should weight endpoint and API coverage far above browser.
- **Real-time enforcement vs. after-the-fact logging.**
Inline blocking and redaction stop leaks but add latency and false-positive friction, while logging is safer to deploy and useless in the moment. Mature programs start in log-only mode and graduate specific high-confidence policies to enforcement.
- **Integration with existing identity and security stack.**
The correlation described above only happens if the tool speaks to your IdP, SIEM, and EDR natively. A brilliant detector that exports CSVs won’t survive contact with your SOC’s workload.

**Budget honestly:** browser-layer and SSPM-style tools commonly land in the $3 to $10 per user per month range, full platforms higher, and the internal cost of policy design and alert triage usually exceeds the license. Set against IBM’s $670,000 shadow AI breach premium, the math is rarely the hard part; *the operating discipline is.*

Shadow AI isn’t a gap you can close by tightening the tools you already have. CASB can’t see inside encrypted, OAuth-mediated, extension-delivered AI traffic, and DLP can’t judge the meaning of a prompt. Visibility has to move to the browser, the identity layer, the endpoint, and the SaaS integration graph, and the output has to feed a governance program that decides what happens next. Organizations that build that stack now will walk into [EU AI Act obligations](https://axipro.co/eu-ai-act-compliance-and-certification/), ISO 42001 audits, and their own board meetings with evidence instead of estimates.

## **Frequently Asked Questions**

Can CASB detect ChatGPT usage?

Partially. A CASB can see connections to known ChatGPT domains from devices routed through its proxy, and it can block them. It can’t see prompt content, can’t tell an enterprise tenant from a personal account, and sees nothing from unmanaged devices, personal networks, or API traffic. **Seeing the visit isn’t the same as seeing the risk.**

Does DLP block prompt injection or data leakage into LLMs?

Not reliably. DLP can block pattern-matched data (card numbers, SSNs) from reaching known AI destinations if it can inspect the traffic. It doesn’t understand prompts semantically, so most sensitive-but-unstructured leakage passes straight through, and prompt injection is an attack on the model’s behavior, which DLP doesn’t evaluate at all.

What's the difference between shadow AI detection and AI usage tracking?

Detection is the discovery step: finding unsanctioned AI tools in the environment at a point in time. AI usage tracking is the continuous program built on top: monitoring interactions, correlating identity and data signals, enforcing tiered policies, and feeding governance frameworks like ISO 42001 and the NIST AI RMF with evidence.

Do I need to replace my CASB and DLP to track AI usage?

No. Keep them for what they do well: SaaS access governance and structured-data controls. Add AI-specific layers on top: identity-based OAuth monitoring, browser telemetry, SaaS integration discovery, and prompt-aware classification. Replacement is rarely justified; supplementation almost always is.

How do you track AI usage in encrypted traffic?

You mostly don’t decrypt it; you move the inspection point. Capture interactions at the browser or endpoint before encryption; use identity signals.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- August 10, 2026
- [AI](https://axipro.co/category/ai/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [All Blog](https://axipro.co/category/blog/), [Customer Stories](https://axipro.co/category/stories/), [Denmark](https://axipro.co/category/denmark/), [ISO-27001](https://axipro.co/category/iso-27001/)

- September 19, 2026

#### [How Haime got through its first ISO 27001 internal and external audits in under four weeks with Axipro](https://axipro.co/haime-iso-27001-internal-external-audit/)

Haime, a Danish AI governance software company, completed independent ISO 27001 internal and external audits with Axipro in under four weeks in 2026.

[Read more](https://axipro.co/haime-iso-27001-internal-external-audit/)

- [ISO-9001](https://axipro.co/category/iso-9001/)

