EU AI Act Logging Requirements: Article 12 Audit Trails Explained
The EU AI Act logging requirements in Article 12 oblige high-risk AI systems to automatically record events over the system's lifetime. This page covers exactly what your audit trail must capture, retention rules, and how Article 11 + Annex IV technical documentation interact.
Last updated: July 4, 2026
What Article 12 Requires
High-risk AI systems must, by design, allow for the automatic recording of events ('logs') over the lifetime of the system. Logs must enable traceability sufficient for post-market monitoring, regulatory inspection, and human oversight under Article 14.
Article 12 is one of the few EU AI Act obligations that demands a technical capability rather than just process documentation — your AI system must literally produce these records as it operates.
What Your Audit Trail Must Capture
Article 12 logs must capture sufficient detail to reconstruct how and why decisions were made:
- Event-level logging with reliable timestamps
- Inputs received by the AI system and outputs produced
- Internal process steps (deliberation, intermediate decisions, policy evaluations)
- Human-in-the-loop actions: approvals, overrides, escalations
- System state data sufficient to reproduce the decision context
- Anomaly events and their handling
Technical Requirements
The regulation specifies several technical properties your logging infrastructure must satisfy:
- Automatic logging — manual log entries don't satisfy Article 12
- Reliable, complete event recording
- Tamper-evident, secure storage
- Retention period proportional to intended purpose and risk profile
- Exportable in formats suitable for regulatory review
Common Compliance Gaps
Based on our work with enterprise AI teams, these are the most frequent Article 12 compliance gaps:
- Logging outputs only, not the reasoning that produced them
- Missing or incomplete human-override records
- Mutable log storage that doesn't satisfy tamper-evidence
- Retention periods too short for regulatory inspection
- No structured export — only ad-hoc database queries
Article 11 + Annex IV Technical Documentation
Article 11 requires technical documentation that, together with Article 12 logs, demonstrates conformity.
Annex IV specifies the structure: system description, intended purpose, design choices, training and testing data, validation procedures, monitoring, and the logs themselves. Treat the two as one workstream.
How AIAgentree Implements Article 12
AIAgentree was built from the ground up for Article 12 compliance:
- Decision-trace capture — every input, intermediate step, output recorded
- Reasoning steps preserved alongside outputs
- Human-override tracking with who/when/why metadata
- Cryptographic hash-chain integrity for tamper-evidence
- One-click export in formats designed for regulatory review (PDF, JSON, CSV)
Frequently Asked Questions
How long must Article 12 logs be retained?
The EU AI Act does not specify a fixed period; logs must be retained for a duration proportional to the AI system's intended purpose and risk profile. Most providers align with sector-specific retention rules (financial services, healthcare) and treat the longest applicable period as the floor.
Do I need to log every model inference?
Article 12 requires logging events that enable traceability of decisions. For consequential decisions affecting people's rights or safety, that effectively means every inference. For purely internal helper tasks, lighter-weight aggregated logging may suffice — document the rationale either way.
Are logs themselves personal data under GDPR?
Often yes, especially when they include input data tied to identifiable individuals. Treat Article 12 log retention and access controls as a joint EU AI Act / GDPR Article 32 problem.
Sources
- Regulation (EU) 2024/1689, Article 12 — artificialintelligenceact.eu/article/12
- Article 11 + Annex IV — artificialintelligenceact.eu/article/11
Continue exploring the EU AI Act guide
EU AI Act Compliance Guide
The complete guide to EU AI Act compliance for AI agents — start here.
Article 14 — Human Oversight
Designing effective human-in-the-loop controls for AI decisions.
Annex III — High-Risk AI Systems
Which AI use cases the Act classifies as high-risk.
EU AI Act Compliance Checklist
A step-by-step checklist to reach and document compliance.
Compliance Cost Calculator
Estimate your EU AI Act compliance effort and cost.
Deadlines & Timeline
Key enforcement dates, including the August 2, 2026 deadline.
Fines & Penalties
Penalty tiers up to €35M or 7% of global annual turnover.
Transparency Obligations (Art. 13 & 50)
Disclosure duties for AI systems and their outputs.
Risk Management & Conformity Assessment
Build a risk management system and assess conformity.
GPAI Obligations
Rules for providers of general-purpose AI models.
EU AI Act for US Companies
Extraterritorial scope and what US providers must do.
Omnibus Update
The latest changes to the EU AI Act timeline and rules.
Penalty Calculator
Estimate your maximum fine under the Article 99 tiers.
Article 11 + Annex IV
What technical documentation the EU AI Act requires.
Article 26: Deployer Obligations
What deployers of high-risk AI must do, including log retention.
Article 17: Quality Management
The QMS providers of high-risk AI must document.
Article 10: Data Governance
Data quality, bias mitigation, and governance duties.
Article 4: AI Literacy
The staff AI-literacy duty in force since February 2025.
Deployer vs Provider
Who bears which obligation — and when a deployer becomes a provider.
FRIA (Article 27)
Who must run a Fundamental Rights Impact Assessment, and how.
Who Does It Apply To?
Scope, operators, and the extraterritorial reach of the EU AI Act.
Post-Market Monitoring
Articles 72–73: ongoing monitoring and incident reporting.
ISO 42001 vs EU AI Act
How the voluntary standard and the binding law fit together.
NIST AI RMF vs EU AI Act
A practical crosswalk between the framework and the law.
EU AI Act for Healthcare
High-risk medical AI, MDR/IVDR interplay, and clinician oversight.
EU AI Act for Financial Services
Credit scoring, insurance pricing, and existing financial regulation.
EU AI Act for HR & Employment
Hiring AI as high-risk, plus NYC LL144 and EEOC overlap.