European UnionAI Act, Article 21(2) (competent authority access to automatically generated logs)
Regulation (EU) 2024/1689, Article 21(2)
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI governance rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- Give a competent authority access to the automatically generated logs of your high-risk AI system, to the extent they are under your control, when it makes a reasoned request, if you are the system's provider.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Settledness
- As of
- Open questions
- What must a competent authority's request state to be a 'reasoned request' under Article 21(2) before a provider has to give access to the automatically generated logs?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 21(2) is the access half of the chain: it names the Article 12(1) logs directly and requires a provider to open them to a competent authority on request. It does not itself create the logging capability, set a retention period, or say what the logs must contain; those are Article 12's and Article 19's.
- Kind
- Explicit
- As of
- Provision
- Article 21(2)
- Trigger
- high_risk_systems
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Upon a reasoned request from a competent authority, a provider of a high-risk AI system must give that authority access to the logs automatically generated by the system under Article 12(1), to the extent the logs are under the provider's control. Any information a competent authority obtains under Article 21, including through this access, is subject to the confidentiality obligations of Article 78.
Article 21(2) is the access half of the record-keeping duty: Article 12 requires the logging capability to exist and Article 19 requires a provider to keep the logs, while Article 21(2) is what lets a competent authority reach them.
Article 21 sits in Chapter III, Section 3, so it takes effect on the same schedule as Articles 12, 19 and 26(6): for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Article 21(2) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .