EU AI Act Logging Requirements: What Engineers Need to Build

Most AI compliance guides describe what Article 12 of the EU AI Act requires in legal language. This post translates those requirements into engineering specifications — what data to capture, where to store it, how long to keep it, and what format it should be in.

What Article 12 Actually Requires

Article 12 requires high-risk AI systems to automatically generate logs that enable monitoring for compliance. The logs must capture operations throughout the lifecycle, be protected from unauthorized access, and be retained for an appropriate period. For general high-risk systems, that period is at least 6 months. For biometric and law enforcement systems, longer periods apply.

Engineering Specification: Required Log Events

• ▸Every inference request: timestamp, model version, input data characteristics (not necessarily full content), output decision, confidence score
• ▸Human oversight interventions: when a human reviews or overrides the AI system's output, log the intervention with timestamp, operator ID, original output, and modified output
• ▸System state changes: model version updates, configuration changes, policy updates
• ▸Errors and anomalies: any deviation from expected behavior, including inputs that triggered safety filters
• ▸Access events: who accessed the system, when, and what actions they took

Tamper Evidence Requirements

The regulation requires logs to be protected from unauthorized modification. The practical engineering interpretation is tamper-evident logging — logs that can prove they have not been modified. Implementations range from simple cryptographic hash chaining to dedicated audit log services with write-once storage.

# Simple hash-chaining approach for tamper-evident logs
import hashlib, json, time

prev_hash = "genesis"

def write_log_entry(event: dict) -> dict:
    entry = {
        "timestamp": time.time(),
        "event": event,
        "prev_hash": prev_hash,
    }
    entry["hash"] = hashlib.sha256(
        json.dumps(entry, sort_keys=True).encode()
    ).hexdigest()
    # Store entry in append-only log
    return entry

Data Minimization Tension

Article 12 requires logging for compliance monitoring, but GDPR requires data minimization. These obligations create tension — you must log enough to demonstrate compliance, but not so much that you create unnecessary retention of personal data. The resolution: log data characteristics and outcomes rather than full input content wherever possible.