Law and data protectionAs of 1 October 2026René HerzerCreated with AI

Traceable AI: audit log, sources and the limits of explainable AI

Verifiable means two different things: what people did with the AI, and what an answer is based on. The audit log fully covers the first. The source reference covers the second, not the model's own explanation.

1QuestionA doctor asks in an app.
2baseboxsearches the documents shared with her.
3Modelgenerates the answer.
4Answerwith numbered sources and the quoted passage.

Who decides: the professionalShe checks against the source and is responsible for how the answer is used. Write actions by agents only after approval.

What was done: audit logWho, when, which app, which connector.

How it came about: model and reasoningModel and version are documented; the reasoning can be expanded.

What it is based on: sourcesEvery statement from documents shows its source with the quoted passage.

Limit: Why a model computes the way it does internally depends on the model and its training. Even a displayed line of reasoning can be wrong. The yardstick is therefore the source, not the model's justification.

What is in the audit log?

Sign-ins, changes to permissions, calls to connectors and web search, exports. On request also questions and answers; in that case all people see a clear notice. Export as CSV or through the interface, on request for your SIEM.

What is explainable AI?

The question of why a model computes the way it does internally. That depends on the model and its training. An expanded line of reasoning is the model's explanation, not a guarantee. That is why checking against the source is the core.

What about agents?

Write access is off by default. Actions are confirmed before they are carried out, and every action is in the audit log.

Audit log and logging

This article was created with the help of AI, based on the sources listed. Responsible for the content: basebox GmbH. Not legal advice. Reviewed on 1 October 2026.