Your AI Audit Log Proves Nothing About Where the Answer Came From

Two different logs, and teams keep shipping the first while believing it's the second. The first records that at 14:02:11 UTC, decision d_8f21 ran through model v2.3.1, took this input, produced this output, and a human approved it. Complete, timestamped, retained for six months. It satisfies most audit-trail checklists. The second proves the answer came from paragraph 4 of manual_A2131.pdf, retrieved at rank 2 with a score of 0.81, and that the sentence in the response is supported by that span. That's a different artifact entirely, and it's the one a regulator asks for when the question stops being "what did the system do" and becomes "was any of it true." Your log can be flawless and sit on top of a model built from a dataset nobody can trace. The log answers what happened, not whether it was trustworthy to begin with. Why this is now a delivery constraint EU AI Act Article 50 and the Annex III high-risk obligations apply from August 2, 2026, with full rollout by August 2, 2027. Article 19 wants six-month log retention. Article 99 puts the penalty at EUR 15 million or 3% of global turnover. FDA and EMA published joint AI guidance in January 2026. US banking supervisors are already asking about AI touchpoints in lending, KYC, and sanctions screening, without waiting for a finished rulebook. Meanwhile the supply chain underneath is worse than most teams assume. A June 2026 analysis of 908,449 Hugging Face models found 55.46% carrying compliance risks or missing metadata, a 56.67% license omission rate in adapter derivations, and 8.05% license drift in fine-tuned models. A separate audit of 29,000 dataset descriptions found complete provenance chains to be rare. So the model you pulled last sprint may have terms you can't reconstruct, and the fix is not more logging. Four things that have to be true Source-linked. Every answer names the document, dataset row, or record it drew from. Path-logged. The retrieval and reasoning steps are captured, not just the final outp