Article 12 Record-Keeping for Fintech AI — EU AI Act
How EU AI Act Article 12 record-keeping applies to fintech AI — credit decision logging, supervisory examination trails, CRD IV retention.
Article 12 of the EU AI Act requires high-risk AI systems to automatically record events relevant for identifying risks and ensuring traceability. Fintech AI — classified as high-risk under Annex III, Section 5(b) when used for creditworthiness assessment, credit scoring, or risk assessment in life and health insurance — must produce transaction-level decision logs that can withstand ECB supervisory examination, support adverse action notice generation, and satisfy multi-year regulatory retention requirements.
Financial AI logging is uniquely demanding because every credit decision, fraud flag, or AML alert must be reconstructable for regulatory examination. ECB and national supervisory authorities (BaFin, ACPR, FCA) routinely request access to AI decision logs during on-site inspections. Your logging infrastructure must produce structured, queryable records that include model version, input feature values, and the specific factors that drove each decision. This page explains what must be logged, retention requirements, and code-level violations Scanara detects.
What Must Be Logged for Fintech AI Systems?
Credit Decision Outputs
Every credit decision — approval, denial, pricing tier assignment — must be logged with timestamp, model version, the decision output, and the applicant reference. For loan denials, logs must include the specific factors that contributed to the adverse decision to support required adverse action notices.
Input Feature Values
Log the feature values used for each decision — not raw personal data, but the transformed features the model consumed. When a regulator asks why a specific applicant was denied credit, you must be able to show the input state at inference time, including which features had the greatest influence on the outcome.
Fraud and AML Alert Logs
Every transaction flagged for potential fraud or money laundering must generate a log entry with the alert severity, triggering rules or model scores, and the disposition (escalated, cleared, or blocked). AML alert logs are subject to separate retention requirements under anti-money laundering directives.
Model Version and Calibration State
Each log entry must record the exact model version, feature engineering pipeline version, calibration date, and any threshold parameters. Supervisory teams examining decisions from months ago must be able to determine which model produced each output and whether the model was within its validated operating parameters.
Human Review Decisions
Log whether a credit analyst reviewed the AI recommendation and the final decision taken. For MiFID II suitability assessments, log the advisor identity and whether they deviated from the AI recommendation, including the stated rationale for any override.
System Availability and Fallback Events
Log periods when the AI system was operational, degraded, or unavailable. Record any fallback to manual processing or rule-based systems, including the duration and number of decisions made outside the AI pipeline during outages.
Key Record-Keeping Obligations for Fintech
Financial services AI logging is governed by some of the longest retention periods of any industry. The AI Act’s 6-month minimum is vastly exceeded by sector-specific requirements that mandate 5–10 year retention for credit decision records. Logging infrastructure must be designed for long-term, queryable storage from day one.
Retention: CRD IV Takes Precedence
CRD IV Article 74 requires institutions to maintain internal governance records including credit decision documentation for a minimum of 5 years. For MiFID II suitability records, the retention period is also 5 years. AML records under AMLD5 must be retained for 5 years after the business relationship ends. These periods far exceed the AI Act’s 6-month baseline.
Regulatory Examination Readiness
ECB and national supervisory authorities conduct on-site inspections where they request access to AI decision logs. Logs must be in a structured, queryable format — supervisors will run aggregate analyses on decision patterns, not read individual log files. Plan for bulk export and analytical query capabilities.
Adverse Action Notice Support
When an AI system denies credit, the institution must provide the applicant with the specific reasons. Logs must capture the top contributing factors for each denial at inference time — generating these reasons retroactively from model weights is not sufficient. Log the explanation at decision time.
DORA Logging Requirements
The Digital Operational Resilience Act (DORA) requires financial entities to maintain comprehensive logging of ICT system events. AI decision systems fall within DORA’s scope — logs must include operational performance metrics, incident records, and system availability data alongside decision-level audit trails.
Regulatory Overlaps
Financial AI record-keeping is subject to the densest regulatory overlay of any industry. Article 12 compliance must be integrated with existing prudential supervision, consumer protection, and anti-money laundering frameworks.
EBA AI Act Guidance
The European Banking Authority has issued guidance on AI use in financial services that specifically addresses logging and auditability requirements. EBA guidance recommends decision-level logging with model versioning, input feature capture, and outcome tracking — aligning closely with Article 12 requirements.
CRD IV Article 74 — Internal Governance
CRD IV requires credit institutions to have robust governance arrangements including comprehensive internal audit trails. For AI-driven credit decisions, this means logging must satisfy both AI Act traceability and CRD IV governance documentation requirements. Supervisors expect integrated audit trails covering model risk management and decision outcomes.
MiFID II Article 25 — Suitability Records
MiFID II requires investment firms to maintain records of suitability assessments for 5 years. When AI systems contribute to suitability assessments, the AI decision log must be linked to the suitability record, including the AI recommendation, advisor decision, and any deviation rationale.
PSD2 and AMLD5 — Transaction Monitoring
Payment services and anti-money laundering directives require transaction monitoring logs with specific retention periods. AI systems performing fraud detection or AML screening must log every flagged transaction, the alert disposition, and the investigator’s decision. AMLD5 requires 5-year retention after the business relationship ends.
Common Violations Scanara Detects
print() Logging Instead of Structured JSON
Credit scoring code using print statements or unstructured text logging. Supervisory examination requires bulk analytical queries across millions of decisions — unstructured logs are useless for regulatory inspection and violate Article 12’s traceability requirements.
Missing Model Version in Decision Events
Credit decision endpoints that log the outcome without recording the model version, calibration date, or threshold parameters. When a supervisor reviews decisions from a specific period, they must be able to determine which model produced each decision and whether it was operating within validated parameters.
Logs Written to Local Disk Without Retention
Writing credit decision logs to ephemeral container storage or local disk. CRD IV requires 5-year retention for credit decision records — logs on ephemeral infrastructure will not survive even a single infrastructure rotation, let alone a multi-year supervisory examination period.
No Adverse Action Factors at Decision Time
Logging credit denials without capturing the top contributing factors at inference time. Generating adverse action reasons retroactively from stored model weights is unreliable and may not reflect the actual factors that drove the specific decision. Log the explanation alongside the decision.
Article 12 Compliance Checklist for Fintech
Log Every AI-Driven Financial Decision
Generate structured log events for every credit decision, fraud alert, AML flag, and suitability assessment. Include timestamp, model version, input features, output, and contributing factors.
Enable Supervisory Analytical Queries
Structure logs in a format that supports bulk analytical queries. Supervisory teams will request aggregate analyses of decision patterns, demographic breakdowns, and model performance metrics across time periods.
Configure 5-Year Minimum Retention
Retain AI decision logs for the longer of the AI Act 6-month minimum and applicable financial regulation (CRD IV: 5 years, MiFID II: 5 years, AMLD5: 5 years post-relationship). Use tiered storage with appropriate lifecycle policies.
Record Analyst and Advisor Decisions
Log the identity of credit analysts or advisors who reviewed AI outputs. Record whether they accepted, modified, or overrode the recommendation, including rationale for any override.
Integrate With ICT Operational Logging
Ensure AI decision logs are integrated with your DORA-compliant ICT operational logging framework. Include system availability, performance metrics, and incident records alongside decision-level audit trails.
Frequently Asked Questions
Related Resources
Article 12: Record-Keeping
Full Article 12 requirements across all industries.
Fintech AI — Industry Hub
Complete EU AI Act compliance guide for financial AI systems.
Article 9: Risk Management for Fintech
Risk management system requirements for financial AI.
Article 12: Record-Keeping for HR Tech
Decision logging for employment AI systems.
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.