EU AI Act compliance
From 2 August 2026, providers of high-risk AI systems must keep automatic, traceable logs of what their systems did. Article 12 says the log must exist and be usable for incident reconstruction and post-market monitoring. It does not prescribe the cryptography, but a log that can be edited without a trace carries little weight in an audit. This page explains what the article requires and how to produce technical evidence an auditor can verify independently.
Article 12 ("Record-keeping") of Regulation (EU) 2024/1689 requires that high-risk AI systems technically allow for the automatic recording of events (logs) over the lifetime of the system. The logging must, at minimum, enable:
In plain terms: the system must keep an automatic, traceable record of what it did, over its whole operating life, detailed enough that someone can later reconstruct what happened and spot when something went wrong. Article 19 then requires providers to keep those logs for an appropriate period (at least six months unless other law requires longer), and Article 26 places parallel logging-retention duties on deployers.
Article 12 applies to high-risk AI systems as defined in the Act (largely the Annex III categories): AI used in areas such as employment and worker management, access to credit and essential services, biometrics, critical infrastructure, education and exam scoring, healthcare, law enforcement, and migration. If you build or deploy an AI agent that operates in one of those areas, the logging obligation is likely to reach you. If you build general developer tools or low-risk applications, Article 12 may not apply, but the same tamper-evident record is still what settles a client dispute or an incident post-mortem.
A log satisfies the spirit of Article 12 only if it can be trusted after the fact. Three properties separate a defensible record from a text file anyone could edit:
Provenrail records every model call, tool call, decision, and human-oversight action your agent takes into an off-box, hash-chained, append-only sink. On Builder and higher, each anchor carries an RFC 3161 trusted timestamp and is included in a witnessed public transparency log. Anyone can verify the result with the open-source pr verify tool, trusting neither the agent nor the vendor. The Team plan turns a run into a one-click evidence pack mapped to the article.
| Article 12 expectation | What Provenrail records as evidence |
|---|---|
| Automatic recording of events over the lifetime | Every model/tool call, decision, and oversight event captured automatically, with a genesis and seal per session. |
| Identifying risk situations (Art. 12(2)(a)) | Model calls, tool calls, data-access and decision events recorded in order, so a risk situation can be reconstructed. |
| Deployer monitoring (Art. 12(2)(c) / Art. 26(5)) | Per-event actor, action, target, and outcome, exportable for the deployer. |
| Record integrity and reliable time | Dual hash chain (tamper-evident on every plan) plus RFC 3161 trusted timestamps (Builder and higher) so timing is independently provable. |
| Human oversight (Art. 14) where applicable | Human-oversight approvals recorded as first-class, signed events. |
| Retention (Art. 19 / 26) | Portable, self-contained bundles you retain for as long as the law requires; we host no agent records. |
Generate the mapped report yourself, free and on your own machine:
pr report --regime eu-ai-act my-run.json --md
It produces a plain-English attestation: what was recorded, whether integrity verified, the events breakdown, and how each maps to Article 12, with an honest note wherever trusted time is absent.
pr verify bundle.json) or open it in a browser at provenrail.com/verify. It recomputes every hash, signature, and timestamp locally, trusting neither the agent nor the vendor, and reports any tampering.Sources: Regulation (EU) 2024/1689 (the AI Act), Articles 12, 14, 19, 26 and Annex III. This page summarises the regulation for engineering audiences and is not legal advice; consult the official text and qualified counsel.
← Back to home