{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"technical","domain":"AI Governance","type":"detective"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-08","description":"Ensure AI systems automatically record event logs that enable traceability of operation over the system's lifetime, including events relevant to identifying risk situations and substantial modification. Retain logs for at least the mandated regulatory minimum, or longer where required. Monitor deployed systems against defined performance and behavior metrics with alerting and escalation for anomalies and drift, and retain logs and monitoring reviews as evidence.","details":{"control_category":"technical","control_type":"detective","domain":"AI Governance","guidance":[{"propositionId":"NIST-AGI-05","propositionTitle":"Verifiable agent action logs and authorization traceability","source":"nist-ai-agent-identity","sourcePages":"Concept paper pp. 4, 6: Auditing and non-repudiation; Logging and Transparency","sourceTitle":"NIST NCCoE: Software and AI Agent Identity and Authorization"},{"propositionId":"NIST-TEVV-02","propositionTitle":"Run evaluations and examine results and limitations","source":"nist-ai-tevv-athlon","sourcePages":"NIST AI 200-2 ipd sections 2.3-2.4, pp. 6-7","sourceTitle":"NIST AI 200-2: TEVV-Athlon Framework for Evaluating AI Systems"}],"members":[{"control_id":"A.6.2.6","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"A.6.2.8","coverage":"full","framework":"iso-42001","relationship":"superset_of"},{"control_id":"AIA-Art12","coverage":"full","framework":"eu-ai-act","relationship":"superset_of"},{"control_id":"C008","coverage":"partial","delta":"monitoring keyed to the AI risk taxonomy categories with per-category alert thresholds and response actions","framework":"aiuc-1","relationship":"intersects_with"},{"control_id":"E015","coverage":"full","framework":"aiuc-1","relationship":"superset_of"},{"control_id":"AIA-Art19","coverage":"full","framework":"eu-ai-act","relationship":"superset_of"},{"control_id":"AIA-Art72","coverage":"partial","delta":"a documented post-market monitoring plan, proportionate to the system's risk, that actively collects and analyses lifetime performance data including interaction with other AI systems","framework":"eu-ai-act","relationship":"intersects_with"}],"statement":"Ensure AI systems automatically record event logs that enable traceability of operation over the system's lifetime, including events relevant to identifying risk situations and substantial modification. Retain logs for at least the mandated regulatory minimum, or longer where required. Monitor deployed systems against defined performance and behavior metrics with alerting and escalation for anomalies and drift, and retain logs and monitoring reviews as evidence.","title":"Log and monitor AI system behavior in operation","unified_id":"UC-AI-08"},"id":"uc:UC-AI-08","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-AI-08","sourceIds":["aiuc-1","eu-ai-act","iso-42001","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"UC-AI-08 — Log and monitor AI system behavior in operation","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:03072faf2365b29c63c8669df10cf625bc696638b7b07538582b4f6354d3d0e0","properties":{"control_id":"A.6.2.8","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-6-2-8-209d5e42.json","targetId":"ctrl:iso-42001:A.6.2.8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0ffa2def5c469c649f11402c81e8ed1599c552790a44f28df6589a3bc9e41a5a","properties":{"rationale":"Lifetime event logs provide the traceability/audit trail underpinning accountability for AI operation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1860d921216e697b2a7b30fde80a4165c79e533acda67a80119ec7688e944d78","properties":{},"sourceDetailPath":"/data/v1/records/wf-d59-b3ddf606.json","sourceId":"wf:D59","targetDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","targetId":"uc:UC-AI-08","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1b1ee959cc26f4a87a9386efa482ae23a1501dc8f85d4ce4a62122317e320641","properties":{"control_id":"AIA-Art72","coverage":"partial","delta":"a documented post-market monitoring plan, proportionate to the system's risk, that actively collects and analyses lifetime performance data including interaction with other AI systems","framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art72-2866ca15.json","targetId":"ctrl:eu-ai-act:AIA-Art72","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:299bffe8d04b68017b3b1eaa8b396600b899f72a36e67dd257be0d8d5e01044f","properties":{},"sourceDetailPath":"/data/v1/records/wf-g1-14bc355c.json","sourceId":"wf:G1","targetDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","targetId":"uc:UC-AI-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:33bf89fb2a59caae998679267dfb94f8446e1add332b2f02a3624df3c7de8793","properties":{"rationale":"Performance monitoring detects post-deployment accuracy degradation so wrong outputs are caught in