How to meet it
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Request & Response Logging
Use a structured log format
Verify that log entries for AI inference events follow a structured, interoperable schema that includes at least the model identifier, token usage (input and output), provider name, and operation type.
OWASP AISVS v1.01, requirement 12.1.3
In plain English
Use one structured format for logging model calls, including at least the model, input and output token counts, provider and type of operation.
What good looks like
- All teams use the same schema.
- Required fields are always present.
- The schema is documented.
How teams usually do it
- The OpenTelemetry semantic conventions for generative AI, or your own schema based on them.
Evidence an auditor would accept
- The schema and sample entries.
Common mistakes
- Free-text log lines that cannot be queried.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.