EU AI Act Article 12 — Record-keeping (automatic logging)
High-risk AI systems must support automatic logging of events to enable traceability, risk monitoring, and post-market surveillance
Where this comes from
Provision: Article 12 — Record-keeping (automatic logging)
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 12, Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Who it applies to
High-risk AI provider in scope — all of these:
- Service deploys AI systems in a professional capacity
- AI Act role is Provider or we provide some AI systems and deploy others
Annex III high-risk area (Art. 6(2)) — any one of these:
- Annex III high-risk areas includes Biometrics
- Annex III high-risk areas includes Critical infrastructure
- Annex III high-risk areas includes Education and vocational training
- Annex III high-risk areas includes Employment and worker management
- Annex III high-risk areas includes Essential public services
- Annex III high-risk areas includes Creditworthiness
- Annex III high-risk areas includes Insurance
- Annex III high-risk areas includes Law enforcement
- Annex III high-risk areas includes Migration, asylum and border control
- Annex III high-risk areas includes Administration of justice and democratic processes
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 6(2): the AI system falls within an area listed in Annex III and is therefore high-risk, no documented Art. 6(3) derogation applying (and it is ALWAYS high-risk where it performs profiling of natural persons)
- Art. 16(a) ('Providers of high-risk AI systems shall …'), read with Art. 3(3): the actor develops the system or has it developed and places it on the market or puts it into service under its own name or trade mark — or is its authorised representative under Art. 22
- Art. 12(1)-(2): the system is operated over time, so events must be recorded automatically to a level of traceability appropriate to the intended purpose and to support post-market monitoring under Art. 72
What engineering work it implies
- AI Decision Logging (Append-Only Decision Record)Covers it fully
Append-only, tamper-evident log of every AI-assisted decision: model and version, hashed inputs, output, confidence, human-override flag, and an enforced retention floor.
Sample acceptance criteria Landfall generates for this obligation:
- Compliance-relevant events are logged automatically with timestamp, actor/subject, and event type
- Logs are append-only / tamper-evident and retained for the required period
- Logs are retrievable and filterable for a regulator request or incident review
- Logs exclude unnecessary sensitive payloads (data minimization in logging)
- A log-store outage blocks the recordable action rather than completing it unlogged
Evidence an auditor expects
- Technical controlTechnical audit
Automatic event logging capability over the lifetime of the system (Art. 12(1))
Design and configuration evidence that the system automatically records events to a level of traceability appropriate to its intended purpose, sufficient to monitor for situations that may result in the system presenting an Art. 79(1) risk or in a substantial modification, and to facilitate post-market monitoring under Art. 72. For Annex III point 1(a) systems, Art. 12(3) additionally requires recording of the usage period, the reference database checked, the input data leading to a match, and the identification of the natural persons involved in verifying the results
- Process recordLog analysis
Sample logs and the retention configuration that proves the capability is live
Extract of production logs plus the retention policy and storage configuration, evidencing that logging is enabled by default rather than merely available, and that log integrity is protected
Questions people ask
- Does EU AI Act Article 12 — Record-keeping (automatic logging) apply to my service?
- It applies when Service deploys AI systems in a professional capacity; AI Act role is Provider or we provide some AI systems and deploy others; and at least one of: Annex III high-risk areas includes Biometrics; Annex III high-risk areas includes Critical infrastructure; Annex III high-risk areas includes Education and vocational training; Annex III high-risk areas includes Employment and worker management; Annex III high-risk areas includes Essential public services; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance; Annex III high-risk areas includes Law enforcement; Annex III high-risk areas includes Migration, asylum and border control; Annex III high-risk areas includes Administration of justice and democratic processes. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 12 — Record-keeping (automatic logging) is enforceable from 2 August 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Automatic event logging capability over the lifetime of the system (Art. 12(1)); Sample logs and the retention configuration that proves the capability is live.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.