Obligations & assessments

Record-keeping (logging)

AI ActArt. 12 · Arts. 19, 26(6)

High-risk systems must technically allow automatic recording of events over their lifetime, so risks and substantial modifications can be traced. Providers and deployers keep the logs under their control for at least six months.

Often confused with

Storage limitation

The AI Act requires keeping logs for at least six months; GDPR says personal data shouldn't be kept longer than needed. Retention policies have to satisfy both.

Connected terms · 9

AI usage record Deployer Enterprise AI licence High-risk AI system Post-market monitoring Provider Role-based access control Serious incident reporting Substantial modification