Record-keeping (logging)

Logs are what make every other obligation provable after the fact. Without them, a serious-incident report cannot be reconstructed, post-market monitoring has nothing to monitor, and a deployer facing an affected person's Article 86 request for an explanation has nothing to explain from. This is also one of the few requirements that is genuinely impossible to retrofit cheaply — a system that was not built to log the right events cannot start producing history for the period before someone noticed.

A bank's loan-decision system logs, for every application, the model version, the input feature vector, the score, the threshold applied, whether a human overrode it and who. Eleven months later a rejected applicant exercises their right to an explanation. The bank can reconstruct the decision exactly. A competitor that logged only the final yes or no can reconstruct nothing, and has no defence to offer either the applicant or the regulator.

Assuming ordinary application logs satisfy Article 12. Standard observability captures system health, not decision traceability — you need the inputs, model version, output and oversight actions tied to an identifiable event, retained for at least six months, and privacy-engineered so that retention does not create a GDPR problem of its own.

How long must AI Act logs be kept?

Deployers of high-risk systems must retain the automatically generated logs for a period appropriate to the intended purpose, of at least six months, unless other applicable Union or national law — such as data protection law — requires otherwise.

Who is responsible for logging, the provider or the deployer?

The provider must design the system to generate the logs automatically and, where it controls them, retain them. The deployer must keep the logs the system generates while it is under its control.

Do logging duties conflict with the GDPR?

They have to be reconciled rather than traded off. Retention should be purpose-limited to traceability, access controlled, and personal data minimised or pseudonymised where the traceability purpose can still be met.