If you operate a high-risk AI system in the EU, Article 12 of the EU AI Act requires you to automatically log its activity over the system's entire lifetime. The obligation is broad, the December 2027 deadline is fixed, and most teams discover gaps only when they try to produce an audit trail under pressure.
This is a practical checklist. Work through it system by system. Each item is something a national market surveillance authority can ask you to demonstrate — so each is something you want to be able to answer before they ask.
For the full legal reasoning behind these requirements, see our complete Article 12 compliance guide. This page is the condensed, do-this-now version.
Phase 1 — Scope and inventory
Before you can log compliantly, you need to know what is in scope.
Inventory every AI system your organisation builds, deploys, or relies on, including embedded third-party models and internal tools.
Map each system against Annex III to determine whether it is high-risk. The eight categories include biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice.
Treat ambiguous cases as high-risk until legal advice confirms otherwise. Under-scoping is the more expensive mistake.
Record your provider/deployer role for each system. Your obligations differ. Deployers carry duties under Article 26 even when they did not build the system.
Flag biometric identification systems — Article 12(3) imposes additional minimum logging requirements on these.
Phase 2 — Logging capability
This is the core of Article 12: the system must technically allow automatic recording.
Confirm logging is automatic, generated by the system itself with no human deciding what to record.
Confirm every event is captured, not a sample and not only errors. Selective or sampling-based logging does not satisfy traceability.
Capture temporal data — request timestamp (UTC, millisecond precision), response timestamp, and latency.
Capture system identification — AI system ID, model version, system release version, and environment.
Capture input and output — sufficient to reconstruct the decision, with PII removed or pseudonymised.
Capture operational data — token counts, endpoint used, and compute or cost units.
Capture human oversight events — whether a human reviewed the output, whether they overrode it, and the final decision taken (this also supports your Article 14 obligations).
For biometric systems, additionally log the period of each use, the reference database checked, the input data that produced a match, and the persons verifying the result.
Phase 3 — Retention
Set a six-month minimum retention for all high-risk system logs (Article 26(6)). This is a floor, not a target.
Check sector-specific rules. Financial regulation (MiFID II, DORA) can require 5–7 years; healthcare may require longer.
Preserve logs under investigation beyond the standard period until any regulatory, judicial, or internal investigation concludes.
Build retention into the infrastructure from day one. Retrofitting retention rules later creates gaps.
Phase 4 — Tamper-evidence
Logs that can be silently altered have no evidentiary value.
Make logs append-only. Standard application logs that rotate and overwrite do not qualify.
Implement cryptographic hash chaining, so each entry includes a hash of the previous one and any modification breaks the chain detectably.
Enable independent verification, so a regulator can confirm the chain's integrity without trusting your word for it.
Record access to the logs — who accessed them and when, as part of the chain of custody.
Phase 5 — GDPR alignment
Article 12 does not override your data protection obligations.
Scrub PII before logging, not after. If raw data hits disk and is redacted later, the raw data still existed — a processing event in its own right.
Pseudonymise consistently — the same individual maps to the same pseudonym across the log, preserving investigative utility while minimising personal data.
Store logs in an EU jurisdiction with an EU-incorporated provider. A US provider's EU region is not sufficient — the US CLOUD Act applies regardless of physical location.
Add logging to your Record of Processing Activities (ROPA) with legal basis, retention, storage location, and access controls.
Complete a DPIA for high-risk AI processing, which almost certainly triggers the requirement.
Phase 6 — Audit readiness
The point of all of the above is to answer a regulator's questions quickly and credibly.
Define your report format and who is responsible for producing Article 12 compliance reports.
Be able to generate a regulator-ready export on demand, including the integrity proof and data residency evidence.
Run a tabletop exercise. Assume a regulator asks for the full decision log for one AI-assisted decision made six months ago. Can you produce it, in a usable format, quickly?
Confirm documentation consistency — your Article 11 technical documentation must accurately describe the logging capability you actually run.
The deadline
The EU AI Act entered into force on 1 August 2024. Following the Digital Omnibus amendment adopted in 2026, obligations for Annex III high-risk systems take effect on 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded as a safety component in physical products.
The extension is runway, not relief. Article 12 covers the lifetime of the system, so a team that starts logging in early 2026 will have nearly two years of clean, verified records when enforcement begins — while a team that starts on the deadline has an audit trail one day old. In any investigation, that difference matters.
The fast path
Most of this checklist — automatic capture, local PII scrubbing, tamper-evident storage, EU residency, and report generation — is exactly what Sovergate is built to deliver. The SDK instruments your existing LLM calls in two lines, scrubs PII inside your own infrastructure, stores logs on German bare-metal hardware, and produces monthly Article 12 audit packs automatically.
The build-it-yourself path is typically four to eight weeks of engineering plus ongoing maintenance of standards, retention, and report formats. The SDK path is about ten minutes.
Frequently asked questions
Yes. Article 12 requires automatic logging over the lifetime of the system. Sampling does not satisfy the traceability requirement for every AI decision.
Six months is the legal minimum under Article 26(6). Sector rules and active investigations frequently require longer, so treat six months as your baseline and extend where your obligations demand.
Yes. As a deployer you have obligations under Article 26, including ensuring the system generates Article 12 logs. If the provider's system does not, you must supplement it.
Article 12 breaches carry administrative fines of up to €15 million or 3% of total global annual turnover, whichever is higher.
This checklist is maintained by Sovergate, a European AI compliance platform providing Article 12 logging for companies using LLMs in high-risk contexts. It is for informational purposes only and does not constitute legal advice. Regulation referenced: EU Regulation 2024/1689 (EU AI Act), Articles 12, 14, 26; Annex III. Deadline: 2 December 2027.
Last updated June 2026.
Ready to tick off most of this checklist in ten minutes?
Two lines of code. PII scrubbed locally. Data stored in Germany. Monthly compliance reports ready for your legal team.