Reg. (EU) 2024/1689 · Article 12 · enforcement 2 Aug 2026

EU AI Act Article 12
evidence, automated.

Every action your high-risk AI system takes — captured, hash-chained, and ready as an auditor-acceptable evidence pack in one click. No spreadsheet rebuilds. No consultant retainers. No rewrites when guidance evolves.

Start free What does Article 12 require?
Article 12 logging Annex IV technical docs Post-market monitoring Notified-body ready
The deadline

2 August 2026 — and your existing logs probably don't qualify.

Article 12 of Regulation (EU) 2024/1689 requires providers and deployers of high-risk AI systems to maintain automatic event logs. The obligations are operational, not paper-based — and the penalty regime is at the higher end of EU regulatory law.

35 M€

Maximum fine for non-compliance with provider obligations

7%

Of global annual turnover — whichever is higher

6 mo

Minimum log retention period mandated by the Article

The obligations

What Article 12 actually requires.

Article 12 mandates automatic event logging for the full operational lifetime of a high-risk AI system. The Commission and the AI Office have published guidance clarifying what counts as adequate — Agent Audit is engineered against those requirements.

1. Automatic event logging

Records must be generated automatically while the system is operating. They cannot be reconstructed after the fact from disparate sources. Agent Audit captures events at the SDK boundary, in real time.

2. Identification of risk situations

Logs must support identification of situations that may result in the AI system presenting a risk under Article 79 or undergoing substantial modification. Agent Audit's decision-drift detection and material event surfacing are built for this requirement.

3. Period of input data recording

Logs must include the period of recording, reference data used, search parameters, and the natural persons involved in the verification of results. Agent Audit's receipt schema captures all of these as first-class fields.

4. Retention

Records must be kept for a period appropriate to the intended purpose, and at minimum six months unless otherwise specified by Union or Member State law. Agent Audit retains receipts for seven years by default, configurable per data class.

5. Availability to authorities

Logs must be made available to national competent authorities on request, in a form they can interpret. Agent Audit's Article 12 evidence pack renders to PDF in the format the AI Office's pilot reviews have indicated as auditor-acceptable.

The pack

Eight pages your auditor recognises.

We've engineered the Article 12 evidence pack from the regulation itself, the AI Office's published guidance, and conversations with external auditors at compliance review pilots. One click renders it from your live receipts.

Page 1–2

Cover & executive summary

System name, period, issuer, integrity status. Three-officer sign-off block ready for compliance, DPO and InfoSec.

Page 3

System inventory

Annex IV-style technical documentation: provider, risk class, framework, model versions, tool inventory, data classifications touched.

Page 4

Operational summary

Throughput, decision distribution, tool usage, operating cost, by-week breakdown for the period under review.

Page 5

Material event — decision drift

Auto-detected windows where decision outcomes diverged from the system's rolling baseline, with affected receipt references.

Page 6

Material event — denials & escalations

Unauthorised tool-call attempts and data-class escalations requiring human review, with timeline and resolution per event.

Page 7–8

Integrity proof & manifest

Hash-chain verification, signing key fingerprint, machine-readable manifest, auditor sign-off section.

View a sample pack →
Frequently asked

EU AI Act Article 12 — your questions, answered.

When does Article 12 enforcement actually begin?

Provisions of the EU AI Act apply in stages. Prohibitions began February 2025; obligations on providers and deployers of high-risk AI systems — including Article 12 record-keeping — apply from 2 August 2026. Most large-scale general-purpose AI obligations are already in force as of August 2025.

Is my system high-risk?

Annex III lists eight categories of high-risk systems including biometric identification, critical infrastructure, education and vocational training, employment and worker management, access to essential services (including creditworthiness assessment), law enforcement, migration, and administration of justice. AI used for claims triage at an insurer or for KYC at a financial institution is typically in scope.

Does Article 12 apply to UK firms?

Yes — extraterritorially. UK-based providers whose AI systems are placed on the EU market, or whose outputs are used in the EU, are in scope. UK firms also face parallel domestic obligations: ICO Article 22 of the UK GDPR for automated decision-making, FCA SYSC for operational resilience of AI-driven services, and the UK AI Regulation framework in consultation.

How are the penalties structured?

For non-compliance with the obligations on providers of high-risk AI systems (which includes Article 12), administrative fines reach up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For non-compliance with prohibitions under Article 5, fines reach up to €35 million or 7%. For supplying incorrect information, up to €7.5 million or 1%. Member States can apply higher amounts.

Can existing tooling produce an Article 12 pack?

The honest answer: no general-purpose observability or SIEM tool today produces output in the format the AI Office has signalled as adequate. Datadog, Splunk and similar log HTTP-level activity but do not capture per-agent decisions, classifications, or chain integrity in a regulator-presentable structure. Drata, Vanta and equivalent compliance automation platforms address static control evidence (SOC 2, ISO 27001) — not runtime AI action records.

FAQArticle 12 · compliance officer questions

Frequently asked, by EU compliance officers.

When does EU AI Act Article 12 enforcement begin?

2 August 2026. Article 12 of Regulation (EU) 2024/1689 imposes record-keeping obligations on providers and deployers of high-risk AI systems. The 24-month transition for high-risk AI ends on that date, after which national supervisory authorities can request evidence of compliance and impose administrative fines for non-conformity.

Which AI agents count as "high-risk" under Article 12?

An AI system is high-risk if it is intended to be used as a safety component of a regulated product (Article 6(1)) or falls within an Annex III use case — including biometric identification, critical infrastructure, education, employment, access to essential services, law enforcement, migration, justice administration, and democratic processes. For fintech, this most commonly captures creditworthiness scoring, claims triage, and certain insurance pricing models.

What exactly does Article 12 require us to log?

Article 12 requires high-risk systems to automatically record events ("logs") over the duration of the system's lifecycle that enable: identification of situations that may present a risk under Article 79, facilitate post-market monitoring under Article 72, and enable monitoring of operation under Article 26. In practice this means a complete, contemporaneous, tamper-evident record of every decision the system makes and every action it takes — which is exactly what Agent Audit produces.

How long must Article 12 records be kept?

Article 19 requires providers to retain logs for at least six months after the system is placed on the market or put into service, unless Union or national law provides for a longer period. Sector-specific obligations frequently extend this — UK FCA-regulated firms typically retain for 5–7 years under SYSC and MIFID II. Agent Audit's cold archive defaults to 7-year retention.

Is a Datadog/Splunk/SIEM trail enough for Article 12?

No. General-purpose observability tools capture HTTP requests, stack traces and performance metrics — not the agent-level fields Article 12 contemplates (decision outcome, data classification, confidence, sub-agent attribution). They also lack tamper-evidence: a regulator cannot verify the log was not edited after the fact. Agent Audit's hash-chain plus optional RFC 3161 notarisation provides the integrity proof a supervisor will expect.

Can I show this evidence to my auditor today?

Yes. Free Dev and paid tiers all generate a printable, machine- readable EU AI Act Article 12 evidence pack on demand for any (system, period) pair. The pack ships with a verifiable hash-chain proof and a JSON manifest your auditor can re-verify independently — no contact with Agent Audit required for the verification step.

Further reading: EU AI Act Article 12 explained — record-keeping requirements · Article 12 vs SOC 2 — what each one actually covers · Retention vs notarisation.

Article 12 readiness review — 30 minutes, no pitch.

We walk through your current AI agent inventory, identify Article 12 gaps against your stack, and produce a sample evidence pack against a representative slice of your operations. You leave with a clear go/no-go on readiness.

Start free → See a sample pack