Principle #

C

4

Log AI interactions with clear policies for retention and integrity

Ensure that AI vendors undergo risk assessments to meet security, privacy, and compliance requirements.

Vendor questions

1. What are your logging practices for AI interactions? Describe: a. What is logged (e.g., inputs, outputs, system metadata, timestamps) b. How integrity is ensured (e.g., tamper-resistance, immutability) c. Whether logs are complete or selectively captured 2. What is your retention policy for AI interaction logs? Specify default retention periods. If different types of interactions (e.g., training logs, user prompts, tool calls) have different retention timelines, list them separately. 3. Are your logging and retention practices contractually defined? If so, provide the relevant sections or language from your MSA, DPA, or service terms that address log storage, access, or deletion commitments. 4. How do you enforce deletion of AI logs according to retention policies? Indicate whether deletion is automated, what systems enforce it, and whether audits are performed (and how frequently) to verify compliance.

Provide feedback on this principle