LangChain · Compliance · Audit · Technical Guide

How to Audit LangChain Agents for Regulatory Compliance

February 28, 2026 · Zirahn Team

LangChain is the most widely deployed agentic AI framework in production. If your organization runs LangChain agents in a regulated industry, you need a compliance audit strategy. This guide shows you how.

Why LangChain Agents Are Harder to Audit Than Traditional Models

LangChain’s power is its flexibility: agents chain LLM calls, tool invocations, memory retrievals, and conditional logic into autonomous workflows. That flexibility is also what makes compliance auditing hard.

With a traditional ML model, an auditor asks: “Given input X, does the model produce output Y within acceptable parameters?” The answer is checkable with a test dataset.

With a LangChain agent, the questions multiply:

None of these questions are answerable with standard LangSmith observability alone. You need compliance-grade logging.

What Regulators Actually Need

Whether you’re preparing for an EU AI Act conformity assessment, an SEC exam, or an internal audit, regulators want to see:

  1. A complete action timeline — every tool call, LLM prompt, and decision point, timestamped
  2. Policy mapping — how each action relates to your compliance framework obligations
  3. Evidence of human oversight — proof that humans could intervene and did so when needed
  4. Drift monitoring — evidence that the agent behaved consistently over time
  5. Incident records — documented cases where the agent violated policy and how it was handled

Step 1: Instrument Your AgentExecutor

The foundation of compliance auditing is comprehensive logging. Here’s the minimum viable instrumentation for a LangChain AgentExecutor:

from agentgovern import init, instrument_langchain

init(api_key="ag_your_api_key", environment="production")

# Returns a LangChain callback handler bound to this agent. It captures
# nothing until you pass it to the agent through callbacks.
handler = instrument_langchain(agent_external_id="credit-scoring-agent-prod")

result = executor.invoke(
    {"input": "Analyze this credit application"},
    config={"callbacks": [handler]},
)

This captures: LLM prompts and completions, tool invocations with inputs/outputs, chain-of-thought reasoning steps, total tokens used, latency per step, and the final output — all tagged with your compliance framework references.

Step 2: Define Your Policy Pack

Policy-as-code makes your compliance obligations explicit and machine-checkable. Here is one policy from the EU AI Act pack, for Article 14 (Human Oversight). It is evaluated against decision actions after they complete or fail:

# Excerpt from the EU AI Act pack (EUAI-HR-004)
- slug: euai-human-oversight-flag
  name: Human Oversight Flag
  severity: critical
  enforcement_mode: warn
  applicable_action_types: [decision]
  applicable_statuses: [completed, failed]
  rules:
    - rule_code: EUAI-HR-004a
      rule_type: threshold
      condition:
        field: duration_ms
        operator: less_than
        value: 30000
      regulatory_reference: EU AI Act Article 14(1)

Step 3: Capture Tool-Level Evidence

LangChain agents are only as auditable as their tool invocations. Ensure every tool your agent uses generates audit evidence:

from agentgovern import track_action, ActionType, ActionStatus

def lookup_credit_bureau(applicant_id: str):
    result = credit_bureau_api.lookup(applicant_id)
    track_action(
        agent_external_id="credit-scoring-agent-prod",
        action_type=ActionType.DATA_ACCESS,
        action_name="credit_bureau_lookup",
        status=ActionStatus.COMPLETED,
        input_payload={"applicant_id": applicant_id},
        output_payload={"score_band": result.band},
    )
    return result

Tools invoked through an instrumented LangChain agent are captured automatically. Use track_action for work that happens outside the agent loop.

Step 4: Set Up Continuous Drift Monitoring

A one-time audit is not enough. EU AI Act Article 9 requires ongoing risk management. Drift monitoring watches for behavioral changes over time. AgentGovern does not do drift monitoring yet; it is on the roadmap. The metrics below are ones to track yourself, from the action history AgentGovern records.

Key metrics to monitor for LangChain agents:

Step 5: Generate Your Audit Report

With comprehensive instrumentation in place, EU AI Act conformity reports are generated from the captured evidence in the AgentGovern dashboard, over a date range you choose. The SDK does not expose a reporting API.

Common Audit Failures (and How to Avoid Them)

“We can’t reproduce what the agent did” — Fix: Use deterministic logging with full prompt capture, not just final outputs.

“We don’t know if the agent accessed data it shouldn’t have” — Fix: Instrument at the tool level, not just the agent level.

“Our logs are in LangSmith but auditors can’t access it” — Fix: Use compliance-grade logging with export capabilities designed for regulatory submission.

“We have logs but no policy mapping” — Fix: Tag every logged event with the applicable regulatory provision.

LangGraph Support

If you’re using LangGraph for stateful, multi-agent workflows, the same principles apply with graph-aware instrumentation:

from agentgovern import init, instrument_langgraph

init(api_key="ag_your_api_key", environment="production")
handler = instrument_langgraph(agent_external_id="credit-scoring-graph-prod")

result = graph.invoke(state, config={"callbacks": [handler]})

State transitions in LangGraph — including conditional edges and checkpointing — are all captured and mapped to your compliance framework.

Need help auditing your specific LangChain setup? Talk to our compliance engineers.

← Back to blog