Imagine it is March 2028.
A regulatory inquiry lands on your legal team's desk. The European Banking Authority wants a full account of every credit decision your AI-driven loan origination system made between January 2026 and December 2027 — specifically, the cases where the system's output differed from what a human reviewer would have decided. They want the model invocation records, the input metadata, the output scores, the human override logs, and evidence that none of these records have been modified since they were created.
Your legal team calls your engineering team. Your engineering team opens the application logs.
And then the uncomfortable conversation starts.
What "Reconstructing" AI Records Actually Looks Like
Most enterprises that have not built dedicated AI evidence infrastructure go through the same process when a serious audit or investigation requires AI decision records. The engineering team pieces together fragments from multiple sources:
- Application server logs with partial event data, stored in a database where admins have write access
- Model deployment records from the MLOps platform showing which model version was active on which date
- Database snapshots with output fields, missing the input feature context
- Spreadsheet exports from the governance platform documenting what the policy said, not what the system did
The result is a plausible reconstruction — a narrative that explains what the AI system was designed to do and what the available evidence suggests it did. Compliance teams spend weeks on this exercise. Legal bills compound.
And then the regulator asks the question that cannot be answered satisfactorily: How do we know this record hasn't been assembled to show what you want us to see, rather than what actually happened?
This is not an unreasonable question. It is the right question. And there is no good answer when the records were assembled retroactively.
Why Retroactive Records Fail the Evidentiary Standard
A sealed audit trail is not just a log. It is a log where the integrity of each record is mathematically verifiable — where any modification after the fact, even by a system administrator, leaves a detectable signature in the cryptographic chain.
EU AI Act Article 12 does not require logs that describe AI events. It requires logs that are automatically generated at the time of the event, with integrity controls that make post-hoc modification detectable. ISO/IEC 42001 similarly requires evidence of AI system operation that is produced by the system, not reconstructed from fragments.
Retroactively assembled records fail this standard on first principles:
They were not automatically generated. They were manually compiled from multiple sources by engineers and compliance staff. This is not what "automatically generated" means.
Their integrity cannot be demonstrated. There is no cryptographic chain showing that record 4,227 existed before record 4,228. There is no external witness that can attest the records were sealed before the investigation began.
They represent the enterprise's interpretation of events. The records contain the conclusions your team drew from the available evidence, not the raw events themselves. That distinction matters enormously in a legal or regulatory context.
They cannot answer the hardest questions. If a regulator wants to know the exact confidence score your model assigned to a specific decision on a specific date, and that value was not stored in real time with appropriate integrity controls, you cannot produce it. Not because you are hiding it — because it no longer exists.
The Mathematics of Delay
Every day that passes without AI event sealing is a day of history that cannot be recovered. Consider the practical calculation for an enterprise deploying AI in loan decisioning at scale:
If a regulatory investigation covers a two-year window and instrumentation began six months in, 625,000 of those decisions — 25% of the total — exist only as fragments across application servers and databases, not as sealed evidence records.
In a fair lending investigation, those 625,000 decisions are precisely the ones an adverse party will focus on. The absence of complete, integrity-protected records for that period is not neutral. It is a gap that regulators and plaintiffs are trained to identify and exploit.
Starting instrumentation three months earlier would have recovered 375,000 of those records. Starting today recovers every decision from this point forward — permanently.
Why "We'll Start Before the Audit" Is the Riskiest Strategy
Some compliance teams operate on the assumption that they will instrument their AI systems before they face an audit, buying themselves enough lead time to demonstrate operational compliance. This strategy has two fatal flaws.
You do not know when the audit will happen. Regulatory investigations are not announced in advance of the window they cover. A complaint filed today about an AI decision made eighteen months ago opens a window that already happened — a window in which, if your systems were not instrumented, you have no sealed evidence.
You cannot compress history. If you begin sealing records in October 2027 because the December 2027 deadline is approaching, you have two months of evidence history on the day of your conformity assessment. You cannot deploy faster to catch up. You cannot pay to generate retroactive records. The history that exists is the history you have.
The only reliable strategy is to start now — not because the deadline requires it, but because every AI decision made from this point forward is evidence that either exists or will never exist, and that choice is made exactly once, at the moment the decision occurs.
What "Starting Now" Actually Costs
The argument against early instrumentation is almost always bandwidth: the engineering team is building product, not compliance infrastructure, and there is no immediate audit pressure.
This is a reasonable operational concern with an unreasonable risk calculus.
Integrating a purpose-built AI evidence SDK typically requires a two-line addition to the application code around each AI invocation. For a single AI system, this is typically completed in a day. The evidence begins accumulating from the first hour.
Against that one-time cost, set the alternative: months of forensic reconstruction, incomplete records, and the specific legal and regulatory risk that incomplete AI decision evidence creates — not just during an investigation, but in the civil litigation environment where plaintiffs increasingly have access to AI-specific discovery frameworks.
The asymmetry here is stark. The cost of starting is a day of engineering time. The cost of not starting is a permanent gap in your evidentiary record, known in advance, taken on deliberately.
The Argument, Simply
Sealed AI audit history is irreplaceable by construction. It can only be created at the moment AI decisions occur, by instrumentation that was in place at that moment.
Every week that passes without that instrumentation is a week of AI decision history that will never be recoverable as legally credible evidence — regardless of what logs exist, what governance platforms document, or how much effort a compliance team applies after the fact.
The EU AI Act extension to December 2027 is real. The extra time is genuinely useful. But it does not create any mechanism to recover the AI decision history that is accumulating today, unsealed, for every high-risk AI system running without a tamper-evident event ledger.
The question is not whether to start. It is whether the cost of starting now is smaller than the cost of explaining, in a regulatory or legal proceeding, why you didn't. For almost every organisation, that answer is obvious.
Evidence accumulates from the first hour. It cannot be backdated.
Provara seals every AI decision event — invocations, outputs, eval scores, human overrides — into a cryptographically-chained ledger the moment it occurs. Records are witnessed nightly into 7-year write-once storage. One AI system is typically sealing on the day of integration.
Request a 30-minute technical demo →Related: Tamper-evident AI logs explained · EU AI Act deadline extended to December 2027 · What is an AI audit trail?