§ EU AI ACT / ARTICLE 12
EU AI Act Article 12: logging for AI agents.
Article 12 requires a high-risk AI system to record events automatically for as long as it runs, and Articles 19 and 26 require the logs to be kept for at least six months. Execlave records each instrumented agent run as a trace, writes every block, policy violation, approval and pause to a hash-chained audit trail, and exports both for an auditor.
§ THE REQUIREMENT
What Article 12 asks for
Article 12 of Regulation (EU) 2024/1689 is a design requirement: the system itself must be able to log. Who keeps the logs, and for how long, is set in Articles 19 and 26.
What Article 12 asks for
01 / Requirement
Automatic logs over the system's lifetime
Article 12(1): a high-risk AI system must technically allow events to be recorded automatically for as long as it is in use. Notes written by hand after the fact do not meet it.
02 / Requirement
Events that serve three purposes
Article 12(2): the logs must help identify situations that may create a risk or amount to a substantial modification, support the provider's post-market monitoring (Article 72), and let the deployer monitor operation (Article 26(5)).
03 / Requirement
Kept for at least six months
Providers (Article 19) and deployers (Article 26(6)) keep the logs under their control for a period suited to the system's purpose, and at least six months, unless other EU or national law, such as data protection law, says otherwise.
04 / Requirement
From 2 December 2027
Under Regulation (EU) 2026/1744, the obligations apply to stand-alone high-risk systems (Annex III) from 2 December 2027 and to high-risk AI in Annex I products from 2 August 2028. Article 12(3) adds minimum fields for remote biometric identification systems only.
§ COVERAGE
What Execlave records for each part
Execlave logs what passes through it: agent runs sent with the SDK or the ingest API, and actions checked against policy. An action that never reaches Execlave is not in its logs.
What Execlave records for each part
Automatic recording, 12(1)
What Execlave records
Each instrumented agent run as a trace: time, duration, status, model, tokens, cost, environment, agent version, input and output, errors, and the parent run in a multi-step chain.
How you show it
Trace export as CSV or JSON for a time window, up to 10,000 traces per request.
Risk situations, 12(2)(a)
What Execlave records
One audit entry for every block and every policy violation, with the agent, the policy, its version and its mode.
How you show it
Hash-chained audit trail. GET /api/v1/audit-logs/chain/verify checks the chain and its signed checkpoints.
Substantial modification, 12(2)(a)
What Execlave records
Every policy change with its state before and after, who made it and when. The agent version on every trace.
How you show it
Each policy's history (GET /api/v1/policies/:id/history) and the audit trail.
Post-market monitoring, 12(2)(b)
What Execlave records
Traces over time, and hourly counts of allowed enforcement decisions, so violations can be read against the number of checks.
How you show it
A compliance report signed with RSA-SHA256: policy inventory, enforcement statistics, approval records and agent registry.
Monitoring by the deployer, 12(2)(c)
What Execlave records
Every approval with the person who decided, and every pause of an agent through the kill switch, whichever path triggered it.
How you show it
An audit entry per approval and per pause. The dashboard shows pending approvals as they arrive.
| Article 12 asks for | What Execlave records | How you show it |
|---|---|---|
| Automatic recording, 12(1) | Each instrumented agent run as a trace: time, duration, status, model, tokens, cost, environment, agent version, input and output, errors, and the parent run in a multi-step chain. | Trace export as CSV or JSON for a time window, up to 10,000 traces per request. |
| Risk situations, 12(2)(a) | One audit entry for every block and every policy violation, with the agent, the policy, its version and its mode. | Hash-chained audit trail. GET /api/v1/audit-logs/chain/verify checks the chain and its signed checkpoints. |
| Substantial modification, 12(2)(a) | Every policy change with its state before and after, who made it and when. The agent version on every trace. | Each policy's history (GET /api/v1/policies/:id/history) and the audit trail. |
| Post-market monitoring, 12(2)(b) | Traces over time, and hourly counts of allowed enforcement decisions, so violations can be read against the number of checks. | A compliance report signed with RSA-SHA256: policy inventory, enforcement statistics, approval records and agent registry. |
| Monitoring by the deployer, 12(2)(c) | Every approval with the person who decided, and every pause of an agent through the kill switch, whichever path triggered it. | An audit entry per approval and per pause. The dashboard shows pending approvals as they arrive. |
§ RETENTION
How long Execlave keeps the logs
Audit trail entries are kept for one year on every plan. Traces follow the plan, and only Professional and Enterprise keep them for the six months that Articles 19 and 26 set as a minimum.