- September 18, 2026

#### [ISO 9001:2026 Changes: What’s New and How to Transition](https://axipro.co/iso-9001-2026-changes/)

ISO published ISO 9001:2026 on September 16, 2026, and the 2015 edition is now formally withdrawn. If you hold a certificate, the good news is that the structure and the process approach are the same, and the list of new requirements is short. Top management now has to promote a quality culture and ethical behavior. Risks and opportunities get handled separately, change management carries more weight, and the 2024 climate change amendment sits inside the core text. That’s most of it. Below, we go through each change clause by clause, cover what stayed where it was, set out the transition timeline, and list the work a certified company has to do before the deadline. Key Takeaways ISO 9001:2026 is the sixth edition of the standard and replaces ISO 9001:2015. Most of the new text is guidance, and only a small part of it adds requirements. The changes that carry audit weight are in Clause 5.1 (quality culture and ethical behavior), Clause 6.1 (risks and opportunities addressed separately), and Clause 6.3 (planning of changes). ISO 9001:2015 certificates stay valid during the transition period, which is expected to run for three years, until around September 2029. Your certification body confirms the exact date. Certification bodies need their own accreditation to the new edition before they can issue 2026 certificates, so nobody has to panic this quarter. A healthy 2015 system needs a gap analysis, some document updates, and better leadership evidence. You won’t have to rebuild it. ISO 9001:2026 Is Now Published: Where the Revision Stands On September 16, 2026, ISO announced the publication of ISO 9001:2026. ISO describes the edition as a set of targeted updates that make the standard clearer and easier to use, built on the framework more than one million organizations already work with. The official ISO 9001:2026 standard page is live. ISO’s page for ISO 9001:2015 now marks that edition as withdrawn and tells certified organizations to speak to their certification body about transition arrangements. It took longer to get here than planned. ISO’s quality committee first voted to leave the 2015 edition alone, then changed its mind in August 2023 after wider consultation. The Draft International Standard followed in August 2025, the final draft went to ballot in spring 2026, and publication hit the September target. Two companion documents came out earlier in the year. ISO 9000:2026, the fundamentals and vocabulary standard, was published in May 2026, and ISO 19011:2026, the auditing guideline, was updated around the same time. If your internal audit procedure cites either one by year, add it to the update list. Why ISO 9001:2015 Was Revised Eleven years is a long time for a management standard. Since 2015, supply chains have become more fragile, remote, and hybrid work has changed how processes run, and customers ask harder questions about ethics and data integrity than they used to. ISO reviews its standards on a regular cycle, and in 2023 the consensus was that a revision would be worth the effort. According to ISO/TC 176/SC 2, the subcommittee responsible for ISO 9001, 81 experts from 46 countries and liaison bodies took part. The result is still conservative, and that was a choice. A standard with a million-plus users can’t afford a rewrite every decade, so the committee went for clarification. ISO 9001:2026 vs ISO 9001:2015: Summary of Changes Area ISO 9001:2015 ISO 9001:2026 Structure Annex SL high-level structure, Clauses 4 to 10 Same clause layout, updated to the latest Harmonized Structure Clause 3, terms Points entirely to ISO 9000 Includes a limited set of core terms; ISO 9000:2026 remains the normative reference Climate change Added by Amendment 1 in 2024 Built into Clauses 4.1 and 4.2 Leadership (5.1) Commitment to the QMS and customer focus Adds promotion of quality culture and ethical behavior Risks and opportunities (6.1) Addressed together Addressed separately, with distinct actions for each Planning of changes (6.3) Brief requirement Reinforced to protect intended results Annex A Short clarification of structure and terms Expanded guidance on the intent of requirements, informative only Annex B Listed other ISO/TC 176 standards Removed; references moved to Annex A and the committee website Key Changes in ISO 9001:2026, Clause by Clause Clause 3: Core Terms Now Sit Inside the Standard The 2015 edition sent readers to ISO 9000 for every definition. The 2026 edition brings a limited number of core management system terms into Clause 3 itself, and ISO 9000:2026 remains the normative reference for the full vocabulary. There’s nothing to set up here. Just check that your quality manual and procedures don’t cite definitions by their old source or year. Clause 4: The Climate Change Amendment Is Now Core Text In February 2024, ISO amended every major management system standard. Organizations had to determine whether climate change is a relevant issue (4.1) and whether interested parties have related requirements (4.2). That amendment took effect immediately, with no transition period, and ISO 9001:2026 folds the same text into the body of the standard. If you handled the amendment properly in 2024, you have nothing new to do. If you wrote “not applicable” on a sticky note, go back to it, because auditors will now read this as a standing requirement. Not relevant is a perfectly acceptable conclusion for many businesses, as long as there’s a reason written down behind it. Clause 5.1: Quality Culture and Ethical Behavior Become Leadership Duties This is the change everyone is talking about, and it’s the hardest one to evidence. Top management now has to show leadership by promoting a quality culture and ethical behavior. The same themes turn up in the requirements for awareness (7.3) and the environment for the operation of processes (7.1.4). You don’t need a culture program for this, and you don’t strictly need a new code of conduct, although one helps. What the auditor wants is for top management to show what they do day to day. Management review minutes where quality problems get discussed without blame are good evidence. So is a working route

[Read more](https://axipro.co/iso-9001-2026-changes/)

- [ISO 42001](https://axipro.co/category/iso-42001/), [SOC-2](https://axipro.co/category/soc-2-2/)

