Can I use existing logging infrastructure?

Yes, but you likely need to extend it. Article 12 requires logging specific AI-related events in a structured, immutable format with defined retention.

Does Article 12 conflict with GDPR data minimization?

This is a tension point. Best practice: log identifiers and metadata rather than raw personal data, implement access controls, and define clear retention policies.

EU AI Act Article 12: Record-Keeping & Structured Logging

How EU AI Act Article 12 record-keeping requirements translate to structured logging and audit trails in your AI systems.

Article 12 of the EU AI Act requires high-risk AI systems to have automatic logging capabilities that record events relevant for identifying risks and ensuring traceability.

For engineering teams, this means structured logging is no longer just a best practice — it is a legal requirement.

What Must Be Logged

System Operation Events

Record the period of each use (start/end times), the reference database against which input data was checked, and the input data for which the search led to a match.

Decision & Output Logs

Log AI system outputs, including confidence scores, classification results, and recommendations.

Human Oversight Actions

Record human review decisions, overrides, approvals, and rejections with timestamps and operator identity.

Anomalies & Incidents

Log anomalous inputs, unexpected outputs, system errors, and performance degradation.

Implementation with Structured Logging

Structured JSON Logging

Use structured logging (JSON format) with consistent schemas. Include timestamp, event type, system ID, trace ID, input/output summary, and confidence scores.

Immutable Audit Trail

Store logs in append-only, tamper-resistant storage. WORM storage like S3 Object Lock ensures logs cannot be altered after the fact.

Correlation & Traceability

Use correlation IDs (trace IDs) that link logs across the entire AI pipeline for end-to-end traceability.

Log Retention Requirements

The EU AI Act specifies minimum retention periods for logs generated by high-risk AI systems.

Minimum 6 months

Providers must retain logs for at least 6 months, unless longer periods are required by applicable law.

As appropriate to purpose

Deployers must keep logs for a period appropriate to the intended purpose, at least 6 months.

Frequently Asked Questions

Related Guides

Article 9: Risk Management

How risk management and record-keeping work together to demonstrate compliance.

AI Act Audit Trail Requirements

Technical requirements for building immutable, inspection-ready audit trails.

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.