How long must law enforcement AI logs be retained?

The AI Act requires a 6-month minimum. Law enforcement records must be retained for the duration of related investigations, prosecutions, and appeal periods. For serious offences, this can extend to decades. National criminal record retention laws govern the maximum period. Retention policies must account for the possibility that AI logs become relevant evidence long after the original decision.

What must be included in AI audit logs for law enforcement?

At minimum: timestamp (synchronised clock), model version and configuration, input data references with provenance, decision output and confidence score, contributing factors, officer identity and decision, and chain of custody metadata. For database queries, additionally log which databases were searched, query parameters, and results returned.

Can law enforcement AI logs be used as court evidence?

Yes, and they frequently will be — both by the prosecution (to establish what the AI found) and by the defence (to challenge AI reliability or demonstrate procedural failures). Logs must meet evidence admissibility standards: authenticity, integrity, reliability, and relevance. Tamper-evident storage and unbroken chain of custody are prerequisites for admissibility.

What is the compliance deadline for law enforcement AI record-keeping?

High-risk law enforcement AI systems must comply with Article 12 by 2 December 2027. Prohibited AI practices (e.g., untargeted scraping of facial images, emotion recognition in law enforcement) have been banned since February 2, 2025. Regulation (EU) 2026/1744 (adopted 8 July 2026, in force since 27 July 2026) has since extended this deadline to 2 December 2027 for Annex III systems (2 August 2028 for Annex I systems).

Article 12 Record-Keeping for Law Enforcement AI — EU AI Act

How EU AI Act Article 12 record-keeping applies to law enforcement AI — court-admissible audit trails, chain of custody, evidence standards.

Published April 2, 2026

Article 12 of the EU AI Act requires high-risk AI systems to automatically record events relevant for identifying risks and ensuring traceability. Law enforcement AI — classified as high-risk under Annex III, Sections 6–8 when used for risk assessment of natural persons, polygraph-like tools, evaluation of evidence reliability, or crime analytics — must maintain court-admissible audit trails that can withstand legal scrutiny, establish chain of custody for digital evidence, and support independent oversight body audits.

Law enforcement AI logging carries the highest legal stakes of any sector: these logs may determine whether evidence is admissible in criminal proceedings, whether a suspect's rights were respected, and whether AI-assisted decisions can withstand judicial review. Unlike other sectors, law enforcement AI logs are not publicly accessible but must be auditable by independent oversight bodies and data protection authorities. This page explains the specific record-keeping obligations, evidence standards, and code-level violations Scanara detects.

What Must Be Logged for Law Enforcement AI Systems?

AI Decision Outputs and Rationale

Every AI-generated risk assessment, evidence evaluation, or predictive output must be logged with: timestamp, model version, the decision output, confidence score, and the key factors that drove the output. These logs must be detailed enough to explain the AI's role in any subsequent law enforcement action.

Input Data References and Provenance

Log references to all input data used for each decision: database queries, intelligence feeds, sensor data sources, and any pre-processing applied. Chain of custody begins at data ingestion — the log must establish where data came from and how it was transformed before reaching the AI system.

Officer Decision and Action Records

Log which officer reviewed the AI output, what action they took (investigate, escalate, dismiss), and whether they deviated from the AI recommendation. Article 14 requires meaningful human oversight — logs must demonstrate that officers made independent decisions rather than blindly following AI outputs.

Reference Database and Watchlist Queries

Article 12(1) requires logging the reference database against which input data was checked. For law enforcement, log every database query: which databases were searched, the query parameters, results returned, and the database version. Watchlist queries are particularly sensitive and require enhanced logging.

System Access and Query Logs

Log every user who accessed the AI system, what queries they ran, and what outputs they received. Access logging is essential for detecting misuse (unauthorised surveillance, fishing expeditions) and for responding to FOIA/transparency requests about system usage patterns.

Chain of Custody Metadata

For AI outputs that may become evidence in criminal proceedings, log chain of custody metadata: who generated the output, when, how it was stored, who accessed it subsequently, and whether the output was modified. An unbroken chain from AI system to courtroom is required for evidence admissibility.

Key Record-Keeping Obligations for Law Enforcement

Law enforcement AI logging must meet the highest evidentiary standards of any sector. Logs are not just compliance documentation — they are potential evidence in criminal proceedings and judicial reviews of law enforcement actions. The logging architecture must be designed with courtroom admissibility as a primary requirement.

Court-Admissible Audit Trails

AI decision logs used in criminal proceedings must meet evidence admissibility standards: tamper-evident storage (cryptographic hashing or write-once media), precise timestamps from synchronised clocks, unbroken chain of custody from generation to courtroom presentation, and sufficient technical context for expert witness testimony.

