← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools
EU AI Act Article 19: log retention for providers
Article 12 requires high-risk AI systems to generate logs automatically (see Article 12 logging). Article 19 says what the provider must do with them: keep the logs automatically generated by the system, to the extent they are under the provider's control, for a period appropriate to the intended purpose and of at least six months, unless otherwise provided in Union or national law, in particular data protection law.
Providers that are financial institutions subject to EU financial services law keep the logs as part of the documentation required under that law.
Provider vs. deployer
- Provider (Art. 19): keeps the logs it controls, for example when the agent runs as a hosted service.
- Deployer (Art. 26): keeps the logs under its control, for example when it runs the agent in its own environment (see Article 26 retention).
In a SaaS agent both can apply to different copies of the same events. Decide in the contract who holds which copy.
Six months is a floor, not a format
Keeping bytes for six months is easy. Keeping them in a form that proves they were not changed during those six months is the actual requirement behind traceability. Three properties matter:
- Verifiable without your running system: a file plus a public key, not a database query.
- Integrity per run: hash chaining and a signature, so a single edited event is detected (see tamper-evident logs).
- Minimised content: data protection law still applies, so record what traceability needs and no more (see GDPR and agent logs).
Storage choice (object lock, WORM) is complementary; see hash chain vs. WORM.
Check your own logs
Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 49 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.
See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.