← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

GDPR and AI agent logs

Agent logs are full of personal data: user messages, retrieved customer records, tool arguments such as email addresses and IDs. The AI Act asks high-risk systems to keep logs for at least six months (Article 19, Article 26). GDPR asks for data minimisation (Art. 5(1)(c)) and storage limitation (Art. 5(1)(e)). Both texts say the logging duty applies without prejudice to data protection law.

The two are compatible if the log is designed for traceability rather than as a copy of everything.

Record actions, not necessarily content

Traceability needs to know what the agent did: which model, which tool, which arguments, which policy fired, what the outcome was. It often does not need the full text of every prompt.

• Record tool names and arguments of actions that affect people; these are the evidence.
• For prompts and model output, consider recording a hash instead of the text. The hash still proves what was sent if the original is later produced, and reveals nothing on its own.
• Keep full content only where the purpose needs it, for a shorter period, in a separate store.

Vetro's adapters take a recordContent option for exactly this choice.

Integrity and erasure

A tamper-evident log detects any change, including a legitimate erasure. Designing for that in advance avoids the conflict: if personal data sits in content fields that are stored as hashes, or in a separate content store referenced by hash, erasing the content does not break the chain.

Access

Logs that explain what an agent did to a person are also useful to answer that person's access request. Record a stable reference to the data subject where appropriate, so you can find their runs without full-text search through prompts.

See the DPO checklist for AI agents for the full review.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 29 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.