Article 12 requires high-risk AI systems to technically support automatic recording of events over their lifetime. Providers build the capability, and under Article 26 deployers keep the logs under their control for at least six months unless other law requires longer. The purpose is traceability: spotting risk, monitoring after market release and supervising operation.
What the law says about purpose
The logging capability must help with three things:
- Identifying situations that may present a risk, or follow a substantial modification.
- Supporting post-market monitoring under Article 72.
- Monitoring operation by deployers as described in Article 26(5).
Article 12 does not give a general field list. It does set minimums for remote biometric identification systems in Annex III point 1(a): start and end time of each use, the reference database checked, the input data that led to a match, and the identity of the people who verified results under Article 14(5).
Provider and deployer split
Providers must design logging in. Deployers must keep the logs that are under their control for at least six months. That means a provider who stores logs on its side and a deployer who holds an export both have a retention question. Settle in the contract who holds what.
Designing a useful log
Because the Act leaves the fields to the provider and the use case, think about what you would need to reconstruct a decision:
- When the system ran and for which workflow.
- Which version of model, configuration and prompt or rules was active.
- A reference to the input, stored in a way that respects data protection law.
- The output and any confidence or score.
- Whether a human reviewed, overrode or stopped it, and who.
- Errors and unusual states.
These are design suggestions, not text from the Act.
Tension with privacy
Logs can hold personal data. Minimise what you store, use references where possible, restrict access and set retention deliberately. Six months is a floor for deployers, not an instruction to keep everything forever.
Make logs tamper evident
If a log can be edited quietly, it will not help in a dispute. Write logs to storage with restricted write access, record changes to settings, and monitor the logging pipeline itself so gaps are noticed.
Test it before you need it
Pick a past decision and try to reconstruct it from logs alone within a day. If you cannot, fix the schema. Do this before the 2 December 2027 date for Annex III uses.
Finally, think about who will read the logs. Auditors, incident responders and sometimes affected people's advocates all need different views. Build search and export early, document the schema, and keep a sample query set that answers the usual questions: what happened, which version, who reviewed, and what changed afterwards.
Quick check
Does Article 12 say exactly which fields to log?
Only for remote biometric identification systems. For other systems the provider decides based on purpose and risk.
Who keeps the logs?
Providers build the capability. Deployers keep logs under their control for at least six months.
Sources
Last reviewed: 19 October 2026.
