Article 12 introduces an automatic logging obligation for high-risk AI systems. The regulation requires these systems to have built-in capabilities to record events throughout their operational lifetime -- creating an audit trail that supports post-incident investigation, market surveillance, and accountability.
What Must Be Logged
Article 12(1) requires logs to capture events relevant to identifying risks to health, safety, or fundamental rights, or to the occurrence of a serious incident or a substantial modification. Article 12(2) specifies that for Annex III high-risk systems used for decisions affecting persons (biometric identification, credit scoring, employment), logs must retain records of at least: dates and times of use, reference databases consulted, input data, and identifying information of natural persons involved in verification.
Regulation (EU) 2024/1689 — Article 12(1)
“High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system. To the extent possible, the logging capabilities shall conform to recognised standards or common specifications.”
- Logging must be automatic -- manual record-keeping is insufficient for Article 12 compliance
- Log retention periods are set by Union or national law applicable to the deployer
- Logs support the obligation to report serious incidents to market surveillance authorities under Article 73
- The logging requirement dovetails with Article 17 quality management system requirements
- Logs should be designed to be tamper-evident to maintain their evidentiary value