It usually arrives as one line in an email. The board wants "a report on AI usage". Or the ISO 27001 auditor asks you to evidence the AI clause in your acceptable use policy. Or a client's due diligence questionnaire asks whether you monitor staff use of generative AI, and if so, to attach a sample log.
You go looking for that log. There isn't one.
ChatGPT will not give you an audit trail. Your browser can.
What people search for, and what actually exists
The queries are consistent: ChatGPT audit log, ChatGPT activity log, AI usage logs, AI audit trail, AI compliance reporting. The assumption behind all of them is that the AI vendor keeps a record you can pull.
For consumer ChatGPT accounts, there is no org-wide export. Someone signed up with their work email, or their personal one. You are not the account owner. There is no admin console listing what they typed, and no report you can hand an auditor.
ChatGPT Enterprise and Team workspaces do give admins compliance and workspace logs. That is genuinely better, but it is not the same thing as DLP evidence, and it only covers that workspace. It tells you nothing about Claude, Gemini, Perplexity, DeepSeek, a hosted wrapper someone found, or the personal ChatGPT account a staff member uses on the same laptop. In most firms we see, the personal accounts are the majority of the usage.
So the honest position is: if your evidence plan depends on the AI vendor, your evidence plan has holes in it.
What a usable AI audit trail actually contains
A useful trail is short, structured, and exportable. For each event you want:
- User - who, tied to an identity you already manage.
- Tool or domain - chatgpt.com, claude.ai, gemini.google.com, and whatever appeared last month.
- Timestamp - when, in a format an auditor can sort.
- Action - visit, paste, or file upload.
- Policy outcome - allowed, blocked, or redirected to the approved tool.
- Export - CSV or report, because "I can show you in the dashboard" is not evidence in a due diligence pack.
Note what is not on that list: the prompt itself. Storing a verbatim transcript of everything staff type into AI tools creates a new pile of sensitive data, a new retention question, and a new conversation with your DPO. We wrote about why that is the wrong default in AI prompt logging: what IT teams need to record. Metadata plus policy outcome answers almost every question you will be asked. Full transcripts mostly create work.
What ISO 27001, the ICO and the board actually want
They want two things: evidence that a control exists, and evidence that it fired.
An acceptable use policy on SharePoint proves the first. Nothing more. The gap that gets flagged is always the second one - you say staff must not paste client data into public AI tools, and you have no way to show whether anyone did, or what happened when they tried.
A log of AI use by user and tool, plus a record of blocked or warned pastes, closes that gap. It shows the control is live, it shows the population it covers, and it shows exceptions being handled. For a board pack, the same export becomes one slide: which tools are in use, how usage is trending, how many risky actions were intercepted.
To be clear about our own position: Fendr does not certify anyone. We are not your ISO 27001 auditor and we do not claim compliance on your behalf. What we produce is the log you use to answer the question yourself. That is what Fendr's compliance and audit reporting is for.
Where the logs can come from
| Capability | ChatGPT native logs | Microsoft Purview / Edge | Fendr browser extension |
|---|---|---|---|
| Covers Chrome | Not applicable | Limited, prompt protection is Edge-centric | Yes |
| Covers Mac and BYOD | Account-level only | Needs enrolled, managed Windows | Yes, wherever the browser is managed |
| Covers non-Microsoft AI tools | No, ChatGPT only | Partial, focused on Microsoft's stack | Yes, across browser AI tools |
| Covers personal AI accounts | No | Partial | Yes, seen at the browser |
| Exportable usage log | Enterprise/Team workspaces only | Yes, inside Purview | Yes, CSV and reports |
| Needs E5 | No | Yes, E5 or E7 tier | No |
| Deploy time | Not applicable | Weeks, with policy and enrolment work | Minutes via MDM |
| Sees native desktop apps | Yes, for its own app | Yes, endpoint DLP | No, browser only |
That last row matters and we are not going to hide it. Fendr is a browser extension. Claude's desktop app and Copilot inside Word are outside what it sees. If your risk sits mostly in native desktop apps, endpoint tooling is the right answer. In practice, the bulk of shadow AI in growing firms happens in a browser tab, which is why the browser is a sensible place to instrument first. The wider licensing picture is covered in ChatGPT DLP without Microsoft Purview E5.
How to produce the trail this week
The short version
Your AI vendor is not going to hand you an audit trail. You do not need a full prompt transcript, and you probably should not want one. You need who, which tool, when, what they did, and what your policy did about it - exportable, and covering every browser and every AI tool, not just the Microsoft ones.
That is a browser-level problem, and it is solvable in an afternoon. Run a free AI audit to see what your current AI usage log would look like, or book a demo to see the reporting.
Ready to see what your team is actually using?