operation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-inaccurate-unreliable-output-cf10c86e.json","targetId":"risk:ai-inaccurate-unreliable-output","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c7023427aa78e1dd93518e3c17913be0aee17311142a471730fa452498746f1","properties":{"rationale":"Continuous monitoring against performance/behavior metrics with drift and anomaly alerting is the post-deployment detection the risk says is missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-model-drift-monitoring-15329f38.json","targetId":"risk:ai-model-drift-monitoring","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:50c89abd5576d62eb7ecfb91abd4aa48f8cb1a90c5e1d4d3373adf012b1dc227","properties":{"control_id":"A.6.2.6","coverage":"full","delta":null,"framework":"iso-42001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2023"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-iso-42001-a-6-2-6-efbed6b5.json","targetId":"ctrl:iso-42001:A.6.2.6","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:711a1e90cc08e74c4fa39e7c5ba0baed9abb795e999c10d2a47d3e0db122c51f","properties":{"control_id":"AIA-Art12","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art12-3714b8af.json","targetId":"ctrl:eu-ai-act:AIA-Art12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:86c062512addea8a4624ceb2229386143903b633c2e84a1742f2f39a86273909","properties":{"rationale":"Automatic event logging and traceability is the mandated logging control supporting law-enforcement-AI accuracy and oversight requirements.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-highrisk-law-enforcement-7d4537e1.json","targetId":"risk:ai-highrisk-law-enforcement","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:97e0a0b88041de7847c41dfffdc51234db0b1c4d6bdebd7d1ed46f128f8c2cbc","properties":{"rationale":"Anomaly alerting and escalation trigger failure response before dependent business processes break.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-model-resilience-fallback-gap-85070995.json","targetId":"risk:ai-model-resilience-fallback-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9faee45843579a9a938b92cd52105132ce6d1023816230b47999c4ae7f96fff5","properties":{"rationale":"Behavior monitoring with alerting detects unsafe operation for escalation, reducing harm impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-safety-harm-to-people-d02cb500.json","targetId":"risk:ai-safety-harm-to-people","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ab7f64af90f33aad12a67c5ab3f53eea3d13f240ccb483df72f07345b0e34d69","properties":{},"sourceDetailPath":"/data/v1/records/wf-c65-09b9172f.json","sourceId":"wf:C65","targetDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","targetId":"uc:UC-AI-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:be23d6f70909ef247f2b41a7228091aee2d8038102834f50b72262599ebdc888","properties":{"control_id":"NIST-AGI-05","coverage":"guidance","delta":null,"framework":"nist-ai-agent-identity","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"Concept paper pp. 4, 6: Auditing and non-repudiation; Logging and Transparency","source_version":"February 2026 draft concept paper"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-nist-ai-agent-identity-nist-agi-05-1adf3e6a.json","targetId":"ctrl:nist-ai-agent-identity:NIST-AGI-05","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf6186db7aa9faa17cdc6db5ca220a4ec52da9e6b1c6ddcff44dbba3b62d91a1","properties":{"control_id":"NIST-TEVV-02","coverage":"guidance","delta":null,"framework":"nist-ai-tevv-athlon","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"informs","sourcePages":"NIST AI 200-2 ipd sections 2.3-2.4, pp. 6-7","source_version":"NIST AI 200-2 ipd (Initial Public Draft), August 2026"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-nist-ai-tevv-athlon-nist-tevv-02-41057f6e.json","targetId":"ctrl:nist-ai-tevv-athlon:NIST-TEVV-02","type":"informed_by"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c004356ed83fe24ae6123dec85b7ce5b0a8df574641f5cf6abb86bf0567cdd12","properties":{"control_id":"E015","coverage":"full","delta":null,"framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-e015-94a0c8ea.json","targetId":"ctrl:aiuc-1:E015","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f26464c19c5287e54a6d2bf630191ccc3b3196567844c1979896c115397f8603","properties":{"control_id":"C008","coverage":"partial","delta":"monitoring keyed to the AI risk taxonomy categories with per-category alert thresholds and response actions","framework":"aiuc-1","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"July 15, 2026 release (quarterly update cadence)"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-aiuc-1-c008-94bd64f2.json","targetId":"ctrl:aiuc-1:C008","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fb1c8dd28ee831d63f9bbf5d171a0a088378fd7d5d6fc7e7be7195d57e5b27f1","properties":{"control_id":"AIA-Art19","coverage":"full","delta":null,"framework":"eu-ai-act","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Regulation (EU) 2024/1689"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/ctrl-eu-ai-act-aia-art19-55451bfa.json","targetId":"ctrl:eu-ai-act:AIA-Art19","type":"maps_to"}],"schemaVersion":1}