How can you trace AI entries in the NIS2 walkthrough?

How do you see what an assistant wrote?

If an assistant wrote a screen in the walkthrough, it says, for example, “Filled in by the assistant claude-code/2.1.287 on 16 October 2026”.

The name is the one the assistant gives itself when it signs in through the browser. With a pasted key it is the identifier its program sends.

The mark records that day's change and stays when a person changes the screen afterwards. If an assistant writes there again later, the mark shows that one. Whether a person changed anything after the assistant, you see in the activity log.

What does the activity log show?

The activity log shows, day by day, who changed what and when. A change through an assistant stands under the name of the person who connected it, with “via” and the assistant's name below it, then the time.

When a call saved something, there is also the entry “Walkthrough item filled in by an assistant” with the item's code. What a change caused appears with the assistant too, such as an item picked up again from the waiting list.

What people do in Settings is in the log as well, for example “Key for assistants created”, “Assistant allowed” or “All assistants disconnected”.

Admins and people with the Reviewer or Legal reviewer access role can see the log. You find it in the left sidebar under Administration.

What does each row in the log store?

Behind every entry is a row in the database. If the change came through an assistant, the row's field for the program (the user agent) starts with “mcp:”, followed by the name the assistant gave when it signed in. With a pasted key it is its program's identifier, cut to the first 100 printable characters, or “key” if it sends none.

A browser cannot imitate this marking. If a browser itself sends an identifier that starts that way, it is stored behind a marker. Only what came through a key or an assistant's sign-in counts as an assistant's change.

Not every row has readable text yet: some still name the change by its technical name, and a few rows that only accompany a change appear without “via”. What you can rely on is the person's name, “via” with the assistant on its changes, and the time.

Reading changes nothing. The activity log notes it once an hour, marked MCP; the server log gets a line per call with the tool and the person's ID. Neither holds the content; self-hosted, both sit with your IT.

What does management check before approving at 7.3?

Management approves the measures and oversees their implementation (Art. 20(1) NIS 2). Before approving at 7.3, it helps management to know which entries an assistant made and who finished the item afterwards.

Open the items waiting for approval and read the screens with a mark first. Ask about facts only someone in the company can know, such as the date of the last restore that worked in 4.4.

An admin or reviewer can show you in the activity log whether anyone changed something afterwards and who finished the item.

This is how the walkthrough shows that every change made through an assistant is tied to a person and that people finished and approved the items. Whether such records hold up in an audit is covered in our article on NIS 2 records filled in by AI.

Art. 20(1) NIS 2