A payments system flags an anomaly. The investigation team pulls the transaction log and finds that the approval was executed by an automated workflow, not a person. The workflow consulted three data sources, applied a scoring model, and approved a transfer to a vendor account that had been compromised two weeks earlier. Nobody authorised that specific decision. The system did, within parameters a human set six months ago and never reviewed since.
Now the question is not who approved the payment. It is whether what the system did can be reconstructed, whether that reconstruction will be admissible, and whether the legal framework for treating it as evidence even exists yet.
For decades, the question in an investigation was what a person knew, said, or did. Increasingly, the question is what an AI agent decided, executed, and why.
Agentic AI systems are no longer tools that assist employees. They are systems that act with operational authority, approving transactions, executing workflows, communicating with third parties, and making decisions that used to require a human in the loop. When something goes wrong, the agent’s decision-making trail is now part of the evidentiary record, whether anyone planned for that or not.
The question this raises is not abstract. It is operational. What does it actually take to forensically reconstruct an AI agent’s decision-making trail, and why are most legal hold processes not built to capture it?
The Evidentiary Problem Nobody Has Fully Solved
For decades, the question in an investigation was what a person knew, said, or did. Increasingly, the question is what an AI agent decided, executed, and why. Agentic AI systems are no longer tools that assist employees. They are systems that act with operational authority: approving transactions, executing workflows, communicating with third parties, and making decisions that used to require a human in the loop.
When something goes wrong, the agent’s decision-making trail is now part of the evidentiary record. But here is the honest counterargument that most writing on this topic skips past: the legal theory for how that record should be treated is still genuinely unsettled.
Courts have not established consistent standards for the admissibility of AI agent logs. There is no equivalent of the business records exception specifically designed for autonomous system outputs. Whether an agent’s reasoning trace constitutes hearsay, a business record, or something else entirely depends on jurisdictional rules that were written before this category of evidence existed. Regulators are issuing guidance on AI governance, but that guidance has not yet translated into clear evidentiary doctrine.
This does not mean the forensic work is unnecessary. It means the forensic work has to be done to a higher standard precisely because the legal framework is still catching up. A reconstruction that would survive scrutiny under settled evidentiary doctrine has a better chance of holding up in a jurisdiction still working out what the doctrine should be. A reconstruction that would not survive settled doctrine has no chance at all.
What an AI Agent Actually Leaves Behind
The categories of evidence involved here did not exist five years ago in this form. There are the prompts and instructions given to the agent, which establish what it was asked to do. There is the model’s reasoning or intermediate output, where it is logged, which shows how it got from instruction to action. There is the final action itself: a transaction approved, an email sent, a record modified. There are the system and API logs showing what the agent accessed and when. And there is any human override or approval step that sat in the loop, which determines how much of the decision was actually automated versus human-directed.
None of this lives in one place. These artifacts are scattered across logging systems, model provider infrastructure, and internal application layers that were never designed with litigation preservation in mind. A prompt history might sit with one vendor. The action log might sit in an internal application database with a thirty-day retention window. The approval step, if there was one, might exist only as a Slack message nobody thought to preserve.
Reconstructing what happened means assembling a record that was never built to be assembled.
Why Legal Hold Was Not Built for This
The standard legal hold process follows a familiar sequence. Identify the custodians. Map their data sources. Issue a preservation notice. That sequence assumes a custodian is a person, someone who can be notified, who understands what they are being asked to preserve, and who has some control over whether they comply.
Agentic AI breaks that assumption at the first step. There is no human custodian to notify. The custodian, in any meaningful sense, is a system. And most organizations have never mapped which of their systems have agentic capability, what those systems can access, or how long their logs are retained before they roll off automatically.
This is precisely the kind of governance gap Gemean’s GRC and legal hold management service is built to close. It is the same information governance maturity work Gemean already provides, extended to a new category of digital actor. The exercise is identical in structure: know what exists, know what it can touch, know how long evidence of its activity survives before someone has to act. What has changed is the subject of the inventory. It used to be people and their devices. Now it includes systems that make decisions without anyone in the room.
The Digital Forensics Discipline This Actually Requires
Once the governance gap is identified, the work of reconstructing what an agent actually did is a digital forensics problem, not a new discipline invented for the occasion.
It requires forensic collection of logs before retention windows close them off permanently. It requires metadata review to establish the exact timing and sequence of what the agent accessed and acted on. It requires activity timeline reconstruction to show the full chain of agent actions in order, not just the final output. And it requires a documented chain of custody, so that when the reconstruction is challenged, and it will be, the methodology holds up to the same scrutiny any other piece of digital evidence would face.
