How can you tell whether an audit trail has been altered?

Laws on data keep asking for logs, the records of what happened in a system and when. In Europe, for example, the AI Act says that high-risk AI systems “shall technically allow for the automatic recording of events (logs) over the lifetime of the system”, and that those who use them keep those logs for “at least six months”. The European Health Data Space asks electronic health record systems to carry a “European logging software component”, which records who opened a patient’s data. Behind them stands an older rule of the GDPR: whoever handles personal data must “be able to demonstrate compliance”.

These laws say what must be logged. They do not say how to prove that a log has not been touched. That is left to the people who build the software, and in our view it is what an auditor cares about most.

A permission is not a proof

In most systems, a log is protected by permissions. Ordinary users can read it; only administrators can change or delete it. That is sensible, and it holds as long as the question never concerns the administrators. The day it does, the log proves only what they chose to leave in it.

We think a log should prove on its own that it is intact. Not because administrators are dishonest, but because an inspector, a judge or a supervisor should not have to take anyone’s word for it, including ours.

A fingerprint for every line

The tool for this is old and well understood. A hash function turns any text into a short code, a kind of fingerprint. The same text always gives the same fingerprint. Change a single letter and the fingerprint changes completely. In 1991, two researchers, Stuart Haber and W. Scott Stornetta, used chains of such fingerprints so that no one could change the date of a digital document after the fact, “even with the collusion of a time-stamping service”.

Applied to a log, the idea is simple. Each new line is written together with the fingerprint of the line before it. If someone edits line 3, its fingerprint changes, but line 4 still carries the old one: the chain breaks between the two, exactly where the change was made. If someone deletes line 4, line 5 points to a line that no longer exists. No one has to be taken at their word: anyone can recompute the fingerprints and see for themselves.

Figure 1

Change a line

Interactive

Audit trail

All six lines are as written

1. 0109:12File receivedIntact
2. 0209:14File checkedIntact
3. 0309:26Export approved by the supervisorIntact
4. 0409:31Case openedIntact
5. 0509:40Document added to the caseIntact
6. 0609:47Case closedIntact

Try itChange a line in secret and watch the check.

Change a line

Each line is tied to the one before it. The check finds all six as they were written.

The limit, said plainly

A chain has one weakness, and we would rather tell you than let you find it. Someone with full control of the system could change a line and then recompute every fingerprint after it. The chain would look whole again.

The answer is to keep a copy of the most recent line’s fingerprint somewhere else as well. Since every line carries the one before it, that single short code depends on every line written so far. It seals the whole log as it stands that day. Keep it in a report sent to the auditor, in another system, or on paper in a safe. If anyone later rewrites the past, the chain will no longer lead to the fingerprint you kept.

What Datasight logs

Datasight logs everything that happens on the platform, in a chain of this kind. Every line holds the fingerprint of the line before it, so a change to any earlier line shows up at the place it was made.

This matters most where people decide. The platform lays out the facts; a person makes the decision. When that decision is questioned months later, the log shows what happened, and that nothing has been touched since.

How to check it

1. Choose a period, any period, and ask for its log and for the check to be run in front of you.
2. Change one line in a copy of that log and run the check again. It must stop at that line, and nowhere else.
3. Ask how the latest state of the log can be kept outside the platform, so that the next audit can be compared with it.

Next on the record · #6What happens to a record between arrival and export?

Sources

1. Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act): Article 12(1) and Article 26(6). EUR-Lex
2. Regulation (EU) 2025/327 of 11 February 2025 on the European Health Data Space: Article 2(2), point (o), and Article 25. EUR-Lex
3. Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation): Article 5(2). EUR-Lex
4. Stuart Haber and W. Scott Stornetta, “How to time-stamp a digital document”, Journal of Cryptology, 3(2), 1991, pp. 99-111. DOI 10.1007/BF00196791