Article 12 concerns the recording capabilities of high-risk AI systems. Turn that obligation into a workflow-specific logging plan, while keeping statutory requirements separate from the engineering choices used to meet them.
What Article 12 Actually Says
Article 12 requires high-risk systems to support automatic event recording over their lifetime, with traceability appropriate to their intended purpose. Relevant events support risk identification, post-market monitoring and operational monitoring. The specific usage-period, reference-database, matched-input and verifier-identity fields in Article 12(3) apply to the remote biometric identification systems in Annex III point 1(a).
Who Article 12 Applies To
Determine applicability from the actor, intended purpose and territorial scope in Article 2. Processing information about an EU resident alone does not establish every AI Act obligation. Document the assessment and the provider or deployer role.
Article 12 Logging Checklist for Engineering Teams
Use the following engineering checks to implement the applicable recording duties. Assign an owner and a test to each check instead of treating a completed checklist as certification.
Structural requirements
Ensure the recording path covers the relevant system operation, including failures and interruptions. Test lost connectivity, unavailable storage and changes in model or tool versions so silent gaps become visible.
Content requirements
Choose event context that supports the intended purpose and the relevant monitoring task. Verify that a reviewer can link an output to the necessary source and system version without exposing unrelated personal information.
Integrity requirements
Choose integrity controls from the threat model and applicable obligations. Restricted access, retention controls, append-only storage and cryptographic verification can help. Article 12 does not prescribe Ed25519, hash chaining or a separate storage service. Signatures help detect changes only when verification and key management work; they do not prove that the original record was truthful or that an audit will pass.
Operational requirements
Name the people responsible for monitoring, access, retention and restoring records. Test retrieval for a review request and document how storage failures are reported and investigated.
Separate documentation from logs. Article 18 sets a period ending ten years after market placement or putting into service for specified provider documentation. Articles 19(1) and 26(6) address automatically generated logs under the provider's or deployer's control: retain them for a period appropriate to the system's purpose, at least six months, unless applicable Union or national law provides otherwise, particularly data-protection law. Financial-sector documentation rules may also apply; there is no universal five-to-seven-year rule for all agent logs.
Common Gaps Engineering Teams Miss
Check for records that cannot be joined across tools, clocks that disagree and retention settings that silently delete needed evidence. Also test that the logging process does not copy unnecessary personal data into a less protected system.
How Article 12 Relates to Other EU AI Act Articles
Use logs alongside technical documentation, oversight records and post-market monitoring. They serve different purposes: a log records an event, while documentation explains the system and its controls. Do not substitute one for the other.
FAQ
Does every system need the biometric fields listed in Article 12(3)? No: those fields concern the specified remote biometric identification systems. Other high-risk systems need recording appropriate to their intended purpose and applicable duties.
Review updated 1 October 2026: the AI Omnibus entered into force on 27 July 2026. The high-risk requirements in Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to the Act's transitional provisions. Other obligations have separate application dates.
EU AI Act: consolidated text, 27 July 2026 | European Commission: AI Omnibus entry into force | GDPR: Regulation (EU) 2016/679