EU AI Act Article 12 Explained: What Logging Actually Requires

Article 12 of Regulation (EU) 2024/1689 addresses record-keeping for high-risk AI systems. It requires high-risk AI systems to technically allow automatic recording of events over the system lifecycle and requires logging capabilities to support traceability appropriate to the intended purpose of the system.

The important distinction: Article 12 requires automatic logging and specifies traceability-related records. It does not state that every record must use SHA-256, RFC 3161, a hash chain, or independent cryptographic verification.

What Article 12 says

For high-risk AI systems, Article 12 requires automatic recording of events. The logging capability must support traceability and enable recording of events relevant to identifying risks, facilitating post-market monitoring, and monitoring system operation. Certain high-risk biometric systems have additional minimum logging requirements.

What this means operationally

The central requirement is that relevant events can be recorded automatically and retained in a way that supports the intended traceability and oversight objectives. The exact records and implementation depend on the system and its intended purpose.

What Article 12 does not say

Where KairoNull fits

KairoNull is designed to support the evidence and traceability layer around applicable AI governance obligations. It records the decision context your integration sends, links records to governance controls, and provides integrity and verification mechanisms that can make later alteration detectable.

Those mechanisms are product capabilities. They may be valuable where an organisation wants stronger evidence integrity or independent verification, but they should not be represented as technical requirements imposed by Article 12 itself.

The practical review question

For a high-risk AI system, ask whether your current stack can automatically record the relevant events, retain the information needed for appropriate traceability, and reconstruct system operation when reviewed. If it can, the remaining question is whether stronger integrity or independent verification provides enough additional value to justify a separate evidence layer.