The record is the control

Most organisations treat logs as something you keep for later: for the auditor, the incident review, the regulator who might ask. Logging sits at the end of the architecture diagram, after the part that does the work, and it is usually the first thing cut when a deadline slips.

For agents that act on someone else's behalf, that ordering is backwards. An agent that pays, replies, files or orders is exercising delegated authority. Delegation is only safe if the person who delegated can see what was done in their name, notice when it goes wrong and take the authority back. Every one of those depends on a record. The record is not documentation of the control. It is the control.

The law already asks for records

The European Union's AI Act makes record-keeping a design requirement for high-risk systems. Article 12 states that "high-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system", and that logging must capture events relevant to identifying risks or substantial modifications, supporting post-market monitoring and monitoring the system's operation (Article 12).

The obligations on organisations that use these systems are just as concrete. Under Article 26, deployers must take appropriate technical and organisational measures to use a system in line with its instructions, assign human oversight to people with "the necessary competence, training and authority", monitor the system's operation, and keep the logs it generates, to the extent those logs are under their control, for a period "of at least six months, unless provided otherwise in applicable Union or national law" (Article 26).

The dates moved; the duty did not

When these obligations apply has changed. The Commission proposed the Digital Omnibus on AI on 19 November 2025. After a provisional agreement in May 2026, Parliament approved it on 16 June 2026 and the Council adopted it on 29 June. It was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 (European Parliament). Obligations for stand-alone high-risk systems listed in Annex III now apply from 2 December 2027 instead of 2 August 2026, and those for high-risk AI embedded in products covered by Annex I from 2 August 2028. The Article 50 transparency obligations were not deferred and apply from 2 August 2026 (Gibson Dunn).

A delay is not a reprieve on design. A system that will need lifetime logging in December 2027 needs it designed in now, because logging bolted on afterwards misses exactly the events that matter.

Not every agent will be a high-risk system under the Act. Many will not. But the Act's logic, that a system acting in consequential settings must leave a record a person can examine, applies to any agent trusted with money, messages or decisions about people.

Standards say the same thing in different words

Outside the EU, the same expectation appears in voluntary frameworks that buyers and auditors increasingly treat as baselines. The NIST AI Risk Management Framework organises risk work into govern, map, measure and manage, all of which assume evidence of how a system actually behaves. NIST's project on Control Overlays for Securing AI Systems, which adapts SP 800-53 controls to AI, released its concept paper on 14 August 2025 and includes use cases for single-agent and multi-agent systems. ISO/IEC 42001 sets requirements for an AI management system, which, like other ISO management system standards, rests on documented information an auditor can inspect.

In Asia, Singapore's IMDA launched a Model AI Governance Framework for Agentic AI at the World Economic Forum in January 2026 and updated it on 20 May 2026 with case studies and guidance on multi-agent systems, third-party agents and automation bias. It is explicit that humans remain ultimately accountable for what agents do (IMDA).

Accountability without a record is a sentiment. Accountability with one is a process.

Why the record does the safety work

Consider what each safety property of delegation actually requires.

Oversight requires a record. A person cannot oversee an agent by watching it in real time; there is too much and it is too fast. They oversee it by reading what it did, sampled or in full, and comparing it with what it was allowed to do.

Limits require a record. A spending cap or a rule that new suppliers need approval is only enforceable if the system knows what has already been spent and approved. The ledger of past actions is the input to the next decision.

Revocation requires a record. Withdrawing an agent's authority is only useful if you can find everything it did under that authority and decide what to undo.

Correction requires a record. When an agent makes a mistake, the useful question is not what the model was thinking, which nobody can answer reliably, but which inputs it saw, which tools it called, with what arguments, and who approved what. That is a question about events, and only a record answers it.

This is why logging cannot be an afterthought. Each of these properties depends on the record being complete, attributable to a specific agent and a specific grant of authority, kept for long enough, and readable by a person rather than only by another system.

The record has to be one record

There is a practical trap here. An agent working across email, payments, accounting and a storefront leaves traces in each system's own logs, in each system's own format, with no shared identity tying them together. Reconstructing what happened means stitching four audit trails together after the fact, usually during an incident.

The better design is a single record per agent and per run, written as the work happens: what came in, what was said, which actions were taken under which limits, and what a person approved. Conversation and action belong in the same place, because in practice an agent's actions are explained by what it was asked and told.

What this means for policymakers

Logging duties work best when they specify outcomes a person can check: that records are complete, attributable to a responsible party, retained for a defined period and readable by the people with oversight duties. The AI Act's deployer obligations already point this way. Extending the same expectation to agents acting under delegated authority, whatever their risk classification, would make accountability concrete without prescribing technology.

What this means for CTOs

Design the record first. For every agent, decide what events it emits, how each is tied to the identity of the agent and the grant it acted under, where the record lives, how long it is kept and who can read it. Write it at the point of action, not reconstructed from downstream systems. Make it searchable by a person, because the person with oversight duties will not be an engineer.

What this means for executives

When you delegate work to agents, ask one question before any other: if something goes wrong, can we see everything that was done in our name, by which agent, under whose authority? If the answer depends on a vendor exporting logs from several systems, the delegation is not yet safe.

Where Praecise fits

Praecise Inbox gives people and agents mailboxes on a domain the business verified once, with everything said kept in one record a person can open and search. Ipnops connects payments, accounting, commerce and mail and acts across them with permission, never ownership; every run stays within limits the owner sets and leaves a record.