When a decision is challenged, the first question is usually simple: how did you arrive at this? For a decision made by people from documents, organisations have long answered that with files, emails, minutes and signatures. For a decision shaped by an AI interaction, many organisations find they cannot answer at all. The prompt is gone. The output was copied into a document and edited. Nobody recorded which version of which tool was used, what information it was given, or what the person checked before relying on it.
That gap matters whenever the AI's contribution was material: when it produced the figure, the summary, the recommendation or the research on which the decision stood. In those cases the prompt, the context the tool was given, its output and the checks that followed are part of the decision record, as much as the final letter or the signed approval.
This series is general information about governing AI in organisations, not legal advice. Where it describes court judgments or legislation, it summarises them for a non-legal audience; read the primary sources and take advice from a qualified legal practitioner before relying on any interpretation for your organisation.
Spekboom Finance is fictional, and its processes and figures are illustrative. Spekboom, the South African consumer lender we follow through this series, decided in Part 2 that its payment reconciliation tool may calculate and draft, but never decide, and that any reconciliation used in court papers is re-performed by a person who signs for it. That raised the next question from its Head of Legal: if a customer, the Information Regulator or a court asked how a particular arrears figure was produced, what could Spekboom actually show them?
The test: could we reconstruct it?
The standard we recommend is practical rather than legal: if an AI interaction materially influenced a consequential decision, the organisation should be able to reconstruct it. Not approximately, and not by asking the tool again, but from records made at the time.
Spekboom tested itself against that standard with one real case: a vehicle finance customer who had disputed arrears three months earlier. The collections agent had used the reconciliation tool, explained the result to the customer, and opened a collections step. Reconstructing it, the team found the final arrears figure in the collections system and the agent's call notes. They did not find the list of payments the tool had been given, the tool's original output, or any record of which bank statements the agent had looked at. The figure was probably right. Spekboom could not show that it was.
The AI decision evidence pack
A useful evidence record has twelve parts. Not every AI interaction needs all of them, but every consequential one should be able to produce them.
- Business purpose and authorised task. What the tool was being used for, and which authority matrix entry permits it.
- Date, tool, provider, model and version, where available. Many products do not expose the model version; record what you can, including the product's own release or configuration identifier.
- System instructions, prompt and material configuration. What the tool was told to do, in its own words, and any settings that shaped the output.
- Information supplied to the system. The documents, figures or records the person gave it.
- Retrieved sources and tool results. Anything the tool looked up or calculated along the way.
- The original output, exactly as produced, before any human editing.
- Independent checks performed. What the reviewer compared the output against, as described in Part 1.
- Corrections and human changes. What the reviewer changed and why.
- The final decision and the accountable decision-maker.
- Known limitations, failures and unavailable evidence. If something could not be checked, say so.
- Data classification, access and retention treatment. What kind of information the pack contains and who may see it.
- Disclosure and challenge route. Whether the affected person was told AI assisted, and how they can challenge the outcome (Part 5 covers this).
The middle of the list carries the point. Items 6, 7 and 8 together show the difference between what the machine produced, what a person verified and what the organisation finally relied on. Without the original output, nobody can tell whether the reviewer changed anything. Without the record of checks, nobody can tell whether they looked.
Evidence is not the same as publication
The objection Spekboom heard first was about confidentiality. Its reconciliations contain customer account details. Its hardship applications contain information about people's health, employment and family circumstances. Its legal research sits close to privileged advice. Surely recording all of it creates more risk, not less?
It creates a different risk, which has to be managed. Preserving evidence does not mean making it public. Court, medical, employment and financial records may need sealing, redaction, strict access controls or a protected audit store. The requirement is to keep sufficient authoritative evidence under an appropriate access model, not to put every prompt in a shared folder.
In practice that means:
- A protected store, separate from day-to-day working systems, with access limited to the roles that need it: legal, risk, compliance and the reviewer of a challenge.
- Retention aligned to the decision, not to the tool. If the decision record must be kept for five years, so must its evidence pack. If it can be deleted after a year, so can the pack.
- Legal hold capability, so that evidence relevant to a dispute is not deleted on schedule while the dispute is live.
