{"slug":"record-keeping-and-logging","id":"AIPT-CTL-0022","title":"Automatic event logging and record retention","kind":"technical","kind_label":"Technical measure","purpose":"Captures what an AI system did, when and with what inputs, and keeps those records long enough to reconstruct a decision, investigate an incident and demonstrate ongoing monitoring.\n","description":"Engineers define a log schema for each system that covers at minimum the time of use, the version of model and configuration, the inputs or their references, the output produced and any human intervention. Logs are written automatically, protected against tampering, access-controlled and retained for a period set by the strictest applicable rule and the organisation's own needs. Deployers confirm that logs generated under their control are retained and can be handed to the provider or an authority. Retention, deletion and access are reviewed periodically and the schema is updated when the system changes.\n","owner_role":"Engineering lead","frequency":"continuous","frequency_label":"Continuous","risk_subdomains":["7.4","6.5","2.2"],"evidence":[{"type":"access_log","title":"AI system event logs","description":"System-generated records of use, versions, inputs, outputs and interventions, retained for the defined period."},{"type":"procedure","title":"Log schema and retention standard","description":null},{"type":"audit_report","title":"Log integrity and retention check","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.8","note":"Recording of event logs.","confidence_level":"high"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 8.15 Logging, 8.16 Monitoring activities","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.4; MANAGE 4.1","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0024 AI Telemetry Logging","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","relationship":"satisfies","note":"Automatic logging with a defined schema, retention and access controls.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","relationship":"supports","note":"Logs support the investigation and report.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","relationship":"satisfies","note":"Retention classes and archive controls for the listed documents.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","relationship":"satisfies","note":"Retention of Article 12 logs for the required period.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","relationship":"supports","note":"Logs must be retrievable in a usable format.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","relationship":"supports","note":"Per-use documentation and annual reporting data.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","relationship":"supports","note":"Logs are the primary data source.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","relationship":"supports","note":"Logs supply the inputs cited in the explanation.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation"},{"slug":"us-colorado-admt-record-keeping","title":"Keep records of consequential decisions influenced by the technology for three years","relationship":"satisfies","note":"Decision records retained for the statutory period.","confidence_level":"high","is_binding":true,"policy":"us-colorado-automated-decision-making-technology-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-admt-record-keeping"}],"related_controls":["post-market-monitoring-and-drift-detection","ai-incident-management-and-reporting","human-oversight-and-override"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/record-keeping-and-logging","context_url":"https://aipolicytracker.org/controls/record-keeping-and-logging.md"}