Skip to main content
Every compliance-relevant action in guardbook is logged automatically. You do not switch it on and you cannot turn it off. Open Audit Trail from the left-hand navigation. Events are listed newest first, 50 to a page. Each shows what happened, who did it and the date and time. Actions guardbook takes on its own show as “System”.

​
What gets logged

Sign-ins, failed two-step codes, onboarding completion, tools added and changed, risks added, changed and removed, quarterly risk register reviews, appropriateness assessments and supplier due diligence signed, policies generated and adopted, materiality determinations signed, Oversight Log entries added, changed and deleted, training records, dip samples, data safeguards checks, people and login changes, evidence packs exported, and more. A failed password sign-in is not tied to a firm, so it does not appear on your firm’s audit trail. Events are colour-coded: green for key sign-offs such as policy adoption and signed assessments, amber for anything risk-related or needing attention, and a neutral colour for everything else.

​
Why it matters

Clause 3.3 requires your risk register to be reviewed and updated at least quarterly. Clause 4.4 requires you to provide written information on request about each AI system, including the due diligence done and the decisions made about the reliability of its output. The audit trail shows when each of those things happened. It is what turns “we do this” into “here is when we did it”. It is also the quiet answer to the most awkward question in a review: not what your records say, but when they were created. A register whose every entry was logged in one burst the week before an assessment tells a different story from one built up over months.

​
How far it can be trusted

Be precise about this, especially with an insurer or an assessor.The audit trail is append-only and tamper-resistant. Nobody at your firm can add, edit or delete an event directly. guardbook writes each event when the action happens, and the database itself blocks any change or deletion, including by guardbook’s own app.It is not yet tamper-evident: there is no cryptographic chain linking one event to the next, so the trail itself cannot prove that nobody with direct database access changed it.Each evidence pack you export is fingerprinted (SHA-256) and the fingerprint is logged, so a changed copy of a pack can be spotted. That makes exported packs tamper-evident, not tamper-proof: the fingerprint shows that a copy has changed, but it cannot stop the change.
The honest formulation, and the one to use: every compliance-relevant action is logged automatically. The log is append-only, and no one can edit or delete it.

​
What the page does not do yet

  • No filtering or search. Paging is the only navigation.
  • No export. The evidence pack includes a summary of the audit trail: how many governance events, the period covered, a count by type and the 10 most recent. It does not list every event and leaves out sign-ins. To show someone the full log, show them the Audit Trail page.