Direct answer
Do we have to keep logs of our AI system?
This falls under Article 12: logging and traceability. That obligation applies from 2 December 2027. There is one exception you have to assess yourself.
This could go the other way
- The retention period may be limited by Union or national law, including data protection.
First step: Design logging into the system.
You describe: You want to know which events your high-risk AI system must record automatically, and how long you keep that record. Likely role: provider (you place the system on the market).
This applies now
- For this situation, the preparation phase matters most right now.
Coming up
- Article 12: logging and traceabilityfrom 2 December 2027
- Article 72: post-market monitoringfrom 2 December 2027
- Article 11: technical documentationfrom 2 December 2027
Logging is not a standalone IT measure but the evidence layer under everything else: without records you cannot reconstruct afterwards what happened, and therefore cannot substantiate an incident report or a complaint.
Your first actions
- Design logging into the system. Ensure the system automatically records events relevant to risk identification and post-market monitoring.
- Draw up a post-market monitoring plan. Systematically collect and analyse real-world data on the system’s performance and compliance throughout its lifetime.
- Build the technical file per Annex IV. Document system description, development process, data, oversight measures, performance and risk management before market placement.
Record this
- Logs and retention regime
- Monitoring plan and reports
- Technical file (Annex IV)
prEN 18229-1: AI trustworthiness framework part 1, logging
prEN 18229-1 (AI trustworthiness framework, Part 1: Logging) is the JTC 21 deliverable under M/613 for Article 12 of the AI Act: high-risk AI systems must technically allow for the automatic recording of events over their lifetime. As at June 2026 the deliverable was at the Enquiry stage. It has not yet been published as an EN and is not cited in the Official Journal.
General interpretation, not legal advice. Checked against Regulation (EU) 2024/1689 and the Digital Omnibus (EU) 2026/1744; the official source remains authoritative.
Full map for your situationExecution
From obligation to arranged and demonstrable
Knowing where you stand is step one. Embed AI translates this obligation into a concrete approach for your organisation: scope, ownership, register and evidence.
See the Embed AI approach