How long Execlave keeps the logs
| Plan | Traces | Audit trail |
|---|---|---|
| Free | 30 days | 1 year |
| Starter | 90 days | 1 year |
| Professional | 365 days | 1 year |
| Enterprise | 365 days or a custom period | 1 year |
Need logs for longer than that? Export them to your own archive before they age out. The trace and audit exports take a time window, and the audit package carries a SHA-256 hash of its contents so you can show it was not changed.
§ SET IT UP
How to set up Article 12 logging for an AI agent
First decide whether the agent is high-risk. Then make sure every run and every governed action leaves a record you can keep and hand over.
How to set up Article 12 logging for an AI agent
Classify the agent
Check whether its use is listed in Annex III or it is a safety component of an Annex I product, and write the decision down. Article 12 applies to high-risk systems; logging the others is still good practice.
Send every run as a trace
Instrument the agent with the JavaScript or Python SDK, or post its runs to POST /api/v1/traces/ingest. Input and output are stored with personal data redacted by default.
Check governed actions against policy
Call enforce before the actions that matter. Blocks, violations and approvals then land in the audit trail, each with the policy and its version.
Keep the logs for at least six months
Use a plan that keeps traces for 365 days, or export them to your own archive on a schedule. Audit trail entries are kept for one year on every plan.
Verify and export
Check the audit chain with GET /api/v1/audit-logs/chain/verify, export the traces and audit entries for the period in question, and generate a signed compliance report for the auditor.
§ QUESTIONS
EU AI Act Article 12, answered
EU AI Act Article 12, answered
What does EU AI Act Article 12 require?
Article 12 requires a high-risk AI system to record events automatically over its lifetime, so that risks, substantial modifications and its day-to-day operation can be traced. It is a requirement on how the system is built; Articles 19 and 26 then require providers and deployers to keep the logs for at least six months.
Does Article 12 apply to my AI agent?
Only if the agent is part of a high-risk AI system: a use listed in Annex III, such as recruitment, creditworthiness assessment or access to essential public services, or a safety component of a product covered by Annex I. Many agents are not high-risk, but the same logs still help you answer for what they did.
When does Article 12 apply?
From 2 December 2027 for stand-alone high-risk systems in Annex III, and from 2 August 2028 for high-risk AI in Annex I products. Regulation (EU) 2026/1744 moved the original date of 2 August 2026.
How long must AI agent logs be kept?
At least six months, for a period suited to the system's intended purpose, unless other EU or national law sets something else, such as data protection law. Financial institutions keep the logs as part of the records their sector rules already require.
Does Execlave log every action an agent takes?
It logs every run you send as a trace, and every governed action that is blocked, violates a policy or needs an approval, one audit entry each. Allowed enforcement decisions are counted in hourly totals rather than stored one by one. Anything the agent does without going through Execlave is not recorded.
Can the audit trail be changed afterwards?
Not through the application or the API. Entries are hash-chained, database triggers block updates and deletes, and checkpoints are signed every hour by default, so a change is detectable. Entries do leave at the end of the retention period, and erasing a user under the GDPR clears their IP address, user agent and email from their entries.
Does Execlave make an agent compliant with Article 12?
No tool does that on its own. Execlave provides the logging, retention and evidence for the agent actions that pass through it. Classifying the system, the technical documentation, the instructions for use and the other high-risk obligations stay with you.
This page summarises Articles 12, 19, 26 and 113 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. It is not legal advice; check the official text for your case.
Start the record before you need it
Six months of logs take six months to collect. Instrument one agent today and the history starts now.