Why keep records of how your business uses AI

Yes, write something down. It needn't be much. Without any record, you'll be guessing the first time someone asks how a piece of work was made.

What goes wrong without a record

Say a customer spots a wrong figure in a quote. Was the text drafted by an AI tool? Which one? Did anyone read it before it went out? If nobody wrote anything down, the honest answer is "we think so". That's a weak place to stand.

The same gap shows up in smaller ways. A staff member leaves and nobody knows which AI accounts they opened. A tool changes its settings and you can't say what it was doing with your data last spring. Two people use different tools for one job and get different answers.

AI tools can be wrong. Australia's OAIC, the privacy regulator, warns that they're known to hand back inaccurate or false answers.¹ If errors come with the territory, you'll want a way to trace one back to its start.

What a record gives you

A record is a memory the whole business shares. It can do a few jobs.

• Show which tools are in use, so an account you didn't know about doesn't surprise you.
• Show who used a tool and for which job, which helps when you follow up on a mistake.
• Show that a person checked the work. There's a separate page on sign-off notes.
• Give you something to look at when you judge how well a tool is doing.

That last job matters. The OAIC wants an AI product reviewed regularly, with staff trained and use watched for as long as you have it.¹ You can't review what you never noted.

Another thing it raises is who gets to see personal details put into a tool, or produced by one.¹ Notes on what was entered, and where, make that easier to answer.

Keep it small

The biggest risk to record keeping is weight. A heavy form gets dropped. A one-line entry survives.

Start with the tools, not the individual chats. Facts worth noting for each one are in what to record about each AI tool. Then try the spreadsheet layout for a running log.

Tax agencies give similar advice about ordinary business records. The Australian Taxation Office wants accurate, complete record keeping built into daily business activities.² That's tax advice, not AI advice. The habit carries over, though: a little each day, not one big clean-up a year.

Is any of this required?

It depends. Record rules differ by country, by industry and by what the AI touches. Some concern tax, some privacy, some your own sector. This site can't tell you which apply to you, and a record is no shield against a complaint. Your regulator's pages are the place to check. For retention periods, see how long to keep AI records.

Voluntary frameworks exist too. NIST, a US standards body, has an AI risk management framework that it calls intended for voluntary use.³ It's a place to look for a wider view of AI risk than a log gives.

Whatever you choose, tell people where the record lives and who looks after it. A record nobody knows about does nothing.