Only where the agent is part of a high-risk AI system. Article 12 requires high-risk systems to be built so that events are recorded automatically over their lifetime. Providers must design that in; deployers must keep the logs under their control. Other agents are not caught, though a full record is still sound practice.
What does Article 12 require, in plain words?
Article 12 of the EU AI Act (Regulation (EU) 2024/1689) deals with record-keeping. In substance, a high-risk AI system must technically allow the automatic recording of events, or logs, throughout its lifetime. The logs must support a level of traceability suited to the system's purpose: identifying situations that may create risk or lead to a substantial change, supporting the provider's monitoring after the system is on the market, and helping deployers monitor how it operates.
Article 26 then requires deployers to keep the logs generated by the system, to the extent they are under the deployer's control, for an appropriate period with a minimum set by the Act, unless other law provides otherwise. The guide on how long to keep AI agent logs under the EU AI Act covers retention.
The Act's obligations phase in over several years, and application dates for high-risk obligations have been subject to proposed changes, so check the current timetable.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who does it apply to?
| Party | Duty |
|---|---|
| Provider of a high-risk system that includes an agent | Design the system so it logs events automatically |
| Deployer of that system | Keep the logs under its control for the required period; use them to monitor operation |
| Provider or deployer of an agent outside the high-risk categories | No Article 12 duty, though other laws and good practice point the same way |
High-risk uses include, among others, creditworthiness assessment and credit scoring of individuals, and risk assessment and pricing in life and health insurance. Deployer duties more broadly are set out in what the EU AI Act requires deployers of AI agents to do.
What does it mean when the system is an agent?
Article 12 was written with systems in mind that take an input and produce an output. An agent does more: it decides which sources to read, calls tools, takes actions, waits for approval and hands work on. A log of model inputs and outputs alone misses most of what an auditor would need to reconstruct a decision.
For an agent, a useful record captures each step: the task, the facts it used and where each came from, every tool call, the action proposed, the verdict (allowed, held, refused or withheld) and the bound that decided it, who approved held items, and the model and version used. Our view that Article 12 logging is not enough for agents makes the case, and what an agent's record must capture under Article 12 lists the fields.
How do you meet it?
| Requirement in substance | Control for an agent | Evidence it leaves |
|---|---|---|
| Automatic recording of events | Every step and verdict filed by the platform, not by the agent's own reporting | An append-only record |
| Traceability suited to purpose | Facts stored with their provenance; tool calls and approvals linked to the task | Reconstructable decisions |
| Support for monitoring | Signals drawn from the record: holds, refusals, edits | Weekly reviews |
| Deployer retention | Retention period set for logs under your control | Retention policy and configuration |
| Integrity | Records cannot be edited after filing | Tamper-evident storage |
The operational steps are in keeping automatic logs for an AI agent.
What does that look like in practice?
Say a lender in the Netherlands uses an agent within a high-risk credit system to prepare consumer loan decisions. Each application produces a record: the data gathered and its sources, the scorecard result, the agent's recommendation, the bound that held it for a credit officer, the officer's decision and time, and the model version. Months later a customer complains about a decline. The lender reconstructs the decision from the record in minutes, showing which fact drove it and who decided.
What does Article 12 not cover?
It does not define what makes a decision fair or accurate, set the content of explanations to customers, or replace data protection duties on how long personal data in logs may be kept. Those come from other parts of the Act and from GDPR.
The wider rules picture is in our guide to AI agent regulation.
Where Pryme fits
In Pryme, every verdict is filed in an append-only record by the platform, not by the agent. Each fact reaching an agent carries its provenance through the Pryme Context Protocol, from sealed records issued by a system of record to external claims such as an emailed document, so a decision can be traced back to what it rested on.
Questions people ask
Can the agent write its own log?
The agent can report what it did, but the authoritative record should be filed by the platform at each step. A log the agent writes about itself is evidence of what it says, not of what happened.
Do logs containing personal data conflict with GDPR?
They must meet GDPR too: a lawful basis, minimisation and a defined retention period. Balance the Act's retention duty with data protection rules, and record how you did it.
Should non-high-risk agents keep the same records?
It is good practice. Incidents, complaints and audits need the same reconstruction whatever the risk category, and other regimes such as DORA expect firms to trace what their systems did.