European UnionAI Act, Article 26(6) (deployer log-keeping)
Regulation (EU) 2024/1689, Article 26(6)
Amended by Regulation (EU) 2026/1744, which moved its start date from to for a high-risk AI system classified under Article 6(2) and Annex III.
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Place of effect
- Obligation class
- Governance, Retention
- Audit expectation
- none
What it requires
- This duty takes effect on for a high-risk AI system classified under Article 6(2) and Annex III, and on for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by if it is intended for use by public authorities.
- Keep the logs your high-risk AI system automatically generates, to the extent they are under your control, if you are its deployer.NIST AI RMFMEASURE 2.4
- Retain the logs for a period appropriate to the system's intended purpose, at least six months, unless other Union or national law, such as data-protection law, provides otherwise.no control in the NIST AI RMF
- If you are a financial institution, keep the logs as part of the documentation your sector's internal-governance rules already require.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST CSF 2.0
- PR.PS-04Log records are generated and made available for continuous monitoring
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Private right of actionNo
Penalty structure
Article 99(4)(e): non-compliance with the obligations of deployers under Article 26 is fined up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher. Article 99(6) requires the lower of the two amounts for an SME, including a start-up; Article 99(6a), inserted by Regulation (EU) 2026/1744, gives the same lower-of treatment to a small mid-cap enterprise, since both apply to paragraph 4 fines.
- Rule
- Lower of for SME
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 3
Who enforces it
Settledness
- As of
- Open questions
- For how long beyond the six-month minimum must a deployer keep the logs under Article 26(6), when the period must be 'appropriate to the intended purpose' and Union law on the protection of personal data may require a shorter period?
- Which logs are 'under their control' for the purpose of Article 26(6) when the provider hosts the high-risk AI system and keeps the logs on its own infrastructure?
What it makes you log
Log retention
The same floor as Article 19, in nearly identical wording: a period appropriate to the system's intended purpose, of at least six months, yielding to a different period under other Union or national law, in particular data-protection law. A deployer that is a financial institution subject to Union financial-services internal-governance rules satisfies this duty through the documentation that law already requires.
- Unit
- Months
- As of
- Basis
- Purpose bound
- Minimum value
- 6
Logging duty
Article 26(6) is the deployer's counterpart to Article 19: it names the logs the system automatically generates and requires the deployer to keep them, on the same six-month floor. It does not create the logging capability or say what the logs must contain; both are Article 12's. Unlike a provider's logs, which Article 21(2) makes accessible to a competent authority on request, no provision of Article 26 or Article 21 gives a competent authority the same named route into a deployer's copy of the logs. Article 74(1) applies Regulation (EU) 2019/1020 to AI systems and treats a reference to an economic operator under that Regulation as including every operator named in Article 2(1), deployers included, which gives a market surveillance authority a general document and information production power reaching a deployer's records. That is a real route, but it is 2019/1020's own general power over any operator's documentation, not an AI Act clause naming access to "the logs" for a deployer the way Article 21(2) names it for a provider, so no named accessor is recorded here rather than importing a background power that would apply identically to every instrument in this file.
- Kind
- Explicit
- As of
- Provision
- Article 26(6)
- Trigger
- high_risk_systems
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
A deployer of a high-risk AI system must keep the logs the system automatically generates, to the extent the logs are under the deployer's control, for a period appropriate to the system's intended purpose, at least six months, unless a different period is required under other Union or national law, in particular data-protection law.
A deployer that is a financial institution subject to internal-governance requirements under Union financial services law satisfies this duty by maintaining the logs as part of the documentation that law already requires it to keep. Article 26(6) is the deployer-side counterpart of Article 19: the two provisions state the same retention period, of a deployer and a provider respectively, in nearly identical wording.
Article 26 sits in Chapter III, Section 3, so like Articles 12, 19 and 21 it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ) wrote into Article 113: for a system classified as high-risk under Article 6(2) and Annex III, and for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general application date.
Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by .
Article 26(6) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .