EU AI Act Article 12: Record-Keeping & Logging
Article 12 requires high-risk AI systems to record events automatically. This guide covers what logs must record, how to build them and how long to keep them.
Providers of high-risk AI systems must build them to record events automatically (logs) over their whole lifetime (Article 12).
This applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) to systems placed on the EU market or put into service. Providers and deployers (organisations that use the system) must keep the logs under their control for at least six months (Articles 19 and 26(6)). Other law can set another period. Fines reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: list the events to record.
Logs must serve three purposes, and one system type has a fixed minimum
Article 12(2) sets no field list. It requires logging of events relevant for three purposes, at a level of traceability that fits the system’s intended purpose.
Identify risks and substantial modifications
Log events that show when the system may present a risk within the meaning of Article 79(1), or when it undergoes a substantial modification (Article 12(2)(a)).
Support post-market monitoring
Log events the provider needs to monitor the system after market placement (Article 12(2)(b), Article 72).
Support deployer monitoring
Log events that let deployers monitor the operation of the system (Article 12(2)(c), Article 26(5)).
Minimum content for remote biometric identification
Remote biometric identification systems under Annex III point 1(a), where their use is permitted under Union or national law, must log at least the following (Article 12(3)). Systems used only to confirm that a person is who they claim to be are not included. The minimum is the period of each use, the reference database checked, the input data that led to a match and the people who verified the results.
The Act sets no log format; these practices fit its goals
Article 12 names no log format or storage technology. The three practices below are common engineering choices.
Structured fields
Write each event as JSON with the same fields every time: timestamp, event type, system ID, trace ID and a summary of input and output.
Append-only storage
Store logs where nobody can alter them afterwards, for example with S3 Object Lock. Neither Article 12 nor Article 19 requires this; it protects the logs as evidence.
Trace IDs
Put the same trace ID in every log entry of a request, so you can follow one event through the whole AI pipeline.
Providers and deployers keep logs for at least six months, unless other law provides otherwise
The six-month minimum applies to logs under your control. Union or national law, in particular data protection law, can set another period. Financial institutions subject to Union financial services law on internal governance, arrangements or processes keep logs as part of the documentation they keep under that law (Articles 19(2) and 26(6)).
Keep the logs your high-risk system generates, to the extent they are under your control, for a period that fits the intended purpose. The period is at least six months, unless Union or national law provides otherwise (Article 19(1)).
Keep the logs the system generates, to the extent they are under your control, for a period that fits the intended purpose. The period is at least six months, unless Union or national law provides otherwise (Article 26(6)).
Article 12 applies to high-risk AI systems only
A system is high-risk if it falls into an Annex III area, unless an Article 6(3) exemption applies. A system that profiles natural persons is always high-risk. A system is also high-risk if it is, or is a safety component of, an Annex I product needing third-party conformity assessment (Article 6). Providers are covered when they place a system on the EU market or put it into service in the EU, wherever they are established (Article 2(1)(a)). Providers and deployers in a third country are also covered when the system’s output is used in the EU (Article 2(1)(c)). High-risk systems tied to products under the Annex I Section B laws are outside Article 12 (Article 2(2)). For Annex I Section A products, some requirements may be limited (Article 2(13)). This concerns Articles 9 to 15 and 17 to 25, where sector law gives equivalent or higher protection. Delegated acts due by 2 August 2027 will specify which. The Act excludes military, defence and national security uses, systems developed solely for scientific research, and research and testing before market placement (Article 2(3), (6) and (8)). Systems already on the market or in service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
Common questions: existing logs, GDPR and fines
Can I use my existing logging system?
Yes, if it meets Article 12. The high-risk system must technically allow automatic recording of events for the three purposes in Article 12(2). Logs under your control must be kept at least six months, unless Union or national law provides otherwise. Check your current logs against those three purposes and the retention period.
Does Article 12 conflict with GDPR data minimisation?
Article 12 names no personal data fields, except the identification of the people who verify results in remote biometric identification systems (Article 12(3)(d)). The retention duty yields to data protection law where that law provides otherwise (Articles 19(1) and 26(6)). Where the purpose allows, log identifiers and event metadata instead of raw personal data. Which personal data a given log may hold is a GDPR question for your data protection officer or counsel.
What are the fines, and is the cap lower for SMEs?
Fines for providers (Article 16) and deployers (Article 26) reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, and small mid-caps, the cap is the lower of the two amounts (Article 99(6) and (6a)). Member States lay down the penalty rules (Article 99(1)).
Read next: post-market monitoring, deployer duties and audit trails
Article 72: Post-Market Monitoring
Providers monitor their high-risk systems after launch; Article 12 logs support that monitoring.
Article 26: Deployer Obligations
Deployers monitor the system, keep logs for at least six months and report serious incidents.
AI Act Audit Trail Requirements
Technical requirements for tamper-resistant audit trails.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.