Keep them for a period appropriate to the agent's intended purpose, never below the minimum floor the EU AI Act sets for deployers of high-risk systems, and longer where other law, such as financial services record-keeping, requires it. Then minimise what the logs contain, because GDPR's storage limitation still applies to the personal data inside them.
What does the EU AI Act require on logs?
Two provisions work together.
Article 12 requires high-risk AI systems to be designed so that they automatically record events over their lifetime. The logs must allow events to be traced: situations that may present a risk or lead to a substantial modification, post-market monitoring by the provider, and monitoring of operation by the deployer.
Article 26 requires deployers to keep the logs automatically generated by a high-risk system, to the extent the logs are under their control, for a period appropriate to the system's intended purpose. The Act sets a minimum period, measured in months, that applies unless other EU or national law provides otherwise, in particular data protection law. Financial institutions subject to internal governance rules under financial services law can keep the logs as part of the documentation they already maintain under that law.
Providers carry a parallel duty to keep the logs under their control. Our explainer on whether Article 12 requires AI agents to keep logs covers when the duty is triggered at all.
Who does it apply to?
Providers and deployers of high-risk AI systems. If your agent is not high-risk, the Act's log retention duty does not apply, but logs remain the best evidence you have for complaints, audits and other laws. Customer service agents are often outside the high-risk class; see EU AI Act for AI agents in customer service. For the overall structure of the Act, see what the EU AI Act is.
What makes agent logs different?
A scoring model's log is a row: inputs, score, time. An agent's log is a sequence: what it was asked, which sources it read, what it concluded, which tools it called, what limits applied, what it did and who approved. Three consequences follow for retention.
Agent logs are larger and richer in personal data. They contain retrieved records, free text and customer statements. Keeping everything for years multiplies data protection exposure.
The useful part is the decision trail, not the transcript. Investigations usually need to know what the agent did, under which limits and on which facts. They rarely need every token of intermediate reasoning.
Logs sit in several places. The platform, the model provider and your own systems may each hold part of the record. Retention must be set for each.
How do you set and justify the period?
Work from the reasons you need the log, then take the longest justified period for each part.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| AI Act minimum for deployers | Retention never below the floor for logs under your control | Retention policy citing the duty |
| Appropriate to intended purpose | Period set per agent from its use, risk and complaint windows | Retention rationale per agent |
| Other law that requires longer | Financial services, AML and complaint record periods applied to the relevant log parts | Mapping of log fields to legal periods |
| GDPR storage limitation | Personal data in logs minimised; full transcripts kept only as long as needed | Field-level retention; deletion runs |
| Integrity of logs | Append-only storage; changes detectable | Storage configuration; integrity checks |
| Access to logs | Read access restricted and itself logged | Access logs |
| Provider-held logs | Contract sets what the platform keeps, for how long, and access on request | Contract terms; access tests |
A tiered design reconciles the pressures. Keep a compact decision record for the longest required period: the action, the facts relied on and their sources, the limits that applied, the verdict and the approver. Keep full transcripts and intermediate traces for a shorter period that covers investigation and complaint windows. Delete or pseudonymise the rest. Our guide on how to keep automatic logs for an AI agent shows what each tier should contain.
What does a worked retention schedule look like?
Take an illustrative credit agent at a bank. Its decision records are kept for the period financial services law requires for credit files, which is well beyond the AI Act floor. Full conversation transcripts are kept for the complaint window plus a margin. Intermediate reasoning traces are kept for a few months for monitoring, then deleted. Access to all tiers is restricted to model risk, compliance and named investigators.
Each period has a written reason. That written reason is what a supervisor will look for, more than the number itself.
What will a supervisor or auditor ask?
- Is this agent high-risk, and are you provider, deployer or both?
- How long do you keep its logs, and why that period?
- Which parts of the log contain personal data, and how long are those kept?
- Can you reconstruct a decision made a year ago: facts, limits, action and approver?
- Who can read the logs, and is that access logged?
- What does the platform keep, and can you get it when needed?
What does the log retention duty not cover?
It does not set a maximum period; GDPR and your own purposes do. It does not require keeping logs that are not under your control, though you should know who holds them. It does not define what an agent must log beyond Article 12's purposes. For a full list of duties, see the EU AI Act compliance checklist for AI agents, and for the wider map, AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme every verdict is filed in an append-only record: the action, the bound that decided under the minimum chain, the provenance of the facts used and the person who released any held action. That record is compact enough to keep for long periods, while fuller transcripts can follow a shorter schedule you set.
Questions people ask
Does the minimum period start from the event or the end of the relationship?
The Act ties retention to the logs themselves, so count from when each log is generated. Other laws, such as financial record rules, may count from the end of the relationship, which is why tiered retention helps.
Can we anonymise logs instead of deleting them?
Yes, if the result is truly anonymous. Agent logs are hard to anonymise because free text carries identifying detail. Pseudonymisation reduces risk but the data stays personal.
Should non-high-risk agents follow the same schedule?
It is good practice to use the same structure, because the decision record serves complaints and audits whatever the risk class. Set periods by need rather than copying the high-risk floor.