What does thelogging obligationrequire?
The EU AI Act only requires automatic logs for high-risk systems, and even there not before December 2027.
Get in touch
Let's talk about your project.
First we check whether the project fits your business model. Then you get a proposal with phases and effort.
Discuss AI governance or call: +49 151 1576 5566The logging obligation in the EU AI Act requires high-risk AI systems to be able to record events automatically over their whole lifetime. Providers and deployers keep those logs for at least six months. None of this applies yet.
- Only high-risk systems are covered.
- After the Digital Omnibus, the rules apply from 2 December 2027 (Annex III) and from 2 August 2028 (Annex I).
- Six months is the minimum, and data protection law sets a limit in the other direction.
Which systems fall under the logging obligation?
Only high-risk systems, and there are two ways to spot them. Annex I covers AI that is a safety component of a product already subject to EU product law. Annex III lists areas where AI takes part in decisions about people, for companies mainly recruitment and performance assessment, the creditworthiness of individuals and pricing in life and health insurance.
Even there an exception applies: under Article 6(3), an Annex III system is not high-risk if it does not materially influence the outcome of a decision. And a chat that answers product questions appears on neither list.
When do AI systems have to keep logs?
In 2026, logging of AI systems is not yet a direct duty for anyone. The high-risk rules for Annex III were originally due on 2 August 2026; Regulation (EU) 2026/1744 moved them to 2 December 2027, and those for Annex I to 2 August 2028.
Systems already in service before then are only covered under the revised Article 111(2) if their design changes significantly afterwards, and what counts as significant is still open. If you plan to replace HR or credit software anyway, ask about logging when you buy.
What does a useful AI log record?
A fixed field list exists only for remote biometric identification. As a rule of thumb, though, record when the system ran, with which version and settings, what went in, what came out and who approved the result, and for AI agents which tools they called.
Keep personal content to a minimum, since a reference to the case is often enough, and that makes deletion easier, because storage limitation under the GDPR applies to logs too.
Frequently asked questions
Who keeps automatically generated logs?
The provider and the deployer, each to the extent the logs are under their control, under Article 19 and Article 26(6). If the system runs on the provider's side, agree access in the contract.
Do I have to keep the logs of my website chatbot?
Not under the EU AI Act, as long as the chatbot is not a high-risk system. If it stores personal data, the GDPR applies to those data, including accountability.
Terms you should know in the same context
EU AI Act · Providers, deployers, importers and distributors (AI Act) · AI governance · Agentic AI · AI agent · Back to the AI glossary A to Z
A log nobody reads protects little; one that shows who approved what answers most follow-up questions on its own.