OpenTelemetry Traces Aid Engineers but Fall Short as EU AI Act Compliance Proof

Engineers using OpenTelemetry to instrument AI agents often assume detailed traces constitute a valid audit trail, but EU AI Act Articles 9 and 13 demand more than self-reported observability data. Regulators require evidence that is independent of the system being audited, meaning a company cannot serve as the sole witness to its own behavior — much like a financial audit cannot rely solely on internally created records. Three structural gaps undermine telemetry as compliance proof: observability backends often allow post-hoc modification of spans, the entity being audited typically controls the primary data store, and agent context such as full system prompts or RAG memory states is frequently never serialized into traces. Simply adding more instrumentation — capturing prompts, hashing model versions, or logging tool arguments — moves in the right direction but does not fully close the evidentiary gap. Closing it requires architectural changes that introduce tamper-evidence and independent verification, separating the act of observing a system from the act of proving how it behaved.