diff --git a/apps/settings/lib/Controller/AISettingsController.php b/apps/settings/lib/Controller/AISettingsController.php
index 114cbf6151435..512afe9d3fd13 100644
--- a/apps/settings/lib/Controller/AISettingsController.php
+++ b/apps/settings/lib/Controller/AISettingsController.php
@@ -10,23 +10,28 @@
 
 use OCA\Settings\Settings\Admin\ArtificialIntelligence;
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
 use OCP\AppFramework\Http\DataResponse;
+use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IAppConfig;
 use OCP\IRequest;
+use OCP\Log\Audit\CriticalActionPerformedEvent;
 
 class AISettingsController extends Controller {
 
 	public function __construct(
 		$appName,
 		IRequest $request,
+		private string $userId,
 		private IAppConfig $appConfig,
+		private IEventDispatcher $eventDispatcher,
 	) {
 		parent::__construct($appName, $request);
 	}
 
 	/**
-	 * Sets the email settings
+	 * Sets the AI settings
 	 *
 	 * @param array $settings
 	 * @return DataResponse
@@ -38,7 +43,23 @@ public function update($settings) {
 			if (!isset($settings[$key])) {
 				continue;
 			}
-			$this->appConfig->setValueString('core', $key, json_encode($settings[$key]), lazy: in_array($key, \OC\TaskProcessing\Manager::LAZY_CONFIG_KEYS, true));
+			try {
+				$settings[$key] = json_encode($settings[$key], flags: \JSON_THROW_ON_ERROR);
+			} catch (\JsonException) {
+				return new DataResponse(['error' => "Setting value for '$key' must be JSON-compatible"], Http::STATUS_BAD_REQUEST);
+			}
+		}
+		foreach ($keys as $key) {
+			if (!isset($settings[$key])) {
+				continue;
+			}
+			$changed = $this->appConfig->setValueString('core', $key, $settings[$key], lazy: in_array($key, \OC\TaskProcessing\Manager::LAZY_CONFIG_KEYS, true));
+			if ($changed) {
+				$this->eventDispatcher->dispatchTyped(new CriticalActionPerformedEvent(
+					'AI configuration was changed by user %s: %s was set to %s',
+					[$this->userId, $key, $settings[$key]]
+				));
+			}
 		}
 
 		return new DataResponse();