Non-Public but Auditable

Law enforcement AI logs are not publicly accessible — but Article 26(5) requires that they be available for audit by the market surveillance authority. Independent oversight bodies, data protection authorities, and courts must be able to access and examine AI decision logs. Design access controls for tiered auditability rather than public transparency.

FOIA and Transparency Requests

Public records laws may require disclosure of aggregate AI system usage statistics, subject to law enforcement exemptions for ongoing investigations. Logs must be structured to support generating aggregate reports (number of queries, decision distribution, demographic patterns) without exposing individual case details.

Retention: Criminal Proceeding Timelines

The AI Act requires a 6-month minimum. Law enforcement records must typically be retained for the duration of any related investigation, prosecution, and appeal period. For serious offences, this can extend to decades. Retention policies must account for the possibility that AI decision logs become relevant evidence years after the original decision.

Regulatory Overlaps

Law enforcement AI record-keeping operates under a distinct regulatory framework that includes the Law Enforcement Directive (replacing GDPR for police processing), national criminal procedure codes, and international cooperation requirements. Article 12 compliance must account for these sector-specific obligations.

Law Enforcement Directive (LED)

Directive (EU) 2016/680 governs processing of personal data by law enforcement authorities. The LED requires logging of collection, alteration, consultation, disclosure, combination, and erasure of personal data. AI system logs under Article 12 must integrate with LED Article 25 logging requirements, creating a unified audit trail for data processing operations.

National Criminal Procedure Codes

Each EU member state's criminal procedure code sets standards for evidence admissibility. AI decision logs that may be used in criminal proceedings must meet these national standards, which vary in their requirements for authentication, chain of custody documentation, and expert witness presentation.

Europol Data Protection Regime

For AI systems used in cross-border law enforcement cooperation, the Europol Regulation imposes specific data processing and logging requirements. AI decision logs shared across Europol channels must comply with Europol's data quality standards and access logging requirements in addition to Article 12.

Court Evidence Rules

Digital evidence standards vary across EU member states but generally require: authenticity (the log is what it purports to be), integrity (the log has not been altered), reliability (the system that generated it is trustworthy), and relevance (the log relates to the matter at issue). AI system logging infrastructure must support all four elements.

Common Violations Scanara Detects

print() Logging Instead of Structured JSON

Law enforcement AI decision code using print statements or unstructured text logging. Court-admissible audit trails require structured, machine-parseable logs that can be reliably queried, verified, and presented as evidence. Unstructured text fails admissibility standards.

Missing Model Version in Decision Events

AI risk assessment or evidence evaluation endpoints that log outputs without recording the model version, configuration, or training data version. Defence counsel will challenge AI evidence if the exact system state at decision time cannot be established from logs.

Logs Written to Local Disk Without Retention

Writing AI decision logs to ephemeral storage without durable, tamper-evident retention. Law enforcement AI logs may be needed years or decades after the original decision for appeal proceedings or cold case reviews. Ephemeral storage is fundamentally incompatible with criminal justice timelines.

No Chain of Custody Metadata

AI outputs stored without chain of custody logging: who generated the output, who accessed it, whether it was modified or copied, and how it was transferred. Without unbroken chain of custody, AI-generated evidence may be ruled inadmissible in criminal proceedings.

Article 12 Compliance Checklist for Law Enforcement

Art. 12(1)

Log Every AI-Assisted Law Enforcement Decision

Generate structured log events for every risk assessment, evidence evaluation, crime analytic output, and database query. Include timestamp, model version, input references, output, and contributing factors.

Art. 12(4)

Record Officer Decisions and Actions

Log the identity of officers who reviewed AI outputs, their decision, and whether they deviated from the AI recommendation. Demonstrate meaningful human oversight in every AI-assisted law enforcement action.

Evidence

Maintain Court-Admissible Chain of Custody

Use tamper-evident storage with cryptographic hashing. Maintain unbroken chain of custody from AI output generation through storage, access, and courtroom presentation. Log all access to AI decision records.

LED

Integrate With LED Article 25 Logging

Ensure AI system logs satisfy Law Enforcement Directive logging requirements for personal data processing. Create a unified audit trail covering both AI decision logging and LED data processing records.

Oversight

Enable Independent Oversight Access

Design tiered access controls allowing market surveillance authorities, data protection authorities, and independent oversight bodies to audit AI decision logs without compromising ongoing investigations.

Frequently Asked Questions

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.