This is the existing digital forensics discipline applied to a new and considerably faster-moving evidence source. An agent can take dozens of actions in the time it takes a person to read one email. The forensic methodology does not change because of that speed. What changes is how quickly the preservation step needs to happen before the underlying data is gone.
What Makes AI Agent Evidence Defensible
A reconstruction of an AI agent’s decision-making trail is only useful if it can survive being challenged in front of a judge, a regulator, or opposing counsel. Three things separate a credible reconstruction from a speculative one.
The first is documented methodology. How were the logs collected, from which systems, and how were they correlated against each other to build a single coherent timeline. The second is a clear chain of custody, tracing every artifact from the system it came from to the report that relies on it. The third, and the one most often missed, is that every conclusion about what the agent did has to tie back to a specific, preserved artifact. A finding that says the agent “likely” took a certain action because that is what the model would typically do is not a forensic finding. It is a guess wearing the structure of one.
Where Specialized Forensic Expertise Changes the Outcome
The two disciplines involved here are not interchangeable, and most organizations facing this problem for the first time will need both.
Mapping which AI agents exist, what they can access, and what legal hold needs to cover before a matter ever arises is GRC and information governance work. Preserving and reconstructing what those agents actually did once a matter is active is digital forensics work. An organization that has to find one specialist for the governance mapping and a separate, unrelated specialist for the forensic reconstruction loses time at exactly the moment time matters most, handing a matter between two teams who have never worked together on this specific intersection before.
Organizations that have both capabilities under one roof do not lose that time. The governance work done in advance directly informs what the forensic team knows to look for and where, because the systems were already mapped before anyone needed to ask.
The Witness You Forgot to Subpoena
The next compliance audit, breach response, or fraud investigation an organization faces may turn on what an AI agent did, not what a person did. That shift has already started, and it is not going to reverse.
The legal framework will catch up. It always does. The question is whether organisations are building the governance and forensic foundations now, while the stakes of getting it wrong are still recoverable, rather than discovering the gaps when a matter has already forced the issue.
The organizations prepared for that question are not the ones with the most sophisticated AI deployment. They are the ones who mapped their agentic systems, understood what those systems could touch, and knew what evidence those systems would leave behind, before a matter forced them to find out the hard way.
Gemean helps organizations map their agentic AI systems before a matter arises and reconstruct what those systems did when one does.
Can an AI agent really be treated as a "custodian" in a legal hold?
Not in the traditional sense, but functionally, yes. A custodian in a legal hold is anyone or anything that holds potentially relevant data. An AI agent with system access generates exactly that kind of data, through its prompts, its logged reasoning, its actions, and the systems it touches. The practical answer is to treat the agent’s data sources the same way you would treat a human custodian’s devices and accounts, mapped, identified, and brought under hold the moment litigation is reasonably anticipated.
What happens if an organization did not preserve AI agent logs before a matter arose?
It depends heavily on what survived. Some systems retain logs far longer than others, and some model providers retain prompt and output history independent of the organization’s own infrastructure. The first step in any matter involving agentic AI activity is a rapid inventory of what might still exist across every layer, internal application logs, provider-side records, and any human approval trail, before assuming anything is unrecoverable.
How is reconstructing an AI agent's actions different from a standard digital forensics investigation?
The underlying methodology, forensic collection, metadata review, timeline reconstruction, chain of custody, does not change. What is different is the evidence landscape. The artifacts are newer, more scattered across vendor and internal systems, and frequently subject to shorter retention windows than traditional email or document records. The forensic discipline is the same. The map of where to look is not.
Does this only matter for organizations using advanced or experimental AI tools?
No. Any system with the authority to take an action without a human approving each step individually, approving a payment, sending a communication, modifying a record, creates this exposure, regardless of how sophisticated the underlying model is. Many organizations have more agentic capability deployed across routine business systems than they realize, often added incrementally by different teams without central oversight.
What is the first step an organization should take if it has not mapped its AI agent risk yet?
Start with an honest inventory. Identify every system with the ability to take autonomous or semi-autonomous action, document what each one can access, and check how long each system retains logs of its activity before that data ages out. That inventory alone usually surfaces the most urgent gaps. From there, the legal hold framework and the forensic preservation plan can be built around what was actually found, rather than assumptions about what probably exists.
