Could You Justify One AI Decision From Six Months Ago?

When a regulator, an auditor, or a board member asks why an AI system approved, denied, or flagged something, most organisations discover a hard truth. They have dashboards. They have reports. They do not have proof of the one decision anyone is actually asking about. 

The AI Act closes that gap. It requires you to reconstruct the basis of a specific AI decision: what data went into the system, what result came out, which model version ran, who supervised the process, and which control the decision was tied to. A report cannot answer that. A report shows scale, trend, and process status. Traceability answers the question a report never touches: why did this happen? It shows accountability, compliance, and proof for one concrete decision. 

In the Controlled Autonomy model, we call this layer the Evidence Trail. It is a decision trail connected to a process, an owner, a risk policy, and records inside ServiceNow. We treat it as a central control mechanism because it brings data, authorisation, human oversight, and proof of execution into one place. Traceability, in this model, goes beyond a technical log. It becomes a layer of accountability: what the system did, why the decision could have been made, who owned its boundaries, and where the proof of control sits. 

Treat every decision as an evidence object 

A technical log is too narrow for what the AI Act asks. It shows an event, not a decision. A decision needs wider context: input data, output, model version, guardrails applied, human involvement, and its link to a control. 

That is why a decision needs its own record. We call this record the Decision Object. In ServiceNow, we build it as an entry linked to the AI Asset in the AI Control Tower and to controls in IRM. A Decision Object pulls scattered information into one evidence object: input data, output, model ID and version, timestamp, transaction ID, a guardrail summary, human intervention, and the link to a risk policy and control. 

From here, traceability works as evidence management. You open one Decision Object and see the full lineage of a decision: what fed into the system, what it returned, who supervised it, which guardrails fired, and which control the decision connects to. The result is an AI decision that is auditable as part of the process, with a basis, a scope of authorisation, an owner, an oversight trail, and a defined place in the control model. 

Read another article: One AI. Different Rules.

Connect scattered evidence into one decision history 

The problem starts when evidence lives in different places. A log shows a technical event. A ticket shows how the case unfolded. A document describes the policy. An approval sits in a workflow. Monitoring creates its own separate record. Each piece shows only part of the story, and the basis for a decision only emerges once these fragments connect. 

In this model, the AI Asset, or Digital AI Passport, answers whether the system had the right to act within a given scope. The Decision Object answers what happened in one specific decision. The Evidence Trail works a level above both: it ties these records to the process, the risk policy, the controls, and the history of change. 

Where an earlier piece in this series, on Ghost Workers, was about algorithms without an owner, this is about decisions without a record. Both problems share the same shape: a missing place in the architecture. In ServiceNow, we design the Evidence Trail as a control layer over existing records, workflows, logs, and GRC or IRM mechanisms. The goal is to reconstruct a specific decision without manually pulling information from a dozen systems. 

Make human oversight part of the record, not just the policy

The AI Act also asks about human oversight. The Human-in-the-Loop principle answers that at the level of accountability. The Evidence Trail extends it to the level of evidence. What matters is concrete: who had the right to intervene, when they actually did, whether they approved a recommendation or overrode it, and why.

In the Evidence Trail, human oversight becomes part of a decision’s history. Every intervention, approval, or override is linked to a specific decision, a specific user, and a specific stage of the process. This matters most for high-risk systems, where human oversight needs to be visible as an operational mechanism: assigned, executed, recorded, and reconstructable. In practice, you can show exactly where a person stood in the process, what role they held, when they acted, and what effect that had on the AI decision.

Size the trail to the risk, not to convenience

Traceability should be proportional to risk. In the Controlled Autonomy model, decision class does that job: a classification of decisions by their impact on people, on the organisation, and on compliance. Decision class sets the depth of the trail, the length of retention, and the strength of the link to controls.

A high-class decision needs the full history: a Decision Object with data context, model version, guardrails, a human oversight trail, monitoring, and a link to IRM. A low-class decision needs a lighter trail: a usage record, an owner, a status, and retention matched to the process.

Read another article: Which AI Are You Already Using?

Insurance claim decisions show why this matters. In cases covered by media and contested in court, claimants have challenged the use of algorithms in claim denials and demanded documentation showing whether AI replaced a physician’s judgement. In that kind of scenario, an AI policy document or a general report is not enough. You need the trail of the specific decision: the model, the version, the input data, the reviewer, the guardrails, the medical basis, and the linked control.

A single Decision Object lets you reconstruct one decision. The Evidence Trail earns its value at scale, across many cases. Aggregated records reveal patterns: where decisions start to drift, which guardrails trigger most often, and which decision classes need stronger oversight. This flips the classic view of traceability. A decision trail defends one case and feeds the improvement of the model, the policy, and the controls at the same time. The greater a decision’s impact, the deeper its trail, the longer its retention, and the stronger its link to controls and to the improvement process.

Build audit readiness into daily work, not into a fire drill

Being audit-ready is a byproduct of how work gets done, not a project you run before an audit. A decision gets recorded, its context lands in the record, a control gets linked, a human intervention leaves a trace, and the status can be reconstructed without chasing information across systems. In this model, an audit starts with opening a decision’s history.

ServiceNow becomes the execution layer where the Evidence Trail supports the AI Act, accountability, and day-to-day risk management. A License to Act is a systemic declaration. The Decision Object and the Evidence Trail are its operational proof, one decision at a time.

Traceability is the moment an AI decision stops being a technical event. It becomes a decision with a history, a basis, and an owner of its own consequences.