Artificial Intelligence Policy Tracker
Search
Menu
Legal requirement Record keeping and logging European Union Partially applicable

Design high-risk systems to log events automatically

Download: JSON · MarkdownUnder EU AI Act, Article 12; Article 26(6) for deployers

Pending review · linked to the official source, waiting for a reviewer to confirm it (a factual check against the official source, not a legal review or legal advice)
What this label means
Verified
— a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review
— linked to the official source and in the queue for a reviewer to confirm.
Source-linked
— linked to the official source, not yet confirmed by a reviewer.
Verification policy and current standing · a factual check, not legal advice.
No change recorded as of 26 Sep 2026 · official source last checked
Open official source Sign in to follow

Report a correction How we verify

On this page 9 sections

In brief

Design high-risk systems to log events automatically is a legal requirement under the EU AI Act in the European Union (Article 12; Article 26(6) for deployers). High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. It applies from 2 December 2027.

Instrument
EU AI Act
Jurisdiction
European Union
Nature
Legal requirement
Source reference
Article 12; Article 26(6) for deployers
Applies from
2 December 2027
Who it binds
Provider / developer, Deployer / user organisation
Evidence examples
1
Framework mappings
ISO/IEC 42001:2023, NIST AI Risk Management Framework 1.0
Controls that meet it
1
Official source
Open official text
Verification
Pending review · source-linked

What does it require?

High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.

Practical action

Define the log schema, retention and access controls, and confirm deployer retention meets the minimum.

Who does it apply to?

Providers (design) and deployers (retention) of high-risk AI systems.

Applies from:

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

  • satisfiesTechnical measureEngineering lead · continuous
    Automatic event logging and record retention

    Serves 9 recorded duties · evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check

    Automatic logging with a defined schema, retention and access controls.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

All 10 templates that cover it →

What evidence would a reviewer expect?

Evidence examples
EvidenceTypeNotes
Logging specification and retention policydocument

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every European Union duty mapped this way →

Framework mappings table
FrameworkReferenceNoteConfidence
ISO/IEC 42001:2023Annex A control on event loggingOriginal editorial mapping.medium
NIST AI RMF 1.0MEASURE 2.x, MANAGE 4.1Monitoring and traceability.medium

Frequently asked questions

Is this a legal requirement?

Yes. It is a legal requirement under EU AI Act (Article 12; Article 26(6) for deployers).

Who must comply with this obligation?

Providers (design) and deployers (retention) of high-risk AI systems.

When does this obligation apply?

It applies from 2 December 2027.

What evidence shows compliance?

A reviewer would expect: Logging specification and retention policy.

Which frameworks map to this obligation?

It is mapped to ISO/IEC 42001:2023 Annex A control on event logging, NIST AI Risk Management Framework 1.0 MEASURE 2.x, MANAGE 4.1. These are editorial crosswalks with a stated confidence, not official mappings.

Which controls satisfy this obligation?

Automatic event logging and record retention.

What should an organisation do in practice?

Define the log schema, retention and access controls, and confirm deployer retention meets the minimum.

Cite this record

AIPolicyTracker (2026). “Design high-risk systems to log events automatically (EU AI Act)” [AIPT-OBL-0009, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0009 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0009: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal of the European Union, https://eur-lex.europa.eu/eli/reg/2024/1689/oj.

BibTeX 
@misc{aipolicytracker2026_designhighrisksystemstol,
  author       = {{AIPolicyTracker}},
  title        = {{Design high-risk systems to log events automatically (EU AI Act)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/eu-ai-act-record-keeping}},
  url          = {https://aipolicytracker.org/obligations/eu-ai-act-record-keeping},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.

Similar obligations in other instruments

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.