Skip to main content

Article 12 for Fintech AI: Record-Keeping and Logs

How Article 12 (record-keeping) applies to credit-scoring and insurance AI: logging by design, who keeps the logs, the financial-institution rule, dates, fines and what the Act leaves open.

Providers of credit-scoring and life or health insurance AI systems must design them to log events automatically (Article 12).

These are high-risk uses under Annex III, points 5(b) and 5(c); fraud detection is excluded from point 5(b). The duty applies from 2 December 2027, unless the Article 6(3) exception applies. Fines can reach up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: list the events your system must record. Providers and deployers then keep the logs (Article 19, Article 26(6)).

Article 12 requires logging by design, not a retention period

Article 12 sets a design duty for the provider. Keeping the logs is a separate duty, shown in the scope rows below.

  • Art. 12(1)
    Automatic recording of events over the lifetime

    High-risk AI systems must technically allow for the automatic recording of events (logs) over the lifetime of the system.

  • Art. 12(2)
    Traceability appropriate to the intended purpose

    The logging capabilities must ensure a level of traceability of the system’s functioning that is appropriate to its intended purpose. They must enable the recording of events relevant for three purposes. The first is identifying situations that may result in a risk within the meaning of Article 79(1) or in a substantial modification. The second is facilitating post-market monitoring (Article 72). The third is monitoring the operation of the system (Article 26(5)).

  • Art. 12(3)
    Minimum log content: remote biometric identification only

    Article 12(3) lists minimum log content for the high-risk systems in point 1(a) of Annex III (remote biometric identification). It does not apply to credit-scoring or insurance systems, for which the Act names no minimum log fields.

Which fintech AI must meet Article 12 and who keeps the logs

Article 12 applies to high-risk AI systems only. The rows below show where fintech AI becomes high-risk, and who keeps the logs.

  • Fintech is not a category in the Act

    The Act has no fintech category. This site uses the word for AI that reaches the Act through two uses in Annex III, point 5. Point 5(b) covers AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score. It makes an exception for AI systems used for the purpose of detecting financial fraud. Point 5(c) covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Point 5 does not name fraud detection, anti-money-laundering or know-your-customer checks, algorithmic trading, robo-advice, non-life insurance, claims handling or credit decisions about legal persons. A system for one of these uses is high-risk only if another point of Annex III or Annex I covers it.

  • Article 6(3) can take a system out of Annex III

    A system under point 5(b) or 5(c) is high-risk under Article 6(2). Under Article 6(3) it is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights. That includes not materially influencing the outcome of decision making. The Act applies this exception where any of the following conditions is fulfilled (Article 6(3), points (a) to (d)). The system is intended to perform a narrow procedural task. Or it is intended to improve the result of a previously completed human activity. Or it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review. Or it is intended to perform a preparatory task to an assessment relevant for the use cases listed in Annex III. How these conditions combine with the significant-risk test is a question for counsel. The system is always high-risk where it performs profiling of natural persons. Profiling is defined by Article 4(4) GDPR (Article 3(52)). Whether a given scoring or pricing system performs it is also a question for counsel. A provider that relies on the exception documents its assessment before the system is placed on the market or put into service. It must also register the system (Article 6(4), Article 49(2)).

  • Provider and deployer

    The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)). Putting into service includes supply for the provider’s own use (Article 3(11)). A bank or insurer that develops a system and puts it into service under its own name is therefore a provider. A bank or insurer that uses a system under its authority is a deployer (Article 3(4)). A deployer becomes the provider in three cases. It puts its name or trademark on a high-risk system already on the market, without prejudice to contractual arrangements stipulating that the obligations are otherwise allocated. It makes a substantial modification to such a system that leaves it high-risk. Or it changes the intended purpose of a non-high-risk system so that it becomes high-risk (Article 25(1)). The provider that initially placed the system on the market or put it into service is then no longer considered the provider of that specific system, and must closely cooperate with the new provider (Article 25(2)). This does not apply where the initial provider clearly specified that its system is not to be changed into a high-risk AI system.

