Every major AI platform now writes audit logs. Anthropic exports 180 days by CSV, OpenAI streams append-only JSONL, Purview records every Copilot interaction automatically. The hard part is moving those logs somewhere durable before each platform's retention clock erases them.
That’s the whole game — not whether the logs exist, but where they end up.
Security teams keep asking vendors "do you have audit logging?" and checking the box when the answer is yes. Wrong question. The useful ones are: what's in the log, how long does the platform keep it, how do I pull it continuously, and does anything downstream already speak its schema. Four platforms, four different answers to each.
What the four platforms actually export
Anthropic gives Claude Enterprise customers two doors. The narrow one is the audit log export in Organization settings: an Owner clicks a button, the past 180 days get aggregated, and a download link arrives by email, live for 24 hours. You get actor, event type, IP address, device ID, and user agent across 26-plus event types. You do not get conversations. Anthropic's support docs are blunt about it: "title and content of chats and projects are not available to be exported in audit logs (only their unique identifiers will be exported)."
The wide door is the Compliance API, served under /v1/compliance/* with a shared limit of 600 requests per minute per parent organization. It returns the Activity Feed, the user directory, and the underlying chats, files, and projects. It also returns something nobody expects: transcripts of Claude Code and Cowork sessions running on users' local machines, as long as they're signed into the Enterprise org. Anthropic's own docs call the CSV export "significantly narrower than the Compliance API." They’re right.
OpenAI took a different route. ChatGPT Enterprise ships what its docs call an "append-only compliance log stream" of time-windowed JSONL files, built, per the quickstart, for "downloading log files so you can ingest them into your SIEM or data lake." Per OpenAI’s help-center description, it logs conversations, uploaded files, admin actions, auth events, and agent activity, and a separate stateful Compliance API answers questions about current state. One line in the docs deserves a highlighter: "Don't assume the source retention window replaces your organization's retention policy." OpenAI is telling you, in writing, to run your own archive.
Microsoft logs Copilot without being asked. Purview's Audit (Standard) captures CopilotInteraction records automatically, no configuration required. The schema is genuinely rich. AccessedResources lists every file and email Copilot touched, sensitivity labels included, and there's a boolean called XPIADetected that flags when a cross-prompt injection attack was spotted, which quietly turns your audit log into a detection source. The catch sits in the Messages property: message IDs and an isPrompt flag. No text. Prompt and response content lives in a separate Graph API, aiInteractionHistory, still on the beta endpoint and capped at 100 records per request. Retention runs 180 days on Audit (Standard), one year on Premium, ten years with a paid add-on. If you're weighing whether Purview alone covers you, we compared Purview against AI-native DLP at length.
Google is the thinnest of the four. Gemini for Workspace writes log events into the Admin console — actor, action, event category, device data. Nothing in the documentation says prompt content is captured. Export runs through Sheets, the Reports API, or BigQuery on eligible editions, and Workspace reporting data generally holds for about six months.
Last verified: September 5, 2026.
| Platform | Export mechanism | Prompt/response content? | Native retention | Named SIEM integration |
|---|---|---|---|---|
| Claude Enterprise (Anthropic) | CSV audit export from org settings; Compliance API under /v1/compliance/* | Via Compliance API only; the CSV export ships identifiers, not content | 180-day export window | Datadog Claude Compliance; Hurricane Labs Splunk add-on |
| ChatGPT Enterprise (OpenAI) | Compliance Logs Platform: append-only, time-windowed JSONL downloads; plus a stateful Compliance API | Yes: conversations, files, admin and auth events, agent activity | Short; OpenAI's docs tell you to enforce your own retention | No first-party SIEM connector; eDiscovery/DLP partners (Global Relay, Palo Alto Networks, Relativity, Tenable, Concentric AI) |
| Microsoft 365 Copilot | Purview Audit, automatic; aiInteractionHistory Graph API (beta) for content | Audit records carry message IDs only; content requires the beta Graph API or eDiscovery | 180 days Standard; 1 year Premium; 10 years with add-on | Microsoft Sentinel M365 Copilot connector (CopilotActivity table) |
| Gemini for Workspace | Admin console log events; Reports API; BigQuery export on eligible editions | Not documented; interaction metadata only | Roughly six months | None named; BigQuery is the usual bridge |
"Immutable" is a bucket you configure, not a box you tick
Only OpenAI markets its export as append-only. Anthropic, Microsoft, and Google document retention windows and make no tamper-evidence claims for these logs. So when a regulator asks whether your AI audit trail is non-rewriteable, the honest answer depends entirely on what you did after the export.
The standard move is S3 Object Lock in Compliance mode. The rule is unambiguous: in Compliance mode, the protection cannot be removed by any user, including the root account. Cohasset Associates has assessed Object Lock against SEC Rule 17a-4(f), FINRA Rule 4511, and CFTC Regulation 1.31, and its opinion covers retention applied in either mode. Use Compliance mode anyway: Governance mode can be bypassed by privileged users, and privileged misuse is precisely the threat model an audit trail exists for.
