← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act log retention: the six-month rule for deployers

*Engineering guidance, not legal advice.*

The EU AI Act splits logging duties between two roles:

Providers (who build or place a high-risk AI system on the market) must design it to record events automatically (Art. 12) and keep the logs under their control (Art. 19).
Deployers (who use a high-risk system in their own operations) must keep the logs automatically generated by the system, to the extent they are under their control, for a period appropriate to the intended purpose, of at least six months, unless other EU or national law requires otherwise (Art. 26(6)).

If you run an agent built on someone else's model, you are probably a deployer for that system, and possibly a provider for the agent you assembled around it. Your lawyers decide which; either way, you end up holding logs.

"At least six months" is the floor

Sector rules often ask for more: financial services, healthcare and employment decisions routinely require multi-year retention. The six months is the minimum when nothing stricter applies.

Retention is not just "keep the files"

A log kept for six months that anyone could have edited in those six months is weak evidence. When you retain logs for accountability, the useful properties are:

Verifiable later: someone can check integrity at month five without your running system (see tamper-evident logs).
Self-describing: the log says which system, model and version produced it.
Portable: plain files you can move between storage tiers without breaking verification.
Deletable on schedule: retention also means deleting personal data when the period ends, per GDPR.

A workable setup for agent logs

Record every run as a signed, hash-chained file at the call site.
Store runs in object storage with lifecycle rules (for example 6 or 24 months), optionally with object lock.
Periodically verify a sample and keep the verification output.
For runs that matter (incidents, disputes, audits), obtain an external counter-signature so the chain head is anchored outside your control.

Where Vetro fits

Vetro ledgers are plain JSONL files, verifiable offline with a public key, so they survive storage moves intact. Vetro Attest verifies a run for free; the 49 USD report adds an ed25519 counter-signature and maps the evidence to Articles 12, 19 and 26, with a gap list of what the log cannot demonstrate.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.