- September 17, 2026

#### [AI Agent Audit Log Requirements: ISO 42001 & SOC 2](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

An AI agent reads a customer record, decides a refund is warranted, and calls the payments API. The trail it leaves looks nothing like a human doing the same job. The log says a user logged in, a service account made three API calls, and the transaction cleared. It doesn’t say why the agent decided on a refund, what it read first, which model version did the reasoning, or who gave the agent permission to act in the first place. That missing “why” is the whole audit problem. This article covers what ISO/IEC 42001:2023 and the SOC 2 Trust Services Criteria expect from AI agent audit logs, where the two overlap, the fields a log needs to satisfy both, how long to keep records, what you shouldn’t record, and how to package it all for an auditor. It’s written for the CTO, platform lead, or founder who owns compliance for a product that now ships with autonomous agents and needs a certification and a Type II report without running two separate logging programs. The Compliance Gap: Traditional Application Logs vs. AI Agent Audit Logs Why Standard Logs Fall Short for Autonomous Agents Application logs were built for deterministic software. Same input, same state, same output, so recording the input, the state change, and the result is enough to reconstruct what happened. A SOC 2 auditor sampling access logs can trace a database write back to a login, a role, and a change ticket without much effort. Agents break that chain in a few places. They usually run under a shared service account or a borrowed OAuth token, so the log pins the action to a machine identity with no link to the human who set the task. The action itself was picked at runtime by a model rather than fixed in code, so there’s no source line to point at. The same prompt can produce a different tool call tomorrow, so a single sampled log entry proves almost nothing about how the system behaves in general. The Shift from Deterministic State Logging to Intent and Reasoning Capture Traditional logs answer “what changed.” Agent audit logs also have to answer “what was the agent trying to do, what did it consider, and what held it back.” That means capturing the task as delegated, the context the model was handed, the reasoning or planning steps it produced, the tools it picked and the arguments it passed, and every point where a guardrail stepped in. The unit of audit moves from the event to the decision, and each decision needs enough surrounding context that a reviewer can judge whether it was reasonable. Unique Audit Challenges of Non-Deterministic AI Behavior Non-determinism is the part auditors struggle with most. In a normal control test, the auditor re-performs the control and expects the same result. Re-run the same input through an agent and you may get a different path. The practical answer is to stop trying to prove that any single output was correct and instead prove that every output was recorded, attributed, bounded by policy, and reviewable. Logs show that the management system works. They don’t show the model is infallible, and nobody expects them to. ISO 42001 accepts this framing outright. SOC 2 auditors are still catching up, and you’ll spend some time educating them. Insider Note: Auditors don’t expect you to explain the model’s weights. They expect you to show that when the agent did something unexpected, you could find it, see what it read, see what it did, and see who was accountable. Frame every logging decision around that reconstruction test. What ISO 42001 Requires for AI Agent Audit Logs ISO/IEC 42001:2023 is the certifiable standard for an AI Management System (AIMS). It follows the same Plan-Do-Check-Act structure as ISO 27001 and comes with 38 Annex A controls. The phrase “audit log” barely appears in it, but logging obligations run through the main clauses and at least three Annex A areas. Our ISO 42001 certification services map these to your existing controls where possible. Clause 8: Operational Logging and Documentation Requirements Clause 8 asks you to plan, run, and control the processes needed to meet your AI requirements, and to keep documented information showing those processes ran as planned. For an agent in production, the process is the runtime behavior, so documented evidence means logs of the agent operating, not a procedure document on its own. Clause 8.4 adds an AI system impact assessment whose results you have to retain. When an agent’s scope or toolset changes, the record of that change and the updated assessment are both Clause 8 evidence. Clause 9: Performance Evaluation and Evidence of Monitoring Clause 9.1 asks you to decide what to monitor and measure, how, and when, and to keep evidence of the results. An auditor will want the monitoring you defined for each agent (error rates, guardrail block rates, tool-call anomalies, how often humans override) and the records showing you reviewed it. Clause 9.2 internal audit and 9.3 management review both feed off those records. Without operational logs, there’s nothing to measure, and Clause 9 falls over. Annex A.6: AI System Lifecycle Logging Obligations Annex A.6 is where logging gets explicit. A.6.2.8, AI system recording of event logs, requires you to decide at which phases of the AI system lifecycle event logging is switched on, and the Annex B guidance ties this to traceability and anomaly detection. A.6.2.6, AI system operation and monitoring, requires ongoing monitoring in operation, including AI-specific threats like data poisoning and model theft. Read together, they mean logging can’t start at go-live. Design decisions, validation runs, deployment configs, and production behavior all need a record. Annex A.9: Logging Requirements for AI System Operation Annex A.9 covers responsible use: processes for responsible use (A.9.2), objectives for it (A.9.3), and intended use (A.9.4). The logging consequence is that you need to show the agent stayed inside its intended use. That takes logs of the tasks it was given, the actions it took,

[Read more](https://axipro.co/ai-agent-audit-log-requirements-iso-42001-soc-2/)

WhatsApp us