Prove
AI agent audit trail and compliance reports
ContextGate keeps an AI agent audit trail: every tool call your AI apps make, with its arguments, the redacted result and the policy outcome. Eight reports draw on it, each for a rule your organisation answers to: the calls, the data redacted, the policies that blocked or warned, and the apps and servers involved.
Not sure which rules apply to you? See who each rule covers.
Operational incident report
FCA PS26/2 and FG26/3
The facts an FCA operational incident report needs when an AI app was involved: what it did, when, where the calls went and what was stopped.
What it covers
- A timeline of the AI app's tool calls: each call, its arguments, the redacted result and the policy outcome, with timestamps.
- Which app or MCP server each call went to, for the third parties involved.
- The calls policies blocked or warned on, with the policy that fired.
Who needs it
Firms with a Part 4A permission, payment service providers, UK recognised investment exchanges, registered trade repositories and registered credit rating agencies, from 18 March 2027.
What you still do
Decide whether a threshold is met, then write and submit the report: within 24 hours of deciding it is reportable, or 4 hours from detection for payment service providers.
About the rule: who it covers, what it asks, and the full guide →
Material third-party register and notifications
FCA PS26/2 and FG26/4
The AI suppliers your AI apps actually reach, for your material third-party register and your notifications to the FCA.
What it covers
- Every app and MCP server your AI apps reach through ContextGate.
- How each one is used: its tool calls over time, and the tools switched off.
- New connections as soon as someone adds them, so a planned arrangement can be assessed and notified early.
Who needs it
Enhanced scope SM&CR firms, banks, building societies, designated investment firms, Solvency II firms, CASS large firms, authorised e-money and payment institutions, UK recognised investment exchanges and consolidated tape providers, from 18 March 2027.
What you still do
Decide which arrangements are material, keep the register and send the notifications.
About the rule: who it covers, what it asks, and the full guide →
SM&CR reasonable-steps Pack
SM&CR duty of responsibility
Evidence that the senior manager answerable for AI took reasonable steps: the controls in place, how they are monitored, and how someone can step in.
What it covers
- The policies applied to each connection, and the tools switched off.
- The activity record, for how the controls are monitored.
- Blocked and warned calls, as evidence the controls work.
Who needs it
FSMA-authorised firms. Firms authorised only as payment or e-money institutions are outside SM&CR.
What you still do
Name the senior manager, decide the controls and review them.
About the rule: who it covers, what it asks, and the full guide →
Consumer Duty board report: AI section
Consumer Duty, Principle 12 and PRIN 2A
The AI section of your annual Consumer Duty board report: where AI apps read or act on customer records, and the safeguards around them.
What it covers
- Personal data redacted from tool results before the AI app saw it, by type: for example UK sort codes, account numbers and NI numbers.
- Governance checks that warned on or blocked a call, such as a draft that promised a guaranteed return.
- Which AI apps used which customer-facing tools, and how often.
Who needs it
Firms that serve retail customers, including payment and e-money firms.
What you still do
Judge the outcomes and write the board report.
About the rule: who it covers, what it asks, and the full guide →
AI records of processing and DPIAs
UK GDPR Article 30 and Article 35
The facts for your record of processing and your data protection impact assessments where AI apps handle personal data.
What it covers
- Which types of personal data were redacted in tool results.
- Which apps and MCP servers the calls went to, for your recipients.
- The redaction, blocking and access controls in force, for your security measures.
Who needs it
Any organisation processing personal data through AI apps.
What you still do
Decide the lawful basis, write the record and the DPIA, and sign them off.
About the rule: who it covers, what it asks, and the full guide →
AI security Review Pack
CSA AI-CAIQ and customers' own questionnaires: contractual, not statutory
Answers to the AI questions in your customers' security reviews: what is logged, how personal data is protected, and which tools an AI system can use.
What it covers
- What is recorded for each tool call: the AI app, user, tool, arguments and policy outcome.
- Personal data redaction, secret blocking and switched-off tools, as controls in force.
- Which tools each AI app can use, connection by connection.
Who needs it
Any company that sells to other businesses, and most of all to banks, insurers and other regulated firms.
What you still do
Write the answers and the policies behind them.
About the rule: who it covers, what it asks, and the full guide →
ISO 42001 Evidence Report
ISO/IEC 42001, a voluntary standard
Evidence for the monitoring and control parts of an ISO/IEC 42001 AI management system. ContextGate itself is not certified against ISO/IEC 42001.
What it covers
- The activity record, as monitoring evidence.
- The policies in force and the tools switched off, as controls.
- Blocked and warned calls, as controls operating.
Who needs it
Organisations that run, or want to certify, an AI management system.
What you still do
Run the management system, and get certified if you choose to.
About the rule: who it covers, what it asks, and the full guide →
EU AI Act Proof Report
EU AI Act, Regulation (EU) 2024/1689
A record of what your AI apps did and the controls around them, for the EU AI Act's logging and oversight duties.
What it covers
- Every tool call your AI apps made: what was called, with what arguments, and the outcome.
- Policies and switched-off tools as controls set in advance, with blocked and warned calls showing them working.
Who needs it
Organisations that provide or use AI systems in the EU, including UK organisations whose AI serves people in the EU.
What you still do
Work out which of your AI uses are covered and at what risk level, then meet the duties that apply.
About the rule: who it covers, what it asks, and the full guide →
Questions people ask about auditing AI agents
How do you audit AI agent actions?
Put the tools the agent uses behind one connection that records every call: which AI app, which user, which tool, the arguments, the result after redaction, and whether a policy blocked, warned on or allowed it. Then review the record by app, tool, user, policy or time, and export it when an auditor or regulator asks. ContextGate keeps that record for every tool call made through it.
What does an AI agent audit trail contain?
For each tool call: a timestamp, the AI app and the signed-in user behind it, the connection and tool called, the arguments as the app sent them, the result as the app received it (with personal data replaced by placeholders), and the policy outcome: allowed, warned or blocked, with the policy that fired. Together those reconstruct what an agent did and what stopped it.
How do enterprises audit decisions made by AI agents?
By recording actions rather than trying to recover reasoning. An agent's decision shows up as the tool calls it made and the ones it was refused. With the policies set in advance (which tools are available, what must never be sent, what needs a person) the record shows both the decision and the controls that shaped it, which is what an audit, an incident review or a complaint needs.
Which compliance reports can be built from an AI agent audit trail?
The eight on this page: an FCA operational incident report and a material third-party register (PS26/2), an SM&CR reasonable-steps pack, the AI section of a Consumer Duty board report, AI records of processing and DPIAs under UK GDPR, an AI security review pack for customer questionnaires, ISO 42001 evidence, and an EU AI Act report. Each gathers what the rule asks for from the record; the judgement and the filing stay with you.
A summary, not legal advice: check your obligations with your compliance team or adviser.
Ready to see what your AI agents do?
Create a free workspace and add ContextGate to your AI apps in minutes. No card required.
Get started free
We'll email you a sign-in link to set up your workspace.
Rather talk it through first? Book a 30-minute call