High-risk AI record keeping is useful only when events remain connected to the system, time, context, source and accountable action they represent. TA-14 treats logging as part of a governed evidence chain rather than an archive of unexplained machine events.
Use the current consolidated Regulation as the controlling source. Article 12 addresses high-risk system record-keeping capability, while provider and deployer retention responsibilities are addressed in related provisions including Articles 19 and 26.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
A timestamp and event can be meaningless without system identity, version, context, source and the operational state in which the event occurred. Preserve the relationship between the record and the reality it represents.
Article 12 requires high-risk AI systems to technically allow automatic recording of events over the system lifetime, with logging capabilities appropriate to traceability and risk monitoring under the applicable provisions.
The system may generate logs, while providers and deployers can have distinct retention and access responsibilities. Map the record to the actor who actually controls it rather than assuming one universal owner.
Records should preserve chronology, provenance, access, material changes and relevant human interventions so later review can distinguish an authentic historical state from a reconstructed story.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Identify the system, version, use context, risk, decision or incident that the record needs to support before choosing what to log.
Connect each relevant event to its origin, timestamp, system state, input/output context where appropriate and accountable actors so the record can be interpreted later.
Determine which provider or deployer records are under the organization’s control, the applicable retention rule and how integrity and authorized access will be maintained.
When records reveal drift, risk, misuse, incident conditions or material change, route the signal to investigation, authority, corrective action and renewed governance rather than leaving it trapped in storage.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
Article 12 requires high-risk AI systems to technically allow automatic recording of events over the system lifetime. The logging capability must support the traceability and monitoring purposes described in the applicable provision.
Retention depends on the actor and applicable provision. The Regulation contains specific provider and deployer record-retention duties, including deployer retention of automatically generated logs under their control for an appropriate period and at least six months unless other applicable Union or national law provides otherwise. Check the current consolidated text for the exact case.
No. Logs are operational records of events. Technical documentation is a broader evidence package describing the system and its compliance-relevant characteristics. They should connect, but one does not replace the other.
Article 26 contains a deployer duty concerning logs automatically generated by a high-risk AI system to the extent those logs are under the deployer’s control, subject to the applicable retention conditions and other law.
Without provenance, a reviewer may not be able to establish where a record came from, which system version generated it, whether it was altered, or what operational context it represented. Those relationships affect whether the record can support a consequential conclusion.
TA-14 can structure evidence records, provenance, chronology, accountable action, gaps and revalidation state. Whether a particular implementation satisfies a statutory technical logging or retention requirement depends on the system, actor, applicable provision and technical architecture.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views