Reg. (EU) 2024/1689 · Article 12 · high-risk application 2 Dec 2027

EU AI Act Article 12
evidence, automated.

Every action your high-risk AI system takes — captured, hash-chained, and ready as an auditor-acceptable evidence pack in one click. No spreadsheet rebuilds. No consultant retainers. No rewrites when guidance evolves.

Book a 30-minute walkthrough What does Article 12 require?
Article 12 logging Annex IV technical docs Post-market monitoring Notified-body ready
The deadline

2 December 2027 — and your existing logs probably don't qualify.

Updated for the Digital Omnibus (Regulation (EU) 2026/1744), in force 27 July 2026 — the high-risk application date moved from 2 August 2026 to 2 December 2027. The obligations are unchanged; only the dates moved.

Article 12 of Regulation (EU) 2024/1689 requires providers and deployers of high-risk AI systems to maintain automatic event logs. The obligations are operational, not paper-based — and the penalty regime is at the higher end of EU regulatory law. Applies to UK firms whose AI systems are placed on the EU market or whose outputs are used in the EU.

€15 M

Maximum fine for breach of provider obligations, including Article 12

3%

Of global annual turnover — whichever is higher

6 mo

Minimum log retention period mandated by the Article

The obligations

What Article 12 actually requires.

Article 12 mandates automatic event logging for the full operational lifetime of a high-risk AI system. The Commission and the AI Office have published guidance clarifying what counts as adequate — Agent Audit is engineered against those requirements.

1. Automatic event logging

Records must be generated automatically while the system is operating. They cannot be reconstructed after the fact from disparate sources. Agent Audit captures events at the SDK boundary, in real time.

2. Identification of risk situations

Logs must support identification of situations that may result in the AI system presenting a risk under Article 79 or undergoing substantial modification. Agent Audit's decision-drift detection and material event surfacing are built for this requirement.

3. Period of input data recording

Logs must include the period of recording, reference data used, search parameters, and the natural persons involved in the verification of results. Agent Audit's receipt schema captures all of these as first-class fields.

4. Retention

Records must be kept for a period appropriate to the intended purpose, and at minimum six months unless otherwise specified by Union or Member State law. Agent Audit retains receipts for seven years by default, configurable per data class.

5. Availability to authorities

Logs must be made available to national competent authorities on request, in a form they can interpret. Agent Audit's Article 12 evidence pack renders to PDF in the format the AI Office's pilot reviews have indicated as auditor-acceptable.

6. Point-in-time authority

Article 12 logs must let a supervisor go back to a past risk situation and see what the system was permitted to do then. Agent Audit pins what authority the agent held at the instant it acted — in force, in scope, delegated up the chain — not rebuilt afterward, plus the verifiable lineage of every correction, dispute and revocation since.

The pack

Eight pages your auditor recognises.

We've engineered the Article 12 evidence pack from the regulation itself, the AI Office's published guidance, and conversations with external auditors at compliance review pilots. One click renders it from your live receipts.

Page 1–2

Cover & executive summary

System name, period, issuer, integrity status. Three-officer sign-off block ready for compliance, DPO and InfoSec.

Page 3

System inventory

Annex IV-style technical documentation: provider, risk class, framework, model versions, tool inventory, data classifications touched.

Page 4

Operational summary

Throughput, decision distribution, tool usage, operating cost, by-week breakdown for the period under review.

Page 5

Material event — decision drift

Auto-detected windows where decision outcomes diverged from the system's rolling baseline, with affected receipt references.

Page 6

Material event — denials & escalations

Unauthorised tool-call attempts and data-class escalations requiring human review, with timeline and resolution per event.

Page 7–8

Integrity proof & manifest

Hash-chain verification, signing key fingerprint, machine-readable manifest, auditor sign-off section.

Bound in alongside the pages: an as-of authority record — the authorisation in force, in scope, and delegated up the chain at decision time, reproducible offline byte-for-byte.

View a sample pack →
Frequently asked

EU AI Act Article 12 — your questions, answered.

When does Article 12 enforcement actually begin?

Provisions of the EU AI Act apply in stages. Prohibitions began February 2025; obligations on providers and deployers of stand-alone high-risk (Annex III) AI systems — including Article 12 record-keeping — apply from 2 December 2027, moved from 2 August 2026 by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026). High-risk AI embedded in regulated products (Annex I) applies from 2 August 2028. Most large-scale general-purpose AI obligations have been in force since August 2025. The obligations themselves are unchanged; only the dates moved.

Did the Digital Omnibus delay everything to 2027?

No — only the high-risk obligations (Annex III, and Annex I embedded systems) moved. The Article 50 transparency obligations — telling people when they are interacting with AI or seeing AI-generated content — still apply from 2 August 2026, and most general-purpose AI obligations have been in force since August 2025. Don't read "2 December 2027" as a blanket reprieve.

Is my system high-risk?

