Article 26(4) requires a deployer, to the extent it exercises control over input data, to ensure that input data are relevant and sufficiently representative in view of the intended purpose of the high-risk system. Article 26(6) requires a deployer to keep automatically generated logs, to the extent they are under its control, for at least six months, unless Union or national law provides otherwise, subject to data protection law. Input data and logs are linked: the quality of inputs affects the quality of outputs, and logs record what inputs were used, what outputs were produced, and what oversight was applied. Both duties require operational checks, not only procurement assurances.
When does a deployer control input data?
A deployer controls input data where it supplies the data, selects the cases or persons to be assessed, configures the data feeds, or determines the data that the system will process. A deployer that receives a system with a fixed data feed supplied by the provider, and cannot change it, exercises less control, and should record that position and check the provider's data requirements instead. Control is a matter of fact, not of contract label: a deployer that in practice chooses the data, even where the contract says the provider controls it, exercises control for Article 26(4) purposes. The record should state the data sources, who controls each source, and what checks the deployer performs, so that the control question is answered from the operating facts.
What do relevant and sufficiently representative mean?
Relevant means the data relate to the intended purpose and to the decision the system supports, without unnecessary or unrelated data that could distort the output. Sufficiently representative means the data cover the population and the conditions the system will encounter in deployment, without systematic gaps that would make the system unreliable for a group. A recruitment system trained on data from one region, applied to applicants from another, and a credit system using data that exclude a relevant group, illustrate representativeness failures. The deployer should check the data against the deployment population, document the check, and act where the data are not representative, including by limiting the deployment, obtaining additional data lawfully, or seeking provider advice, rather than using the system regardless.
For the broader regulatory framework, see deployer responsibilities.
How should input data be checked in operation?
Input data checks should be built into the workflow: validation of format and completeness, checks for missing or implausible values, monitoring of distribution drift, and periodic review of representativeness as the population changes. Checks should be proportionate to the risk: a high-volume, consequential system needs automated checks and alerts, while a low-volume system can use manual review. Where a check fails, the deployer should record the failure, decide whether to proceed, correct the data, or escalate, and should not proceed with data known to be unrepresentative for a consequential decision. The checks, the results, and the actions should be retained as part of the operational record, so that a later reviewer can see that input quality was monitored.
What logs must a deployer keep, and for how long?
A deployer must keep automatically generated logs, to the extent they are under its control, for at least six months, unless Union or national law provides otherwise. Logs under the deployer's control include logs generated by the system in operation, logs of oversight and intervention, and logs of input data checks, where the deployer holds them. The six-month period is a minimum, and other law, including sectoral and data protection law, can require a different period. The deployer should record the logs held, their location, their retention period, their access controls, and their deletion process, and should reconcile the AI Act period with the GDPR storage limitation principle, by keeping only the logs needed for oversight, monitoring and investigation, for the period needed, with appropriate safeguards.
How should logs be used in monitoring and investigation?
Logs should be used to monitor operation, to investigate anomalies and incidents, and to evidence oversight. A deployer should be able to retrieve the logs for a specific decision, a specific period, or a specific user, and to show what inputs were used, what output was produced, and what the overseer did. Logs should be protected against alteration and unauthorised access, and access should be logged. Where logs are shared with the provider or an authority, the sharing should be recorded, and the recipient's handling should be stated. A log set that cannot be retrieved, or that does not show the decision trail, does not support monitoring or investigation, even if the system technically generates logs.
Continue with Article 26 deployer duties in depth.
What is not decided by this guide?
This guide explains the input data and log duties in outline. It does not decide whether a particular data set is relevant or representative, whether a deployer controls a particular input, or what retention period applies to a particular log set. Those questions need the data, the deployment population, the control facts, and the applicable data protection analysis, read against Article 26 in the consolidated text. Input data and logs for consequential systems should be confirmed with a competent authority or legal adviser, and with the data protection officer where personal data are involved, before the system is used at scale.
Frequently asked questions
Does a deployer need to check data supplied by the provider?
Where the deployer exercises control over input data, it must ensure relevance and representativeness. Where the provider supplies the data and the deployer cannot change it, the deployer should record that position, check the provider's data requirements, and raise gaps with the provider rather than assuming the data are suitable.
Can logs be deleted after six months?
The AI Act minimum is at least six months, unless other law provides otherwise. Other law, including data protection and sectoral retention rules, can require a shorter or longer period. The deployer should record the period applied, its legal basis, and the deletion process, and should not delete logs needed for an open investigation.
Do logs need to contain personal data?
Logs should contain what is needed for traceability, oversight and investigation, and no more. Where logs contain personal data, data protection principles, including minimisation, security and retention, must be applied, and the log design should be checked with the data protection officer.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