The audit trail: every change, hash-chained and anchored daily

Audit trail (under Prove it) is the register of every action the platform recorded in your workspace: classifications run, obligations moved, evidence filed, steps approved, members invited, settings changed — each with the actor, the time, and the record it touched. It evidences your governance decisions for an auditor and feeds the Art. 72 monitoring story; it is not the AI system's own Art. 12 logs, which stay with the system, and it is the same feed a system's Activity tab shows for one system.

Why it is more than a log

Each day's lines are chained by hash and an anchor is written for the day. Change a line afterwards and the chain no longer verifies. That is what lets a regulator or an auditor trust the trail rather than take your word for it — and it is the same property the Evidence hub's fingerprints and the sealed dossier rely on.

Reading it

Each line shows when, who, the action, the IP address and the details. Filter by action or user, and search by action, user, IP or record. Completed reviews leave a dossier entry here too, so the periodic reviews the Act expects have a footprint you can point at.

Verifying it

The integrity banner at the top of the page re-derives the chain on demand and reports how many days of history are anchored and verified, or warns that an anchored day no longer matches its recorded hash. It appears once anchors exist — a workspace created before anchoring began grows into it. Export CSV on the same page hands the trail to an auditor; the machine API exposes it with cursor paging for a SIEM, and outbound webhooks carry the events that matter as they happen (see Webhooks: react to compliance events in real time).

What it is not

It is not a place to edit anything. Nothing in the trail can be changed or deleted from the app; retention is governed by the Art. 18 floors and reported, never automated.