Annex III lists eight categories of high-risk systems including biometric identification, critical infrastructure, education and vocational training, employment and worker management, access to essential services (including creditworthiness assessment), law enforcement, migration, and administration of justice. AI used for claims triage at an insurer or for KYC at a financial institution is typically in scope.

Does Article 12 apply to UK firms?

Yes — extraterritorially. UK-based providers whose AI systems are placed on the EU market, or whose outputs are used in the EU, are in scope. UK firms also face parallel domestic obligations: ICO Articles 22A–22D of the UK GDPR (as replaced by the Data (Use and Access) Act 2025, in force 5 February 2026) for automated decision-making, FCA SYSC for operational resilience of AI-driven services, and the UK's sectoral AI approach — the FCA supervises AI through existing frameworks (SYSC, SM&CR, Consumer Duty) rather than a bespoke AI rulebook.

How are the penalties structured?

For non-compliance with the obligations on providers of high-risk AI systems (which includes Article 12), administrative fines reach up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For non-compliance with prohibitions under Article 5, fines reach up to €35 million or 7%. For supplying incorrect information, up to €7.5 million or 1%. Member States can apply higher amounts. The Digital Omnibus extended the AI Act's lower, proportionate caps for SMEs to small mid-caps (up to 500 employees) as well.

Can existing tooling produce an Article 12 pack?

The honest answer: no general-purpose observability or SIEM tool today produces output in the format the AI Office has signalled as adequate. Datadog, Splunk and similar log HTTP-level activity but do not capture per-agent decisions, classifications, or chain integrity in a regulator-presentable structure. Drata, Vanta and equivalent compliance automation platforms address static control evidence (SOC 2, ISO 27001) — not runtime AI action records.

FAQArticle 12 · compliance officer questions

Frequently asked, by EU compliance officers.

When does EU AI Act Article 12 enforcement begin?

2 December 2027 for stand-alone high-risk (Annex III) systems — moved from 2 August 2026 by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026). Article 12 of Regulation (EU) 2024/1689 imposes record-keeping obligations on providers and deployers of high-risk AI systems. After the application date, national supervisory authorities can request evidence of compliance and impose administrative fines for non-conformity. High-risk AI embedded in regulated products (Annex I) applies from 2 August 2028.

Which AI agents count as "high-risk" under Article 12?

An AI system is high-risk if it is intended to be used as a safety component of a regulated product (Article 6(1)) or falls within an Annex III use case — including biometric identification, critical infrastructure, education, employment, access to essential services, law enforcement, migration, justice administration, and democratic processes. For fintech, this most commonly captures creditworthiness scoring, claims triage, and certain insurance pricing models.

What exactly does Article 12 require us to log?

Article 12 requires high-risk systems to automatically record events ("logs") over the duration of the system's lifecycle that enable: identification of situations that may present a risk under Article 79, facilitate post-market monitoring under Article 72, and enable monitoring of operation under Article 26. In practice this means a complete, contemporaneous, tamper-evident record of every decision the system makes and every action it takes — which is exactly what Agent Audit produces.

How long must Article 12 records be kept?

Article 19 requires providers to retain logs for at least six months after the system is placed on the market or put into service, unless Union or national law provides for a longer period. Sector-specific obligations frequently extend this — UK FCA-regulated firms typically retain for 5–7 years under SYSC and MIFID II. Agent Audit's cold archive defaults to 7-year retention.

Is a Datadog/Splunk/SIEM trail enough for Article 12?

No. General-purpose observability tools capture HTTP requests, stack traces and performance metrics — not the agent-level fields Article 12 contemplates (decision outcome, data classification, confidence, sub-agent attribution). They also lack tamper-evidence: a regulator cannot verify the log was not edited after the fact. Agent Audit's hash-chain plus optional RFC 3161 notarisation provides the integrity proof a supervisor will expect.

Can I show this evidence to my auditor today?

Yes. Free Dev and paid tiers all generate a printable, machine- readable EU AI Act Article 12 evidence pack on demand for any (system, period) pair. The pack ships with a verifiable hash-chain proof and a JSON manifest your auditor can re-verify independently — no contact with Agent Audit required for the verification step.

A regulator is asking about a decision from months ago — what can I produce?

One as-of record. It pins what the agent was authorised to do at the instant it acted — in force, in scope, delegated up the chain — and carries the verifiable order of every correction, dispute and revocation since, with nothing silently dropped. It ships with independent verification that the record has not been altered, omitted from, or backdated. You produce what was authorised when, and everything that happened after, as a single signed artefact — you do not reconstruct it after the fact.

Further reading: EU AI Act Article 12 explained — record-keeping requirements · Article 12 vs SOC 2 — what each one actually covers · Retention vs notarisation.

Article 12 readiness review — 30 minutes, no pitch.

We walk through your current AI agent inventory, identify Article 12 gaps against your stack, and produce a sample evidence pack against a representative slice of your operations. You leave with a clear go/no-go on readiness.

Book a 30-minute walkthrough → See a sample pack