Article 12 requires high-risk AI systems to automatically log events ('logs') over their lifetime. Logs must be sufficient to identify situations of risk, facilitate post-market monitoring, and enable traceability. The retention period must be proportionate to intended purpose and at least six months. For Annex III point 1(a) systems (remote biometric identification), specific log fields are mandated: each use, the reference database, identification results, and the natural persons involved.
What you must do
- → Build automatic logging into the system at design time, not as an afterthought.
- → Define a retention period of at least six months — longer if the use case demands it.
- → Protect logs against tampering and document the storage architecture.
The authoritative text of Article 12 is published by the Publications Office of the European Union on EUR-Lex. We link directly to it rather than mirror it, so you always read the current consolidated version straight from the source.
Read Article 12 on EUR-LexSource: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). The only authentic version is the one published in the Official Journal of the European Union.