Logging Obligation (Article 12 EU AI Act)
Mandatory logs for high-risk AI
TL;DR
The logging obligation for high-risk AI serves traceability, incident investigation and performance monitoring. The provider must generate the logs; the deployer must retain them.
What is the logging obligation (Article 12 EU AI Act)?
Art. 12 EU AI Act requires high-risk AI systems to technically allow for the automatic recording of events (logs) over their entire lifetime (Art. 12(1)).
General log categories (Art. 12(2)) — these apply to all high-risk AI systems. The events recorded are those relevant for:
- identifying situations that present a risk within the meaning of Art. 79(1) or a substantial modification
- post-market monitoring (Art. 72)
- monitoring of the operation by the deployer (Art. 26(5))
Specific minimum log content (Art. 12(3)) — these apply only to high-risk AI for remote biometric identification (Annex III no. 1(a)), and cover at least:
- the period of each use (date and time of start and end)
- the reference database against which the input data were checked
- the input data for which the search led to a match
- the identity of the natural persons verifying the results (pursuant to Art. 14(5))
Retention (at least 6 months): The deployer retains the automatically generated logs for at least six months, in so far as they are under its control (Art. 26(6)). The provider is subject to the corresponding retention obligation for the logs under its control pursuant to Art. 19(1). Longer periods may follow from other Union or national law.
Germany and Austria: As a directly applicable EU regulation, Art. 12 applies equally in Germany and Austria (Regulation (EU) 2024/1689). There are no diverging national provisions; the logging and retention obligations are identical in wording in both jurisdictions.
Practical example
HR assessment by AI: the log contains the applicant ID (pseudonymised), the score, the reviewer ID, the system version and the time.