The EU AI Act requires automatic logging for every high-risk AI system in the EU market. The deadline is August 2026. These are binding legal requirements, not best-practice suggestions.
High-risk AI systems must automatically record events throughout their operation. Logs capture risk-relevant data, support post-market monitoring, and provide traceability across the system's lifecycle.
Any organization that builds, deploys, or distributes high-risk AI systems in the EU market, regardless of where you're headquartered. Providers, deployers, importers, and distributors.
Answer six questions about your current logging infrastructure to see where you stand relative to Article 12 requirements.
Start assessment
Reproducible Decision Traces and EU Article 12
Article 12 mandates automatic logs for high-risk AI systems — capturing risk-relevant events, supporting monitoring, and providing lifecycle traceability. But the regulation leaves a structural question unanswered: what should a compliant log actually contain?
Read the actual regulation text with practical annotations. Click any paragraph for implementation notes. The regulation text is unedited; the annotations are ours.
Click a paragraph in the regulation text to see its annotation here.
Terms with dashed underlines link to the glossary.
From proposal to full enforcement. Select any milestone for context and source citations.
Paste a sample log entry or load our example. The analyzer checks each element against Article 12 requirements: green for compliant, amber for partial, red for missing.
Paste a log entry and click Analyze to see Article 12 compliance annotation.
Answer a few questions about your AI system to get a personalized risk classification and compliance gap analysis.
Walk through a guided assessment to determine your AI system's risk classification under the EU AI Act. Each answer narrows the classification and shows which obligations apply.
Assess your current logging against each Article 12 requirement dimension. Pick the option that best describes your setup, and see where the gaps are.
Article 12 requires that high-risk AI systems are designed with capabilities enabling automatic recording of events ("logs") while operating. Logging must conform to recognised standards or common specifications, and must ensure traceability appropriate to the system's intended purpose.
At minimum, logs must capture: the period of each use (start and end timestamps), the reference database against which input data was checked, input data that led to a match, and the identity of people involved in verifying results.
Yes, if your AI system is placed on the EU market or its output is used in the EU. The Act has extraterritorial reach similar to GDPR. Providers outside the EU must comply if their systems are placed on the market or put into service in the Union, or if the output is used in the Union.
Non-compliance with high-risk AI system requirements (including Article 12) can result in fines up to €15 million or 3% of worldwide annual turnover, whichever is higher. Providing incorrect or misleading information to authorities can result in fines up to €7.5 million or 1% of turnover.
A provider develops an AI system (or has one developed on their behalf) and places it on the market under their own name. A deployer uses an AI system under their authority in a professional context.
Both have obligations, but provider obligations are more extensive, including the design and development requirements of Article 12.
Several approaches can help:
The key is that your logs meet the traceability, completeness, and retention requirements in Article 12 and its associated harmonised standards.
Article 12 itself doesn't prescribe a single retention period. It requires logging "for a period appropriate to the intended purpose" and conformance with recognised standards. In practice, retention will be shaped by the harmonised standards in development, sector-specific legislation (healthcare may require longer), and the conformity assessment process. Plan for at least the system's operational lifetime plus any post-market monitoring period.
The system must generate logs without manual intervention during operation. Logging needs to be part of the system architecture, not something added after the fact or performed by operators manually recording system states. The logs must be generated by the system itself during normal operation.