Skip to main content

Article 12 Record-Keeping for HR Tech AI — EU AI Act

How Article 12 of the EU AI Act applies to HR technology: automatic event logging, retention, provider and employer roles, dates and fines.

Providers of high-risk HR-technology AI must design systems that record events automatically (logs) (Article 12).

HR technology is not a category in the Act. Systems in Annex III point 4 (employment and workers’ management), for example CV filters, are high-risk (Article 6(2)). An exception exists (Article 6(3)). The rules apply from 2 December 2027 (Article 113(c)(i)). Fines reach EUR 15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: list which events your logging must capture for the purposes in Article 12(2).

Article 12 has no HR-specific rule: logging is a design duty of the provider

Article 12 asks for a capability in the system. It sets no log format and no field list for HR systems.

  • Automatic recording over the lifetime

    High-risk systems must technically allow for the automatic recording of events (logs) over the lifetime of the system (Article 12(1)).

  • Three purposes

    The logging capabilities must record events relevant for three purposes, at a level of traceability that fits the intended purpose (Article 12(2)). The first is identifying situations that may present a risk within the meaning of Article 79(1) or a substantial modification. The second is facilitating post-market monitoring (Article 72). The third is monitoring the operation of the system (Article 26(5)).

  • A fixed minimum only for remote biometric identification

    Article 12(3) sets minimum log content only for systems under Annex III point 1(a), remote biometric identification. It does not apply to systems under Annex III point 4.

  • Retention: at least six months

    Providers keep the logs under their control for a period appropriate to the intended purpose, of at least six months (Article 19(1)). Deployers (the organisations that use the system) do the same for the logs under their control (Article 26(6)). Union or national law, in particular on the protection of personal data, can provide otherwise.

  • Instructions describe the log mechanisms

    Where relevant, the instructions for use describe the mechanisms that allow deployers to collect, store and interpret the logs (Article 13(3)(f)).

HR technology can be high-risk through Annex III point 4

The Act has no category called HR technology. What counts is the use listed in Annex III point 4, “Employment, workers’ management and access to self-employment”.

  • Point 4(a): recruitment and selection

    AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates.

  • Point 4(b): work-related relationships

    AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics, or to monitor and evaluate the performance and behaviour of persons in such relationships.

  • An exception exists, and it never covers profiling

    An Annex III system is not high-risk if it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. The derogation applies only where any one of the four conditions in Article 6(3), points (a) to (d), is fulfilled. A system that performs profiling of natural persons is always high-risk. A provider that considers its system not high-risk must document the assessment before placing it on the market or putting it into service (Article 6(4)). The Commission was to provide guidelines with practical examples by 2 February 2026 (Article 6(5)).

  • The software developer is the provider, the employer using it is a deployer

    The provider is the natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark (Article 3, point 3). Providers of high-risk systems must ensure that the systems comply with the requirements of Section 2, Articles 8 to 15 (Article 16(a)). A deployer is a natural or legal person, public authority, agency or other body using an AI system under its authority, except in the course of a personal non-professional activity (Article 3, point 4). An employer that uses an HR system is a deployer with the duties of Article 26. A deployer becomes a provider if it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to it, or changes the intended purpose of a system so that it becomes high-risk (Article 25(1)).

  • Dates, older systems and what the Act excludes

    The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A high-risk system placed on the market or put into service before that date is covered only if it is subject to significant changes in its design as from that date. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)). The Act does not apply to areas outside the scope of Union law (Article 2(3)), to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before a system is placed on the market or put into service; testing in real-world conditions is not excluded (Article 2(8)). It does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Article 2(10)). AI systems under free and open-source licences are outside it unless placed on the market or put into service as high-risk systems or as systems under Article 5 or 50 (Article 2(12)).

  • Logs about candidates and workers hold personal data

    The Act leaves data protection law in place (Article 2(7)). The six-month minimum applies unless Union or national law, in particular on the protection of personal data, provides otherwise (Articles 19(1) and 26(6)).

What the Act leaves open

  • No HR log fields and no retention period beyond the minimum

    The Act lists no log fields for HR systems. It sets no retention period beyond the six-month minimum for logs (Articles 19(1) and 26(6)). Periods set by other law are questions for that law; this page states none.

  • The Act names no standard; harmonised standards and guidelines exist

    The Act itself names no standard for logging. It asks for the generally acknowledged state of the art to be taken into account (Article 8(1)). High-risk systems in conformity with harmonised standards whose references are published in the Official Journal are presumed to conform with the Section 2 requirements those standards cover (Article 40(1)). The Commission is to develop guidelines on the application of the requirements in Articles 8 to 15 (Article 96(1)(a)). Any other standard a provider uses is a voluntary design choice.

Example: events a hiring tool could log

These are examples, not requirements.

  • Example: use events (Article 12(2)(a) and (b))

    The time of each use, the model version and a reference to the input, so that a later review can tell which version produced a ranking.

  • Example: human decisions (Article 12(2)(c))

    Whether the recruiter accepted, changed or overrode the output, which supports monitoring the operation of the system (Article 26(5)).

Common questions: retention, who builds the logging, dates and fines

Does an employer have to keep the logs, and for how long?

Deployers keep the logs the system generates to the extent they are under their control, for a period appropriate to the intended purpose of the system, of at least six months, unless Union or national law, in particular on the protection of personal data, provides otherwise (Article 26(6)).

Does the employer have to build the logging?

No. The provider must design the system so that it technically allows for the automatic recording of events (Articles 12(1) and 16(a)). The employer, as deployer, keeps the logs the system generates to the extent they are under its control (Article 26(6)).

When do the Article 12 rules apply to HR technology?

The requirements for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A high-risk system placed on the market or put into service before that date is covered only if it is subject to significant changes in its design as from that date. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

What are the fines, and are they lower for small companies?

Article 16 sets the provider duties, which include compliance with Article 12, and Article 26 the deployer duties. Breaches of either are fined up to EUR 15 million or, for an undertaking, 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs, including start-ups, and small mid-cap enterprises (Article 3(14b)), each fine is up to the lower of the two amounts (Article 99(6) and (6a)). The turnover percentage applies if the offender is an undertaking (Article 99(4)). Each Member State lays down to what extent administrative fines may be imposed on public authorities and bodies established in that Member State (Article 99(8)).

Read next: the article for all sectors, the HR technology overview and related guides

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.