How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · Explainability & Traceability of Code Suggestions
Store AI records in tamper-evident storage
Verify that explainability reports, AI-event logs, and citation records are kept in tamper-evident storage (append-only, WORM, or an immutable log store) and are referenced during security reviews.
OWASP AISVS v1.01, requirement AC.5.3
In plain English
Keep AI event logs, explanation reports and citation records in tamper-evident storage, and use them in security reviews.
What good looks like
- Records are stored append-only or write-once.
- Security reviews refer to them.
- Retention is defined.
How teams usually do it
- Object storage with retention locks or an immutable log service.
Evidence an auditor would accept
- Storage settings and a review that used the records.
Common mistakes
- Logs on a server the AI tooling can also write to.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.