United States (federal) · federal standard
NIST 800-53 · AU: what it requires, and the records to keep
The AU family has 16 controls (AU-1 to AU-16, AU-15 withdrawn) covering which events a system logs, what each record contains, how logs are reviewed, protected, retained and made non-repudiable. For AI systems inside a federal boundary it is the baseline for logging model use, administrative actions and outputs so incidents can be investigated later.
01 / What it requires
What NIST 800-53 · AU requires
Federal agencies and the contractors and cloud providers that operate federal information systems under FISMA, FedRAMP or contract terms.
- 01Select the event types the system logs, with a rationale that they support after-the-fact incident investigation (AU-2).
- 02Make each audit record show what happened, when, where, the source, the outcome and the identities involved (AU-3).
- 03Review and analyze audit records for unusual activity and report findings to designated officials (AU-6).
- 04Protect audit information and logging tools from unauthorized access, modification and deletion (AU-9).
- 05Retain audit records for a defined period to support investigations and retention rules (AU-11).
- 06Generate audit records for selected events on defined components; use non-repudiation where required (AU-12, AU-10).
02 / AI work
Where it touches AI work
Applies to AI systems as to any system. Agencies decide which AI events to log (prompts, outputs, model version changes, administrative actions); NIST's planned AI overlays will tailor these controls but are not yet published.
03 / Dates
The dates that matter
SP 800-53 Rev. 5 published
Rev. 5 Update 1 published
NIST concept paper on 800-53 control overlays for AI systems
Release 5.2.0 published (software update controls)
Annotated outline for predictive AI overlay released
AI overlay project renamed Control Overlays for Super Intelligence Systems
04 / Enforcement
Who enforces it
Agency authorizing officials, inspectors general and OMB under FISMA; FedRAMP for cloud services. No fines; failed controls affect authorization to operate and contracts.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Audit and accountability policy and procedures (AU-1)
- 02Documented list of logged event types with rationale
- 03Log review reports and escalation records
- 04Log integrity protections and retention schedule configuration
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Which NIST 800-53 controls cover AI audit logging?+
The Audit and Accountability (AU) family in SP 800-53 Rev. 5 covers logging for AI systems as for any other system; it has no AI-specific controls. The main ones are AU-2 Event Logging, AU-3 Content of Audit Records, AU-6 Audit Record Review, Analysis, and Reporting, AU-9 Protection of Audit Information, AU-10 Non-repudiation, AU-11 Audit Record Retention and AU-12 Audit Record Generation. The CA family covers assessment and continuous monitoring. NIST's AI control overlays, renamed Control Overlays for Super Intelligence Systems on October 20, 2026, have no public draft yet. Read the full answer
SOURCES
Go back to the source
NIST Computer Security Resource Center
NIST (usnistgov/oscal-content)
NIST Computer Security Resource Center
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: NIST 800-53 · AU for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4