The Compliance Layer of AI Is Becoming Infrastructure

Every AI system an organisation deploys needs the same small set of controls, and most organisations build them separately every time. This piece covers the consolidation underway, drawing on FISTA Solutions' AI enablement delivery work.

What does every system need?

Four controls that recur in every deployment.

Control	Why every system needs it
Audit logging	Investigation, regulation, and dispute
Retention and deletion	Legal obligation and risk reduction
Consent capture	Personal data processing
Disclosure	Telling people a system is automated
Access control	Who may use which capability
Data residency	Where processing may occur

Why does per-project building fail?

Because it produces as many implementations as projects, all slightly different.

One team logs prompts, another logs only outputs, a third logs nothing because it was not asked to. When a regulator or a customer asks what was processed and when, the organisation has no single answer.

It also means every project pays the review cost separately. Security and legal assess each implementation from scratch, which is the bottleneck teams complain about and the direct consequence of not sharing. See AI governance framework.

What should audit logging capture?

Enough to reconstruct what happened, with sensitive material handled appropriately.

That means the request, the context supplied, the model and version, the output, any action taken, and the identity of the person or system involved. Linked by a correlation identifier so a whole interaction can be assembled.

The tension is that these logs contain exactly the data most in need of protection. Redaction at capture, access controls on the logs, and a retention period that is itself compliant are all necessary. See AI log retention checklist.

Why is retention difficult?

Because deletion has to reach everywhere the data went.

A deletion request covers the primary record, the audit log, the cache, the vector store, the backup, and anywhere the data was copied for analysis. Systems built without this in mind cannot honour it.

Retention periods also differ: transaction records may need years, conversation logs months, and some categories must be deleted promptly. One policy for everything is either too short to be lawful or too long to be prudent. This is general guidance, not legal advice.

What is happening with disclosure?

Requirements are tightening across jurisdictions.

Several frameworks now require that people be told when they are interacting with an automated system, and some require an explanation of automated decisions affecting them. The direction is consistently toward more disclosure.

Building disclosure as shared infrastructure — a consistent way to indicate automation and to surface an explanation — is cheaper than retrofitting it into each interface separately. This is general guidance, not legal advice.

What does the shared layer look like?

A small set of services every AI system is required to use.

A logging service with a defined schema, a retention service that knows the rules per data category, a consent store, and a disclosure component for interfaces. Teams integrate rather than implement.

The requirement has to be enforced, usually through the deployment pipeline or the review process. Optional shared infrastructure is unused shared infrastructure, and then the organisation has both the platform cost and the inconsistency.

Who owns it?

A platform team, with legal and security as stakeholders rather than as owners.

The controls encode legal requirements, so legal defines what is needed. But the implementation is infrastructure, and infrastructure owned by non-engineers does not get maintained.

The pattern that works is legal specifying the obligation, platform engineering building and running the service, and security reviewing it once rather than reviewing every project.

What is the counter-argument?

The counter is that premature platform building is a classic failure, and an organisation with two AI systems does not need a compliance layer. That is right. The threshold is roughly the third or fourth deployment, or the first regulatory question that nobody can answer centrally.

What does this change for engineering teams?

It changes what a project team is responsible for: integrating with the controls rather than designing them. That is a smaller, clearer responsibility and it shortens review.

It also means the logging schema becomes a contract, which needs versioning and care in the same way any shared interface does.

What does this change for buyers?

It means asking vendors what they log, how long they retain it, how deletion works, and whether you can export the audit trail.

A vendor whose audit logging you cannot access has moved a compliance obligation to a place you cannot satisfy it from.

What should leaders do about it now?

Count how many separate implementations of audit logging exist across your AI systems. If the number is more than one, that is the case for consolidation.

Then make the shared services mandatory rather than available, or they will not be used.

Does this connect to the coming audit wave?

Directly. Auditors ask what was processed, by which system, under what authorisation, and what happened to it afterwards. Those questions are answerable only from records captured at the time.

Organisations building the logging layer now will answer in days. Those without it will reconstruct from partial evidence, which is expensive and unconvincing. See the coming audit of AI systems.

How will you know if this is happening?

Watch for security review becoming the bottleneck on AI projects, for inconsistent answers to what is logged, and for deletion requests that cannot be fully honoured. Each indicates the layer is missing.

How FISTA Solutions reads this

FISTA Solutions builds and operates production AI systems through AI agents, AI enablement, and forward deployed engineering: audit logging, retention, and disclosure built once as shared services that projects integrate with rather than reimplement, decisions documented with their reasoning, and handover that leaves your team able to maintain what was delivered. The record is 150+ projects for 50+ companies across 12+ countries.

To discuss what this means for your roadmap, message FISTA on WhatsApp, or read AI governance framework.