Planisphere Download for Mac

Law · NIST 800-53 · AU

NIST 800-53 · AU for legal AI workflows

NIST 800-53 · AU in legal AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding on federal agencies; on contractors through FedRAMP and contracts
Applies from23 Sep 2020
SectorLaw
Checked21 Oct 2026

01 / The rule

What NIST 800-53 · AU requires

Federal agencies and the contractors and cloud providers that operate federal information systems under FISMA, FedRAMP or contract terms.

  1. 01Select the event types the system logs, with a rationale that they support after-the-fact incident investigation (AU-2).
  2. 02Make each audit record show what happened, when, where, the source, the outcome and the identities involved (AU-3).
  3. 03Review and analyze audit records for unusual activity and report findings to designated officials (AU-6).
  4. 04Protect audit information and logging tools from unauthorized access, modification and deletion (AU-9).
  5. 05Retain audit records for a defined period to support investigations and retention rules (AU-11).
  6. 06Generate audit records for selected events on defined components; use non-repudiation where required (AU-12, AU-10).

02 / In this sector

In a legal AI workflow

Applies to AI systems as to any system. Agencies decide which AI events to log (prompts, outputs, model version changes, administrative actions); NIST's planned AI overlays will tailor these controls but are not yet published.

Usually asked by

General counsel and litigation support.

Named alongside

FRE 702 · ABA Model Rules.

Sector pagePlanisphere for law

03 / Records

Records to keep

  1. 01Audit and accountability policy and procedures (AU-1)
  2. 02Documented list of logged event types with rationale
  3. 03Log review reports and escalation records
  4. 04Log integrity protections and retention schedule configuration

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY
GUIDANCE

RELATED

Related: NIST 800-53 · AU: the full guide · NIST 800-53 · AU for defense · NIST 800-53 · AU for medicine · NIST 800-53 · AU for education