- Minimisation where it preserves the task. If the tool did not need a customer's ID number to reconcile payments, it should not have been given it, and the pack should not contain it.
- Access logging on the store itself, so that the evidence of a decision does not become an unmonitored copy of personal information.
POPIA's conditions apply to the evidence store as much as to the original processing. Personal information kept as evidence still needs a lawful purpose, security safeguards and a retention period. That is a design task, not a reason to keep nothing.
Reproducibility has limits
The other common objection runs the opposite way: "we do not need to keep the prompt, because we can always run it again." With generative AI that is not true.
Generative systems can produce different outputs for the same input. Between March and June, the provider may update the model or its safety layers. The documents a retrieval step finds may have changed. And even with nothing changed, many systems vary their output between runs by design. Asking the same question in June and getting an answer tells you what the system says in June. It does not tell you what it said in March, when the decision was made.
So reproducibility means preserving the actual interaction and configuration, not assuming the organisation can ask again and get the same answer. If someone wants to know whether the March output was reasonable, they compare it against the preserved record and the evidence it was based on.
This also changes how to think about AI "audit trails" offered by vendors. A log that records that a user ran a query at a certain time is useful. A log that also keeps the input, the output and the configuration is evidence. Ask which one you are buying.
What Spekboom now keeps
Spekboom did not apply the full pack to every AI use. It applied it where the AI's contribution was material to a consequential decision, which in practice meant two uses.
Payment reconciliations that lead to any collections step or court document. The pack holds the claimed payments as supplied, the ledger extract, the tool's original reconciliation, the bank statements the agent or reviewer checked, any corrections, the decision and who made it. It is stored in a protected evidence store with legal-hold capability, retained for as long as the account's collections record.
Hardship application decisions. The pack holds the application, the information the triage tool used, its recommendation and the reasons it gave, the team leader's review and any changes, and the final arrangement. Because these packs contain special personal information, such as health details some customers disclose, access is limited to the hardship team leaders, the Head of Collections and the Information Officer.
Call summaries and the general staff assistant were deliberately left out. They do not decide anything about a person on their own, and keeping every interaction would have created a large store of personal information with no purpose. That decision is written down too, with the reasoning, so it can be revisited.
Repeating the reconstruction test a month later on a fresh case, the team could show every step from the customer's dispute to the collections decision in about ten minutes.
Common mistakes
- Keeping only the final document. The edited result hides what the tool produced and what the reviewer changed.
- Relying on re-running the prompt. Models, retrieval and sampling change; the March answer cannot be recovered in June.
- Keeping everything, everywhere. An unprotected log of every prompt is a new privacy exposure, not an evidence system.
- Keeping nothing because of confidentiality. Sensitive evidence belongs in a protected store, not in no store.
- Accepting a usage log as an audit trail. Knowing that a query happened is not knowing what was asked and answered.
- Separating evidence retention from decision retention. The evidence pack should live as long as the decision it supports.
Questions to ask this week
- Which of our AI uses materially shape decisions about people, money or legal positions?
- For one recent decision of that kind, could we reconstruct the input, the original output and the checks?
- Do our AI tools keep the original output before people edit it?
- Where would an evidence pack be stored, who could access it, and for how long?
- Can we place AI evidence under legal hold when a dispute starts?
- What do our vendors' "audit logs" actually record?
What to take from this part
If AI materially shaped a decision, the interaction is part of the record. Prompt, context, output and checks belong with the decision.
Twelve items make a decision reconstructable. The original output, the independent checks and the human changes carry the most weight.
Evidence is not publication. Keep it in a protected store, with access control, retention and legal hold.
Re-asking is not reproduction. Preserve what actually happened at the time.
Next in the series: Confidentiality before convenience: what may enter which AI service.
How CloudNala can help
We help organisations decide which AI uses need an evidence record, design the evidence pack and the protected store that holds it, connect AI tools so that inputs, original outputs and review steps are captured automatically, and align retention and legal hold with the decision records they support. We work alongside your legal and privacy advisers on what must be kept and for how long.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book an AI Readiness Workshop or write to us at consult@cloudnala.co.za