Does Provenrail make my AI system EU AI Act compliant?

No. It provides the technical record-keeping evidence Article 12 calls for: an automatic, tamper-evident, independently verifiable, timestamped log. Compliance is a broader, system-level determination that rests with you and your advisors.

When does EU AI Act Article 12 start to apply?

From 2 December 2027 for standalone Annex III high-risk AI systems, and 2 August 2028 for AI embedded in Annex I regulated products. Both dates were deferred from 2 August 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. The AI Act itself entered into force on 1 August 2024.

What EU AI Act obligations still apply from 2 August 2026?

The Article 50 transparency obligations were not deferred and apply from 2 August 2026: informing people that they are interacting with an AI system, and marking synthetic media in a machine-readable format. The marking duty applies immediately to systems placed on the market after 2 August 2026, with a grace period until 2 December 2026 for systems already on the market.

Is the new EU AI Act high-risk deadline conditional on harmonised standards?

No. The Commission's original Digital Omnibus proposal included a conditional trigger tied to the availability of harmonised standards. The final adopted text replaced it with fixed dates, so 2 December 2027 and 2 August 2028 do not shift again if standards are delayed.

Does the EU AI Act require cryptographic logging specifically?

No. Article 12 requires automatic, traceable logging over the system lifetime and does not prescribe a method. But a log that can be altered without detection has little evidentiary weight, so tamper-evidence and trusted time are the prudent way to make it defensible. The harmonised technical standards are still in draft.

How does an auditor verify a Provenrail record?

They run the open-source verifier (pr verify bundle.json) or open the record in a browser at provenrail.com/verify. It recomputes every hash, signature, and RFC 3161 timestamp locally, trusting neither the agent nor the vendor, and reports any tampering.

How long must EU AI Act logs be kept?

Article 19 requires providers to retain the logs for an appropriate period, at least six months unless other Union or national law requires longer. Provenrail bundles are portable and self-contained, and Provenrail hosts no agent records.

EU AI Act compliance, updated 30 July 2026

EU AI Act Article 12: the deadline moved to December 2027. Here is what did not move.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It defers the high-risk obligations, Article 12 record-keeping among them, from 2 August 2026 to 2 December 2027 for standalone Annex III systems and 2 August 2028 for AI embedded in Annex I regulated products. The Article 50 transparency obligations were not deferred and have applied since 2 August 2026. This page explains what changed, what Article 50 requires now, and what a defensible log looks like whichever date reaches you.

Last updated 5 August 2026

What changed on 27 July 2026. Parliament endorsed the Omnibus on 16 June 2026 (423-57), the Council gave final approval on 29 June, and it entered into force on 27 July. The Commission's originally proposed conditional trigger, which would have tied the new dates to the availability of harmonised standards, was dropped in favour of fixed dates. There is no stop-the-clock mechanism: 2 December 2027 and 2 August 2028 are firm. Read the full date-by-date diff →

Article 50 transparency applies in 2 August 2026 The transparency duties were not deferred. Article 12 record-keeping now applies from 2 December 2027.

What changed and when What Article 12 requires Do nothing until 2027? Am I in scope? Why tamper-evidence matters What good evidence looks like How Provenrail maps to it FAQ

Honest framing. Provenrail is technical evidence tooling, not legal advice and not a compliance certification. It produces tamper-evident, independently verifiable records of the kind Article 12 calls for. Whether your overall system is compliant is a determination for you and your qualified advisors. We give you the evidence; you provide the attestation.

What Article 12 actually requires

Article 12 ("Record-keeping") of Regulation (EU) 2024/1689 requires that high-risk AI systems technically allow for the automatic recording of events (logs) over the lifetime of the system. The logging must, at minimum, enable:

identifying situations that may cause the system to present a risk, or to undergo a substantial modification;
facilitating post-market monitoring of the system in operation; and
monitoring the operation of high-risk systems by deployers.

In plain terms: the system must keep an automatic, traceable record of what it did, over its whole operating life, detailed enough that someone can later reconstruct what happened and spot when something went wrong. Article 19 then requires providers to keep those logs for an appropriate period (at least six months unless other law requires longer), and Article 26 places parallel logging-retention duties on deployers.