  • Providers keep the logs under their control

    Providers must keep the logs automatically generated by their high-risk systems, to the extent the logs are under their control (Article 19(1)). Without prejudice to applicable Union or national law, the period must be appropriate to the intended purpose and at least six months. It can be different if Union or national law, in particular on the protection of personal data, provides otherwise.

  • Deployers keep the logs under their control

    Deployers must keep the logs automatically generated by the system, to the extent the logs are under their control (Article 26(6)). The period must be appropriate to the intended purpose and at least six months. It can be different if applicable Union or national law, in particular on the protection of personal data, provides otherwise.

  • Financial institutions: logs form part of their financial-law documentation

    This applies to providers that are financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law. They must maintain the logs as part of the documentation kept under that law (Article 19(2)). Deployers that are such financial institutions do the same (Article 26(6), second subparagraph). The Act names no specific financial services law.

  • Dates

    The requirements for these Annex III uses apply from 2 December 2027 (Article 113, third paragraph, point (c)(i)). A system placed on the market or put into service before that date is covered only if its design changes significantly afterwards. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

  • Fines

    Providers must ensure that their high-risk systems meet the requirements of Section 2 of Chapter III, which includes Articles 9 to 15 (Article 16, point (a)). A breach of the provider obligations in Article 16 or of the deployer obligations in Article 26 can be fined. The fine is up to EUR 15 million or, for an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(4), points (a) and (e)). For SMEs, including start-ups, each fine is up to whichever of the two is lower (Article 99(6)). The same applies to small mid-cap enterprises (Article 3(14b), Article 99(6a)). Each Member State lays down rules on to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).

  • Reach and limits of the Act

    The Act applies to providers and deployers established or located in a third country where the output produced by the AI system is used in the Union (Article 2(1), point (c)). It does not apply to areas outside the scope of Union law, and it does not affect the competences of the Member States concerning national security (Article 2(3)). The Act does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)). It does not apply to research, testing or development activity before a system is placed on the market or put into service. Testing in real-world conditions is not covered by that exclusion (Article 2(8)). AI systems released under free and open-source licences are outside the Act. That exclusion does not apply if they are placed on the market or put into service as high-risk AI systems, or if they fall under Article 5 or 50 (Article 2(12)).

What the Act leaves open for fintech

  • No fintech log fields or retention period

    Beyond “at least six months, unless provided otherwise”, the Act names no log fields, format or retention period for credit scoring or insurance pricing (Article 19(1), Article 26(6)). Other Union or national law may provide otherwise. The Act itself names no harmonised standard. High-risk systems that conform to harmonised standards published in the Official Journal are presumed to conform to the requirements of Section 2, to the extent those standards cover them (Article 40(1)). The Commission is to develop guidelines on the practical application of the requirements and obligations in Articles 8 to 15, 25 and 26 (Article 96(1), point (a)).

  • Example: what a scoring log could hold

    Example, not an Act requirement: a provider of a credit-scoring system could record, for each scoring run, the model version, a reference to the input data and the output. An unexpected output can then be traced.

  • Example: logs can hold personal data

    Example, not an Act requirement: logs of scoring runs can hold personal data of applicants. A provider could decide with its data-protection counsel which fields to store and for how long. The decision must stay within the six-month minimum and any other applicable law.

Questions about Article 12 in fintech

Who must meet Article 12 for a bank’s credit-scoring system?

The provider designs the system to allow automatic logging (Article 12 and Article 16, point (a)). The bank, as deployer, keeps the logs under its control (Article 26(6)). A bank that develops the system and puts it into service under its own name is the provider (Article 3(3) and (11)).

How long must a lender keep AI logs?

Providers and deployers must keep the logs under their control for a period appropriate to the intended purpose of at least six months, unless Union or national law provides otherwise (Articles 19(1) and 26(6)). The Act names no longer period for credit scoring or insurance.

Do banks keep AI logs separately from their other records?

Financial institutions subject to internal governance requirements under Union financial services law maintain the logs as part of the documentation kept under that law (Articles 19(2) and 26(6), second subparagraph). The Act does not say which law or which records.

Related pages

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.