Record-Keeping Obligations Under Article 12 AI Act

Article 12 requires high-risk AI systems to have automatic logging capabilities that capture events throughout the entire lifecycle. Records serve traceability, risk detection, and post-market surveillance. They must be implemented by default and function without external modification.

Automatic logging must capture at minimum: usage periods (start and end timestamps), input data leading to matches, reference databases used, and identity of verifying persons. Biometric identification systems under Annex III point 1(a) face enhanced logging requirements.

Retention periods differ by role: providers must retain technical documentation and quality management records for at least 10 years. Deployers must store automatically generated logs for at least 6 months under Article 26(6). Sector-specific regulations may require longer periods for certain high-risk systems.

Records serve three core functions: risk detection (identifying events indicating emerging risks), post-market monitoring under Article 72 (assessing system behaviour after deployment), and operational oversight under Article 26(5) (facilitating monitoring by deployers and authorities).

The final draft ISO/IEC FDIS 24970 (as of May 2026) standardises AI system logging and helps providers integrate Article 12 into development and design processes. Additionally, EN 18229‑1 defines requirements for internal logging mechanisms. The European Commission is developing harmonised standards that will serve as presumption of conformity with logging requirements.

AI logs may contain personal data subject to GDPR. Storing records must be compatible with data protection principles, particularly data minimisation and purpose limitation. An integrated logging strategy addressing both the AI Act and GDPR frameworks is essential for compliance.

The Digital Omnibus on AI, adopted in June 2026, moved the record-keeping obligations for standalone high-risk AI systems under Annex III from 2 August 2026 to 2 December 2027. For high-risk AI embedded in products covered by Annex I product-safety law, the date is 2 August 2028. The Article 50 transparency obligations were not deferred and have applied since 2 August 2026. Providers should still build logging into development now, because retrofitting existing systems is significantly more complex and costly.