The timeline that matters, after the Omnibus

1 August 2024: the AI Act entered into force.
2 August 2026 (now in force): the Article 50 transparency obligations apply, including the duty to inform people that they are interacting with an AI system and to mark synthetic media in a machine-readable format. The marking duty bites immediately for systems placed on the market after that date; systems already on the market get a grace period to 2 December 2026.
2 December 2026: transitional deadline for the new Article 5 prohibition on AI-generated non-consensual intimate imagery and CSAM. Also the end of the Article 50(2) marking grace period.
9 December 2026: the revised EU Product Liability Directive (2024/2853) must be transposed by member states. After that, a missing or alterable log can shift the burden of proof against you (see below). This directive was not touched by the Omnibus, so the liability pressure on log integrity arrives a full year before Article 12 does.
2 August 2027: deadline for member states to establish regulatory sandboxes, extended by the Omnibus from 2 August 2026.
2 December 2027 (moved, was 2 August 2026): the obligations for standalone Annex III high-risk AI systems, Article 12 record-keeping among them, become applicable.
2 August 2028 (moved, was 2 August 2027): the same obligations for AI embedded in Annex I regulated products.
No conditional trigger: the Commission's original proposal would have tied these dates to harmonised standards being ready. The final text uses fixed dates instead. The harmonised standards that detail "how" are still in draft, which is exactly why an externally anchored evidence approach is the safe path: it survives whatever the standard lands on.

So should you do nothing until December 2027?

That is the wrong read of a 16-month deferral, for three reasons that have nothing to do with the AI Act.

The Product Liability Directive lands first. National transposition is due 9 December 2026, roughly a year before Article 12. Recital 46 lets defectiveness be presumed where a product lacks the logging Union law requires. That presumption operates through civil litigation, not through the AI Office, and no omnibus deferred it.
Evidence cannot be created retroactively. A record-keeping obligation is the one kind you cannot satisfy by starting on the deadline. On 2 December 2027 a regulator or claimant asks about an incident from 2027, and either the signed, timestamped record exists from back then or it does not. Turning capture on the week before buys you nothing.
The Article 50 transparency duties applied from 2 August 2026. If you disclose AI interaction or mark synthetic output, the ability to show what you disclosed and when is itself a record-keeping problem, and that duty is already in force.

The honest version: the compliance emergency is gone, and anyone still selling you an August 2026 panic is working from stale material. The engineering reason to keep a defensible record, which is that arguments about what your agent did are settled by evidence you cannot have edited, was never about the deadline.

Why tamper-evidence, not just logging

Article 12 says the log must exist. It is the revised Product Liability Directive (EU) 2024/2853 that makes the log's integrity matter in court. Recital 46 states that where a product is not equipped with the means to log information that Union law requires, defectiveness can be presumed. The burden then shifts to you to prove the system was not defective, using the very records you failed to keep defensibly.

The trap is subtle: a log you control is a log you could have edited, so a claimant can argue your own export is self-serving. An independently verifiable record cannot be argued away the same way. It was signed and chained at the moment of the event, and any auditor, regulator, or court can recompute it without trusting you. One tamper-evident record can serve the evidence layer of several regimes at once:

Regimes whose evidence requirements one tamper-evident record can help address. Whether it does is your auditor's determination, not ours.
Regime	Provision	What it needs
EU AI Act	Art. 12, 19, 26	Automatic event logging plus 6-month retention
EU Product Liability Directive	Recital 46	Logs that defeat the defectiveness presumption
ISO/IEC 42001	A.6.2.8	Tamper-evident event-log storage
NIST AI RMF / IR 8596	MEASURE 2.13	Action records attributed to a non-human identity
21 CFR Part 11	11.10(e)	Secure, independent, time-stamped audit trail
SOC 2	CC7.2 / CC6.1	Immutable, attributable inference logs

Regime mapping is a technical summary for engineering audiences, not legal advice. The PLD applies to products placed on the market after national transposition; consult qualified counsel for your situation.

Who this applies to

Article 12 applies to high-risk AI systems as defined in the Act (largely the Annex III categories): AI used in areas such as employment and worker management, access to credit and essential services, biometrics, critical infrastructure, education and exam scoring, healthcare, law enforcement, and migration. If you build or deploy an AI agent that operates in one of those areas, the logging obligation is likely to reach you from 2 December 2027 (or 2 August 2028 if your AI is embedded in an Annex I regulated product). If you build general developer tools or low-risk applications, Article 12 may not apply, but the same tamper-evident record is still what settles a client dispute or an incident post-mortem.

Am I in scope? A 30-second self-check

Tick what applies to your AI system. This is an engineering heuristic to help you decide whether to look closer, not a legal determination.

My AI system or agent is used for one or more of these: Hiring, recruitment, or worker management decisions Credit scoring, lending, or access to essential financial services Insurance pricing or risk assessment Healthcare, medical devices, or patient triage Biometric identification or categorisation Critical infrastructure, education scoring, law enforcement, or migration It is offered to, or used by, people in the EU

No boxes ticked yet. Article 12 may not reach a low-risk developer tool, but a tamper-evident record still settles disputes and incident post-mortems.

