Clause 7.2: Traceability
Traceability describes how far what the service produces can be connected back to what the user needed, or forward from that need.
What clause 7.2 is
Traceability describes how far what the service produces can be connected back to what the user needed, or forward from that need. In practice it means records of the models, datasets, requests and outcomes that let a result be reconstructed and a decision explained. It is the service-side counterpart of product transparency.
What the 2023 edition said
No equivalent.
What the second edition changes
New in the second edition, as a sub-characteristic of the service model. The public commentary links it to the work on AI system logging.
The FDIS text is not public. The change line above is read from the public draft, which is not the FDIS and may differ. No clause level diff is invented here. The ISO stage record is the authority for the dates.
Why it matters to the buyer
When a customer disputes an outcome, the provider has to reconstruct what happened: which model, which data, which request, which decision. Without that, the service cannot defend itself and the customer cannot check it. The characteristic is also what lets an auditor test the other service claims, because a claim about an outcome that cannot be traced is only an assertion.
What to write in the requirement
Define the identifiers that link a request to a model version and an outcome. Set the retention period against the dispute and audit windows. Test reconstruction on a real request, not a synthetic one. Record who may read the log and how a customer obtains an extract without exposing another customer's data.
Evidence a reviewer asks for
A reviewer will pick an outcome and ask you to reconstruct it. A log that stops at the API call is not traceability.
- Identifier schemeThe identifiers that link request, model version, data version and outcome
- RetentionThe retention period and the reason it matches the dispute and audit windows
- Reconstruction testA dated reconstruction of a real outcome from the logs alone
Where it commonly fails
- Model versions are not logged
- Retention is shorter than the dispute window
- No reconstruction test was ever run
What to do before publication
Run one reconstruction test before publication and fix the first gap it finds.
Read across
Source for clause 7.2: ISO/IEC 25059, Clause 7.2, retrieved 20 October 2026. The change line rests on the public draft of the second edition and ISO page 88234. The requirement, evidence and gaps are written from our record. Every source.