{"slug":"eu-ai-act-art-19-provider-log-retention","id":"AIPT-OBL-0025","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0025","title":"Providers must retain automatically generated logs under their control","short_title":"Automatically generated logs","category":"record_keeping","summary":"Providers must keep the event logs that a high-risk AI system generates under Article 12, to the extent those logs are within their control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless Union or national law on personal data sets a different period. Financial institutions keep the logs under their sector rules.\n","practical_action":"Configure log retention for hosted or API-served high-risk systems to at least six months with a documented rationale for any longer period.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 16–27","source_reference":"Article 19","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":null,"actors":["provider"],"sectors":["cross_sector","financial_services"],"use_cases":["biometrics","finance_and_credit","safety_critical"],"applicability":[{"description":"Providers that host, operate or otherwise hold the logs of a high-risk AI system; deployers have the parallel duty in Article 26(6).","actors":["provider"],"conditions":null}],"evidence_examples":[{"title":"Log retention configuration and policy","description":null,"artifact_type":"document"},{"title":"Sample log export demonstrating retention period","description":null,"artifact_type":"record"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.6.2.8","note":"AI system recording of event logs.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.4, MANAGE 4.1","note":"Traceability data for monitoring.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"satisfies","note":"Retention of Article 12 logs for the required period.","confidence_level":"high","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}