Article 12 — Record-Keeping

Legal Provision

Record-Keeping: establishes the obligation to implement record-keeping mechanisms that enable monitoring, auditing or potential investigations.

Scope

Applies to providers of the high-risk AI system.

Requirement type

Duty: during the operation and monitoring of the high-risk AI system.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Log generation mechanisms embedded into system design.
• Record of key system events, including inputs, outputs, decision paths.
• Secure, tamper-evident logging infrastructure.

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required to further verify compliance with each specific legal basis.

• Logging detail proportionate to the system's risk profile and functionality.
• Compliance with data minimisation principles (if logs contain personal data).
• Adequacy of retention duration to allow investigation and post-market traceability.
• Logging of human intervention and overrides.
• Review protocols to detect patterns of abnormal behaviour or drift.

Monitoring requirement

• Clearly defined logging policies, including purpose, scope, and retention schedules.
• Use of tamper-evident storage to preserve integrity of logs.
• Secure access control and access logs for every retrieval or inspection of logs.

Consequences of non-compliance

• Administrative fines up to €15 000 000 or 3% of total worldwide annual turnover.
• Penalties and enforcement measures adopted at the Member State level.