Who could alter it?
If the answer includes the party the record is about, it is not evidence in a dispute.
← Learn · audit trails
Two different jobs wearing the same name.
An operational log helps you investigate something internally. An evidentiary record convinces someone outside your company. Almost everything sold as an “AI audit trail” is the first, described as though it were the second.
The test
Can it be checked by someone who trusts nobody?
Ask three questions of any AI logging you already have.
What proves it wasn't altered?
Retention is not integrity. A ten-year retention policy on a mutable record buys you ten years of a mutable record.
Can it be verified without asking the issuer?
Evidence that can only be checked by asking the issuer is worthless at exactly the moment the issuer is the disputed party.
What the standards say — and don't.
The mainstream information security standard already recommends protecting logs with “cryptographic hashing, append-only recording, read-only recording, and use of public transparency files.”
The AI management standard says only that logging should be enabled while the system is in use.
Article 12 requires automatic logging; Article 19 sets retention at no less than six months. Neither requires integrity, and ordinary application logs satisfy both.
So the security standard already asks for what the AI standard leaves out — and nobody has connected the two. If your organisation is certified against 27001, you have already committed to a control your AI logging probably doesn't meet.
A signed receipt is 27002 §8.15 applied to AI traffic: hashed, append-only, anchored in a public transparency file, and checkable by a stranger.
That is what Lyntway issues, and you can verify one in four minutes without an account.