An agent without a log can't be audited

When an agentic system works, nobody asks how it decided. The trouble starts the day something goes wrong and you need to reconstruct what the agent did, with what information, and who authorized it. If the system didn’t record it, there’s no answer.

The law already requires it

The EU Artificial Intelligence Act turned three things that used to be optional into obligations for high-risk systems:

• Automatic event logging (Article 12): the system has to keep a record of what it does.
• Human oversight (Article 14): a person must be able to monitor, intervene and shut it down.
• Record retention (Article 19): the log doesn’t get deleted when it’s inconvenient.

The Act’s recitals explicitly address chains of systems: if an agent performs a high-risk function inside a chain, the obligation reaches that agent too (official text on EUR-Lex).

Canada has no federal AI law, but Quebec’s Law 25 already requires notifying people when a decision about them was made through an automated process. Mexico has no equivalent yet — which doesn’t change what a regulated customer or an auditor will ask.

The technical standard is locking in

There’s now a common language for logging what an agent does: OpenTelemetry’s semantic conventions for generative AI, which standardize how each model operation is recorded — which model was called, tokens in and out, and, with consent, the messages and tool calls (OpenTelemetry). A system that logs in that shape can be audited with anyone’s tooling, not just the vendor’s.

The approval pause is the compliance mechanism

Durable execution engines — which turn an agent’s task into a workflow that can pause and resume — solve more than technical stability. That pause, where the agent prepares, waits and a human approves, is exactly what human oversight requires. It’s not a product feature. It’s how you comply.

What an agentic system needs by design

1. A log of every action, including who authorized it and with what information.
2. Human sign-off on anything that commits the company: payments, contracts, sensitive messages.
3. A kill switch: the ability to stop one agent, or all of them, in seconds.
4. Scoped permissions: the agent only reaches what its role needs.
5. Logs in a standard format, so an outside auditor can read them.

The bottom line

Building an agentic system without these pieces means building something that works until the day you have to explain it. Designing them in from the start is cheap. Bolting them on after an incident isn’t.

Want to see how auditable your operation is today? Talk to Luz.