Record-keeping and logging: what does Article 12 of the AI Act require?

Short answer: Article 12 of the AI Act requires providers to build high-risk AI systems so that they automatically record events (logs) over their lifetime. Those logs must make it possible to identify risky situations, monitor the system after it is placed on the market, and reconstruct its operation after the fact. Logging is not an optional audit feature but a design obligation.

Why logging is mandatory

A high-risk system may perform differently in practice than in testing. Logs provide the objective trail to see that: they make it possible to detect situations that may lead to a risk or a substantial modification, to monitor the system (post-market monitoring), and to investigate exactly what happened in an incident. Without logs, after-the-fact human oversight is blind.

What the logs must contain at minimum

Logging capabilities must be appropriate to the intended purpose of the system. For certain systems — such as remote biometric identification — Article 12 names specifically:

• the period of each use (start and end time, date);
• the reference database against which input data were checked;
• the input data for which the search produced a match;
• the identification of the persons involved in verifying the results (see the four-eyes principle in Article 14).

For other high-risk systems the general standard applies: record what is needed to support risk identification, monitoring and traceability.

Keeping, protecting and using

The provider builds in the logging function; the deployer then keeps the generated logs, insofar as they are under its control. The AI Act indicates a benchmark of at least six months, unless other rules (for example data protection) require otherwise. Note: logs may contain personal data, so the GDPR applies in full — minimise what you record, secure storage and govern access.

What to do

• Decide which events to log based on the intended purpose and risks of the system.
• Capture timestamps, input and relevant decision points so that a use can be reconstructed.
• Set a retention period (at least six months, or longer where the law requires) and automate clean-up afterwards.
• Secure the logs against tampering and unauthorised access; treat them as sensitive data.
• Describe the logging function in the instructions for use so the deployer knows what to retain.
• Embed logging in your AI governance framework and follow the timeline of obligations.

Logging is a fixed requirement in the overview of high-risk obligations and is checked in the conformity assessment and CE marking. What you do not record, you cannot later prove.