How to Write an AI Decision Record

An AI system proposes an answer. A person accepts, edits or rejects it. Weeks later, the output remains but the reasoning environment has vanished: the model changed, the source moved, the prompt is missing and nobody remembers who made the final call. An AI decision record prevents that disappearance.

The record is not a transcript archive and not a claim that paperwork makes a decision safe. It is a compact account of what was decided, what the AI contributed, what evidence a human checked, who owns the consequence and when the result should be revisited.

Use a record when the decision can outlive the chat

Do not document every spelling correction. Create a record when an AI-assisted choice affects another person, commits meaningful time or money, changes published information, handles sensitive data, creates a reusable rule, or would be hard to reconstruct after a failure.

The higher the consequence and the harder the rollback, the stronger the record should be. A brainstorm for private notes may need none. A public research summary needs sources and verification. A hiring, credit, health, legal, safety or access decision needs formal institutional controls beyond this personal template.

Use The Reversibility Test before choosing the record depth. Documentation should scale with the cost of being wrong, not with how impressive the model appears.

The eleven fields that matter

1. Decision and status. State the actual choice in one sentence and mark it proposed, approved, rejected, superseded or rolled back.
2. Date and owner. Record when the decision was made and the person or role accountable for it.
3. Purpose and affected people. Name the intended outcome and who bears costs if it fails.
4. AI contribution. Say whether the system brainstormed, summarized, retrieved, classified, drafted, calculated or recommended.
5. System identity. Record provider, product or model name shown by the interface, relevant mode, and date. Do not invent a hidden version number.
6. Material inputs. Describe the prompt, files, data range and constraints necessary to reproduce the task without copying unnecessary personal data.
7. Sources checked. Link the primary materials that support consequential claims and note access dates or versions.
8. Human review. Name what was independently checked, edited or rejected and by whom.
9. Alternatives. Record at least one credible option and why it was not chosen.
10. Risk and rollback. State the leading failure mode, detection signal, stop condition and recovery path.
11. Review and retention. Set the next review date and when the record or sensitive attachments should be deleted.

These fields separate the system's contribution from the human decision. They also preserve disagreement. “The model recommended A; the reviewer chose B because the primary source contradicted the summary” is valuable operational evidence.

Copy this lightweight template

Decision: [one sentence]
Status: proposed | approved | rejected | superseded | rolled back
Date / owner: [date] / [responsible person or role]
Purpose / affected people: [outcome and stakeholders]
AI contribution: [brainstorm, summary, draft, classification, other]
System / mode / date used: [what the interface actually identifies]
Material inputs: [minimal reproducibility note]
Sources verified: [primary links, versions, access dates]
Human review: [checks, edits, disagreement, reviewer]
Alternatives considered: [option and reason]
Risk / stop signal / rollback: [specific action]
Review date / retention: [date and deletion rule]

Keep the record beside the work product, not inside a personal chat account that colleagues cannot access. Use the storage and access controls appropriate to the underlying information.

Preserve evidence, not theater

A full chat transcript can be long while omitting the facts that matter. It may not reveal system configuration, retrieval changes, hidden instructions or later model updates. It can also duplicate personal or confidential information into a less controlled archive.

Prefer a concise prompt summary, the exact material output used, verified source links and the human decision. If exact wording is material, preserve that excerpt. If a calculation matters, save the independent calculation. If a citation matters, follow How to Verify an AI Citation Before You Use It and record the page or passage that supports the claim.

Sourced fact: NIST's AI RMF Playbook recommends documenting roles, responsibilities, risks, policies and decisions about bypassing or deactivating AI systems. Inference: an effective local record should make authority and intervention visible, not merely preserve model output.

Be honest about system identity

Interfaces do not always disclose every component in a pipeline. A product name may sit above retrieval, routing, moderation and one of several models. Record what the service actually displays, the date, the enabled mode and any organization-managed settings you can verify. Do not guess at hidden architecture.

If the provider exposes a stable model or API version, record it. If not, write “consumer interface; underlying model not confirmed.” Reproducibility is a spectrum. Honest uncertainty is more useful than a fabricated version label.

Minimize the record before you secure it

A decision record can become a second sensitive dataset. Do not paste secret keys, passwords, medical details, protected personnel information or complete customer records into it. Use case IDs, data ranges, approved storage references and redacted excerpts where possible.

Ask four questions: Who needs access? What is the minimum information needed to reconstruct the decision? How long does it remain useful? Who can delete it? The Personal Data Minimization guide applies to governance records too.

Review provider retention and training controls separately. A local record does not change what the AI service retained during the original interaction. For that distinction, see What AI Chatbots Remember.

Use three documentation tiers

Tier one: reversible personal work. Record the decision, date, AI contribution and one verification note. Example: selecting a draft outline.

Tier two: published or shared work. Add sources, system identity, human review, alternatives, risk and review date. Example: using AI to organize a public comparison.

Tier three: consequential institutional work. Use the organization's approved risk process, legal requirements, access controls, testing, escalation, appeals and audit trail. This page is not a substitute for those controls. If none exist, the absence is itself a risk to escalate.

A low-stakes worked example

Decision: publish a help-page structure with five sections. AI contribution: generated three candidate outlines from an existing policy document. Human review: editor checked every requirement against the policy, removed an unsupported promise and wrote the final wording. Alternative: preserve the old structure; rejected because users repeatedly missed the cancellation step. Risk: policy changes make the page stale. Stop signal: policy owner revises cancellation rules. Rollback: restore the previous page from version control. Review: quarterly and upon policy change.

Notice what the record does not say: “AI decided the layout.” The accountable editor decided after using an AI draft. That wording preserves the responsibility chain described in Automation Does Not Remove Responsibility.

Review the decision, not only the model

At the review date, ask whether the underlying goal still matters, whether affected people experienced unanticipated costs, whether sources or rules changed, and whether the AI contribution remains appropriate. A technically unchanged model can still become unsuitable when the context changes.

Mark superseded records clearly. Do not silently rewrite history. Link the replacement decision and explain what changed. A useful record shows revision rather than pretending the first answer was inevitable.

What a record cannot do

A record cannot validate a model, eliminate bias, confer legal compliance or make a harmful decision accountable by itself. It can expose missing review, unclear authority and absent rollback. That visibility enables governance; it is not governance's completion certificate.

The test is practical: after the original participants leave, can a responsible reviewer understand what the AI did, what a human decided, which evidence mattered and how to stop or repair the result? If yes, the record is doing useful work.

Official framework notes

• NIST, AI Risk Management Framework.
• NIST AI Resource Center, AI RMF Playbook.
• NIST AI RMF Playbook, Govern function, on roles, policies and tracked risk information.
• NIST AI RMF Playbook, Manage function, including documented intervention and deactivation decisions.
• NIST, Generative AI Profile (PDF).