What "good" logging evidence looks like

A log is only useful under Article 12 if it can be trusted after the fact. Three properties separate a defensible record from a text file anyone could edit:

Tamper-evident. Any alteration, deletion, reordering, or insertion after the fact is detectable. A plain database row or log line is not: whoever controls the store can change it silently.
Independently verifiable. An auditor can confirm the record is intact without trusting you, ideally with open tools and no account. "Trust our dashboard" is not evidence.
Reliably timed. When something happened is provable against an independent time authority, so the timing cannot be back-dated, even by the operator.

How Provenrail provides the technical evidence

Provenrail records every model call, tool call, decision, and human-oversight action your agent takes into an off-box, hash-chained, append-only sink. On Builder and higher, each anchor carries an RFC 3161 trusted timestamp and is included in a witnessed public transparency log. Anyone can verify the result with the open-source pr verify tool, trusting neither the agent nor the vendor. The Team plan turns a run into a one-click evidence pack mapped to the article.

How Provenrail records map to Article 12 expectations
Article 12 expectation	What Provenrail records as evidence
Automatic recording of events over the lifetime	Every model/tool call, decision, and oversight event captured automatically, with a genesis and seal per session.
Identifying risk situations (Art. 12(2)(a))	Model calls, tool calls, data-access and decision events recorded in order, so a risk situation can be reconstructed.
Deployer monitoring (Art. 12(2)(c) / Art. 26(5))	Per-event actor, action, target, and outcome, exportable for the deployer.
Record integrity and reliable time	Dual hash chain (tamper-evident on every plan) plus RFC 3161 trusted timestamps (Builder and higher) so timing is independently provable.
Human oversight (Art. 14) where applicable	Human-oversight approvals recorded as first-class, signed events.
Retention (Art. 19 / 26)	Portable, self-contained bundles you retain for as long as the law requires; we host no agent records.

Generate the mapped report yourself, free and on your own machine:

pr report --regime eu-ai-act my-run.json --md

It produces a plain-English evidence summary: what was recorded, whether integrity verified, the events breakdown, and how each maps to Article 12, with an honest note wherever trusted time is absent.

Produce your first record Verify a record in your browser See plans

What this is not. Producing an Article 12-mapped evidence record does not, by itself, make you compliant with the AI Act. Compliance is a system-level determination involving risk management, data governance, transparency, human oversight, and more. Provenrail addresses the record-keeping evidence layer. Recorded time is independently reliable only where an RFC 3161 trusted-time anchor is present.

FAQ

Does Provenrail make my AI system EU AI Act compliant?: No. It provides the technical record-keeping evidence Article 12 calls for: an automatic, tamper-evident, independently verifiable, timestamped log. Compliance is a broader, system-level determination that rests with you and your advisors.
When does Article 12 start to apply?: From 2 December 2027 for standalone Annex III high-risk systems, and 2 August 2028 for AI embedded in Annex I regulated products. Both were deferred from 2 August 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026. The AI Act itself entered into force on 1 August 2024.
What still applies from 2 August 2026?: The Article 50 transparency obligations, which were not deferred: telling people they are interacting with an AI system, and marking synthetic media in a machine-readable format. The marking duty applies immediately to systems placed on the market after 2 August 2026, with a grace period to 2 December 2026 for systems already on the market.
Is the new deadline conditional on harmonised standards?: No. The Commission's original proposal contained a conditional trigger tied to standards readiness. The final text replaced it with fixed dates, so 2 December 2027 and 2 August 2028 do not move again if standards slip.
Does the AI Act require cryptographic logging specifically?: No. The article requires automatic, traceable logging and does not prescribe a method. But a log that can be altered without detection has little evidentiary weight, so tamper-evidence and trusted time are the prudent way to make the log defensible. The harmonised technical standards are still in draft.
How does an auditor check a Provenrail record?: They run the open-source verifier (pr verify bundle.json) or open it in a browser at provenrail.com/verify. It recomputes every hash, signature, and timestamp locally, trusting neither the agent nor the vendor, and reports any tampering.
How long do I keep the logs?: Article 19 requires providers to retain the logs for an appropriate period, at least six months unless other Union or national law requires longer. Provenrail bundles are portable and self-contained, so you keep them wherever you retain records; we host no agent records.

Sources: Regulation (EU) 2024/1689 (the AI Act), Articles 12, 14, 19, 26, 50 and Annex III; Regulation (EU) 2026/1744 (the Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force from 27 July 2026; Directive (EU) 2024/2853 (the revised Product Liability Directive). Last reviewed 30 July 2026. This page summarises the regulations for engineering audiences and is not legal advice; consult the official texts and qualified counsel.

← Back to home