Article 12 requires high-risk AI systems to be designed and developed with capabilities enabling the automatic recording of events, or logs, while the system is operating, appropriate to the intended purpose. The logging capabilities must ensure a level of traceability of the system's functioning that is appropriate to the intended purpose. Article 18 requires the provider to keep documentation for ten years, and Article 19 requires the provider to keep automatically generated logs, to the extent they are under its control, for a period appropriate to the intended purpose, at least six months, unless Union or national law provides otherwise. Deployers must also keep logs under Article 26(6) for the period the deployer controls them, subject to the conditions in that paragraph.
What must a high-risk system log?
Article 12 requires logging capabilities that are appropriate to the intended purpose, and the Act specifies the kinds of events that should be recordable, including the period of each use, the reference database against which input data have been checked, the input data that led to a match, and the identification of the natural persons involved in verification of results. The exact logging design depends on the system: a biometric identification system, a recruitment system, and a critical infrastructure system will log different events, but each must log enough to make its functioning traceable. The design should be specified before release, with the events, the data captured, the format, and the access controls defined, rather than relying on general application logs that were not designed for traceability.
How do logs support human oversight and monitoring?
Logs allow a human overseer to understand what the system did, what it was given, and what it produced, and allow a deployer to monitor operation, detect anomalies, and investigate incidents. Without logs, an overseer cannot verify a result, a deployer cannot monitor drift, and an authority cannot reconstruct an event. The logging design should therefore be linked to the human oversight design in Article 14 and the deployer monitoring duty in Article 26. The overseer should be able to access the relevant logs for the decision under review, in a form that can be understood, without needing to reconstruct the event from unrelated system logs. Access should be controlled, so that logs are available to those who need them for oversight and investigation, and protected from unauthorised access.
For the broader regulatory framework, see provider responsibilities.
What retention periods apply?
Three retention concepts must be kept separate. Documentation under Article 18 is kept for ten years after the system is placed on the market or put into service. Provider logs under Article 19 are kept for a period appropriate to the intended purpose, at least six months, unless Union or national law provides otherwise. Deployer logs under Article 26(6) are kept for a period of at least six months, unless Union or national law provides otherwise, and the deployer must keep logs that are under its control. Data protection law can impose its own retention limits, especially where logs contain personal data, and the retention design must reconcile the AI Act periods with the GDPR principles of storage limitation and data minimisation. The record should state each period, its legal basis, and the deletion process.
How should logs be protected and accessed?
Logs can contain personal data, sensitive information, and commercially sensitive material, and they must be protected accordingly. Access should be role-based, logged itself, and limited to oversight, monitoring, investigation and authority requests. Logs should be stored in a form that preserves integrity, so that a later reviewer can rely on them, and should be protected against alteration and unauthorised deletion. Where logs are shared with a deployer, an importer, a distributor or an authority, the sharing should be recorded, and the recipient's handling duties should be stated. A logging design that captures everything without access control, or that captures too little to reconstruct an event, both fail the traceability purpose, in different ways.
What should a logging specification contain?
A logging specification should name the events recorded, the data fields, the timestamp and system version, the user and overseer identifiers where appropriate, the retention period, the storage location, the access roles, and the deletion process. It should state which events are always logged, which are logged on exception, and which are not logged and why. It should be tested: a test event should be run through the system and the log checked for completeness and intelligibility. The specification should be part of the technical documentation, and the deployer instructions should state which logs the deployer will receive, how to access them, and how long to keep them. Testing should include a simulated incident, to confirm that the logs would support an investigation.
Continue with Article 16 provider duties.
What is beyond this guide?
This guide explains the logging and record-keeping structure in outline. It does not design a logging system for a specific product, does not set retention periods beyond the Act's minimums, and does not resolve conflicts between AI Act retention and data protection retention for a specific data set. Those questions need the system's purpose, the data in the logs, the oversight design, and the applicable data protection analysis, read against Articles 12, 18, 19 and 26 in the consolidated text. Logging design should be confirmed with a competent authority or legal adviser where logs contain special category data or where retention conflicts arise.
Frequently asked questions
Must every high-risk system log the same events?
No. Article 12 requires logging capabilities appropriate to the intended purpose, with the kinds of events the article specifies. The design must be tailored to the system, its decisions, and its oversight needs, and must ensure traceability appropriate to that purpose.
Who keeps logs, provider or deployer?
Both, for the logs under their control. The provider keeps automatically generated logs under Article 19, and the deployer keeps logs under Article 26(6), each for at least six months unless other law provides otherwise, and each subject to data protection law.
Do logs need to be kept for ten years?
No. The ten-year period in Article 18 applies to documentation. Logs have their own periods under Articles 19 and 26(6), of at least six months and appropriate to the intended purpose, subject to other Union or national law.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