Land every export in a Compliance-mode bucket, turn on access logging for the bucket itself, and forward from there to the SIEM. The SIEM copy is for detection. The locked copy is for the lawyer.
Article 12 is the deadline behind all this
The EU AI Act's record-keeping requirement is short and unforgiving. Article 12: "High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system." Lifetime. Not 180 days, not six months. For certain Annex III systems, the minimum log even includes the start and end time of every single use.
Hold that against the retention column in the table above and the mismatch is stark. Every platform window is shorter than any regulatory horizon you're likely to face, whether that horizon comes from the AI Act, from HIPAA's audit-control expectations for systems touching health data, or from SEC books-and-records rules if you're a regulated firm archiving AI conversations. Continuous export isn't an optimization. It's the only way the math works.
The integrations that exist right now
Three are worth naming because you can deploy them this week.
- Microsoft Sentinel's Microsoft 365 Copilot connector. Public preview since February 2026. It pulls Copilot audit records through the Office 365 Management API into a dedicated CopilotActivity table in near real time. Install from the Sentinel Content Hub.
- Datadog's Claude Compliance integration. Ingests Anthropic's Activity Feed, 150-plus activity types across 35-plus categories, tags everything source:claude-compliance-logs, and ships Cloud SIEM detection rules out of the box. Requires an Anthropic Enterprise plan and an Admin API key scoped to read compliance activities.
- The Hurricane Labs Add-on for Anthropic Compliance API on Splunkbase (app 8758). Polls the Activity Feed, the org directory, Claude.ai projects, and chats for audit, eDiscovery, DLP, and insider-risk use cases.
Notice what's missing. There's no first-party ChatGPT Enterprise connector for Sentinel or Splunk on that list; OpenAI's named partners skew toward eDiscovery and archiving. For the JSONL stream you're writing a scheduled puller yourself. It's a paginated download API with ISO 8601 time windows, so this is an afternoon of scripting rather than a project, but it's your afternoon. Internal LLMs behind your own gateway are the easy case, since you own the middleware and can log whatever you want. It's the SaaS platforms where you take what you're given.
Once events land, write detections. An alert on XPIADetected being true belongs near the top of the list, and the CIS Controls mapping for AI agents is a sensible frame for prioritizing the rest.
What none of these logs will show you
Cross-platform correlation, for a start. You now hold four event schemas, four identity namespaces, four retention clocks, and four definitions of what even counts as an event. Nothing native will tell you that the same engineer pasted the same customer file into ChatGPT after Copilot refused it. Joining that requires normalizing everything into one event model keyed on shared identity, which is exactly the layer platform vendors don't ship because each one only sees itself. This is the core argument for an AI control plane that sits above the individual tools.
Then there's the desktop. Personal ChatGPT accounts, local models, unmanaged browsers: none of them appear in any log described above. Purview's AIAppInteraction records cover third-party AI only where network or browser DLP already sees the traffic. The one bright spot is Anthropic returning local Claude Code and Cowork transcripts through its Compliance API, and even that only works for sessions signed into your org. Everything else is dark, which is why endpoint AI security has become its own discipline.
That gap is where we live. AccuroAI's endpoint AI governance watches AI use at the machine rather than the platform, classifies traffic with 40+ content classifiers, and streams its own audit trail into whatever SIEM you already run — one schema across every tool, including the ones with no compliance API at all. Customers typically surface 94% of their shadow AI within 30 days of switching it on.
Agent runtime activity is a third blind spot with problems of its own; we covered it separately in our AI agent runtime security guide.
Questions that come up in every scoping call
Can I get actual prompt text out of Copilot's audit log?
No. CopilotInteraction records carry message IDs and an isPrompt flag, nothing more. For text you need the aiInteractionHistory Graph API, which is beta and capped at 100 records per request, or a Purview eDiscovery workflow. Plan for both, because auditors ask for content eventually.
What's the difference between an audit log, an activity feed, and a compliance API?
The terms get used loosely, so here's a working glossary. An audit log records administrative and security events (sign-ins, permission changes, exports), usually without content. An activity feed is a stream of user-level events, sometimes with content references attached. A compliance API is programmatic access to either or both, built for continuous pull rather than one-off download. Anthropic offers all three, which is why its documentation reads confusingly on first pass.
Does an append-only export make me SEC 17a-4(f) compliant?
Not on its own. The assessed control is your storage: Object Lock in Compliance mode, with a Cohasset-style assessment behind it. A platform's stream being append-only protects integrity in transit, but the regulator cares about the archive you control.
Do local Claude Code sessions really show up anywhere?
Yes, and it surprises people every time. Anthropic's Compliance API returns transcripts of Claude Code, Cowork, and Claude for Microsoft 365 sessions on users' machines when those sessions are signed into an Enterprise org. The same work done on a personal account appears in no log at all.