European UnionAI Act, Article 12 (record-keeping)
Regulation (EU) 2024/1689, Article 12
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- Build automatic event logging into a high-risk AI system so it can record events over the system's lifetime, if you are its provider.
- Design the logging capability to support identifying an emerging risk or a substantial modification, post-market monitoring, and a deployer's monitoring of the system's operation.
- For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- NIST CSF 2.0
- PR.PS-04Log records are generated and made available for continuous monitoring
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(a): non-compliance with the obligations of providers under Article 16 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 16, point (a), requires a provider to ensure its high-risk AI system complies with the Section 2 requirements this row states; brought in by Article 16, point (a)'s reference to Section 2, which covers the Article 12 record-keeping requirement; Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- Which events are 'relevant for identifying situations that may result in the high-risk AI system presenting a risk' under Article 12(2), point (a), so that a provider must build logging that records them?
What it makes you log
What the log must hold
Event time, Input reference, Human involvement
Logging duty
Article 12 names the recording of events, in logs, directly. It states the capability the log must have and, for a remote biometric identification system under Annex III point 1(a), a minimum content list; it does not itself state how long the logs must be kept or who may demand access to them. Retention is Article 19's duty for a provider and Article 26(6)'s for a deployer, and access is Article 21(2)'s.
- Kind
- Explicit
- As of
- Provision
- Article 12(1) to (3)
- Trigger
- high_risk_systems
Why the legislator wanted it
Recital 71, second sentence.
- As of
- Quote
- This requires keeping records and the availability of technical documentation, containing information which is necessary to assess the compliance of the AI system with the relevant requirements and facilitate post market monitoring.
- Source link
- https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
- bias_and_performance_monitoring
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
High-risk AI systems must be technically capable of automatically recording events, in logs, over the system's lifetime. The logging capability must enable recording of events relevant to identifying a risk under Article 79(1) or a substantial modification, to supporting the post-market monitoring required by Article 72, and to the deployer monitoring required by Article 26(5).
For a remote biometric identification system, one of the Annex III use cases classified as high-risk under Article 6(2), the logs must at minimum record the start and end date and time of each use, the reference database checked against the input data, the input data for which a search produced a match, and the identity of the natural persons who verified the results under Article 14(5); this minimum contents list does not extend to high-risk systems generally.
Article 12 does not itself set how long a log must be kept or who may demand access to one: retention is Article 19's duty for a provider and Article 26(6)'s for a deployer, and access is Article 21(2)'s. Article 12 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Article 12 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .