← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools
EU AI Act Article 12: what "automatic logging" means for AI agents
*Engineering guidance, not legal advice.*
Article 12 of the EU AI Act ("Record-keeping") says that high-risk AI systems must technically allow the automatic recording of events (logs) over the lifetime of the system. The purpose is stated in the same article: traceability of how the system functions, appropriate to its intended purpose, including identifying situations that may present a risk.
Three words in that sentence do most of the work for an engineering team.
"Automatic"
A log that exists only because a developer remembered to call logger.info() is not automatic recording, it is developer discipline. Agents make this worse: the interesting events (which model was called, which tool ran with which arguments, what came back) happen inside framework code, and coverage drifts every time someone adds a tool.
What satisfies "automatic" in practice is recording at the call site: wrap the model client and the tool dispatcher once, so every call produces an event whether or not anyone thought about it.
"Events"
For an LLM agent, the useful event set is small and concrete:
| Event | Why a reviewer wants it |
|---|---|
| Model call (model, parameters, input, output, tokens) | Reconstruct what the system was asked and what it answered |
| Tool call (name, arguments, result or error) | The agent's actions in the world, the part with real consequences |
| Policy decision (allowed / warned / blocked, and why) | Evidence that risk controls actually ran, including refusals |
| Run start / end, errors | Boundaries of each "decision" and its outcome |
| Cost and usage | Resource accountability per run |
"Traceability"
Traceability means someone who was not there can reconstruct a run later, in order, and trust that what they read is what happened. Ordinary application logs fail the second half: they are mutable files or rows, and nothing distinguishes an original line from an edited one.
That is why integrity matters even though Article 12 does not use the word "tamper-proof": a log you cannot trust does not provide traceability, it provides a story. See tamper-evident logs for how to make edits detectable.
Who has to do what
- Providers of high-risk systems must build the logging capability in (Art. 12) and keep the logs under their control (Art. 19).
- Deployers must keep the automatically generated logs under their control for at least six months, unless other law says otherwise (Art. 26). See log retention for deployers.
Most obligations bite only for systems classified as high-risk, and the high-risk dates have moved (see what changed in 2026). Logging is still the cheapest obligation to get ahead of, because it cannot be added retroactively: runs that were not recorded are gone.
Checking what you already have
Vetro Attest verifies an agent log for free: upload a Vetro ledger or an OpenTelemetry GenAI trace and it shows which of these events are present, whether the log's integrity checks out, and what is missing. For 49 USD it issues a counter-signed EU AI Act evidence report you can hand to compliance.
What it does not do: classify your system's risk tier or make it "compliant". Compliance is an organisational property; a log is evidence for part of it.
See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.