Recording who checked AI work before it was used

Write down who read the AI output, when, and what they did about it. A name, a date and a result such as "approved", "changed" or "rejected" is enough to show a person looked.

Why a name matters

"Reviewed by a human" is easy to say and hard to prove. A name and a date make it something you can check.

The reason to bother is simple. Output can be false, and the OAIC, Australia's privacy regulator, says as much.¹ A person reading it is one safeguard you can use. A record shows the safeguard ran.

That regulator also wants businesses to think about building human oversight into their processes.¹ Recording the check makes oversight part of the routine, not just a good intention.

What a sign-off note holds

Keep it light. These fields cover most of what you'd want later.

• Who checked it, by name, not "the team".
• The date.
• What they checked against, such as a price list, a policy, the original document or their own knowledge.
• The result: approved as it was, edited, or thrown out.
• What they changed, in a few words, if anything.

The "checked against" field does most of the work. "Read it" is a weak check. "Compared the prices to the current list" tells a reader what the check really was.

Put these in the "Checked by" and "Notes" columns of your AI use log. Or use the job record you already keep, like a ticket, a quote file or an email thread.

Where to place the sign-off

Put the record where the work lives. If a quote goes through a quoting tool, add the note there. If an email is drafted with AI and sent from a shared inbox, a short internal note on the thread will do.

Avoid a separate system that people must remember to visit. Anything off to the side gets skipped when it's busy.

Not every use needs the same check

Work that goes to a customer, or that affects a person, deserves a named check. Private brainstorming usually doesn't. Decide the line in advance and write it down, so staff don't make it up on the spot.

Decisions that seriously affect a person's rights get special mention from the OAIC. It calls AI use there likely a high privacy risk activity.¹ If your tools touch decisions like that, ask your country's regulator. This site can't say what your duties are.

Here's a rough scale you might use.

It's a starting suggestion, not a rule. Adjust it to your own business.

Make the record hard to quietly change

A sign-off only counts if it stays as written. An audit trail, in general, is a set of records giving documentary evidence of the sequence of activities that touched an operation or event.² Treat your notes the same way. Don't overwrite an old note. Add a new line with the date if something changes.

Don't let people sign for each other either. Each checker adds their own name. If someone is away, the work waits, or a named stand-in does the check.

Found a mistake later? Add that to the record too. A mistake with a clear history is easier to fix than one nobody can trace.