Since 2 August 2026, obligations under the EU AI Act have real dates attached. For anyone running AI agents in a high-risk context, Article 12 — record-keeping is the one that turns “we should log this” into “we are required to, and it has to hold up.” Here’s what it actually asks for.
What Article 12 requires
High-risk AI systems must automatically record events (logs) over their lifetime, and those logs must ensure a level of traceability appropriate to the system’s purpose. In practice that means:
- Logging is automatic, not something a human remembers to switch on.
- The record captures the events that matter for risk assessment — not just the final output, but the inputs, parameters and actions that led to it.
- The log is tamper-evident: you can show it wasn’t quietly altered after the fact.
- Minimum retention is six months (longer — up to 24 — for some categories).
Penalties for non-compliance reach €15 million or 3% of global turnover. That’s the number that gets record-keeping into this quarter’s budget rather than next year’s.
Why AI agents make this harder
A single-shot model returns one output you can log. An agent takes a sequence of consequential actions — it reads files, calls tools, runs commands. To be traceable, the log has to capture each of those with its arguments and its authorising decision, not just “the agent completed the task.” Most agent setups log almost none of this today. Read what an agent actually does to see the gap.
What a compliant log actually looks like
Tamper-evident isn’t “we write to a file.” A file can be edited. The properties that hold up:
- Hash-chained. Each record carries the previous record’s digest and its own, so editing, deleting or reordering any past line breaks every digest after it.
- Verifiable. A verify step walks the whole structure and names the exact line where the chain broke — evidence you can hand an auditor.
- Signed. A signature with a key the agent (or an attacker in its position) cannot read is what turns evidence into proof.
- Continuous across rotation. The chain survives log rotation, and the rotation ledger is itself chained, so you can’t drop an inconvenient segment.
- Exportable. To your SIEM (CEF / syslog) with escaping that stops a crafted input forging fields.
How to produce one
You can build this, or use a control that produces it as a by-product of enforcement. airlock_ai gates every agent action and writes exactly this kind of record: hash-chained, verifiable to the exact altered line, optionally Ed25519-signed, continuous across rotations, and exportable to your SIEM. It maps directly onto Article 12’s traceability requirement for the agent layer — and lines up with ISO 42001, NIST AI RMF and SOC 2 CC7.
If your obligation is to demonstrate control of an agent deployment, pairing that log with an independent AI agent penetration test gives you both the evidence and the assurance an auditor is looking for.
Frequently asked questions
Does a normal application log satisfy Article 12? Rarely — it’s editable and usually doesn’t capture agent actions with traceability. Tamper-evidence is the differentiator.
Isn’t enforcement of the Act being delayed? Some provisions may shift, but organisations are already preparing, and the record-keeping requirement is a long-lead item — you can’t retroactively produce six months of tamper-evident logs.
Need a tamper-evident record for your agents? See airlock_ai or talk to us about an agent assessment.