Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Training Data & Model Lifecycle Audit
Log all labelling activity
Verify that all labeling activities are recorded in logs.
OWASP AISVS v1.01, requirement 12.5.2
In plain English
Log every labelling action: who created or changed which label, and when. Labels steer what the model learns. If they are tampered with, or one annotator turns out to be unreliable, the log is how you find and fix the affected records.
What good looks like
- Label creation, edits, reviews and approvals are all logged.
- Each entry has the person or system, the time, the item, and the old and new values.
- Automated labelling is logged with the model or script version.
- Logs are kept with the dataset version and protected from editing.
How teams usually do it
- Audit logs from the labelling platform, exported to central storage.
- Individual accounts for annotators so that entries mean something (see 1.2.1).
Suggested evidence
- Sample labelling logs.
- A query showing every label one annotator touched.
Common mistakes
- Keeping only the final label, with no history.
- Shared annotator accounts.
- Logs that stay in the vendor's platform and vanish when the contract ends.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.