{"slug":"eu-ai-act-record-keeping","id":"AIPT-OBL-0009","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0009","title":"Design high-risk systems to log events automatically","short_title":"Record-keeping","category":"record_keeping","summary":"High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise.\n","practical_action":"Define the log schema, retention and access controls, and confirm deployer retention meets the minimum.\n","is_binding":true,"applies_from":"2027-12-02","section":"Articles 8–15","source_reference":"Article 12; Article 26(6) for deployers","official_source_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","review_status":"pending_review","confidence_level":"medium","last_verified_at":null,"reviewed_by":null,"actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["biometrics","finance_and_credit","public_services"],"applicability":[{"description":"Providers (design) and deployers (retention) of high-risk AI systems.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Logging specification and retention policy","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A control on event logging","note":"Original editorial mapping.","confidence_level":"medium","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.x, MANAGE 4.1","note":"Monitoring and traceability.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"satisfies","note":"Automatic logging with a defined schema, retention and access controls.","confidence_level":"high","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"}],"url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping","policy":{"slug":"eu-ai-act","title":"Regulation (EU) 2024/1689 — Artificial Intelligence Act","status":"partially_applicable","jurisdiction":"eu","url":"https://aipolicytracker.org/policies/eu-ai-act"}}