Article 12
UpcomingConditional timingEnable Automatic Event Logging for High-Risk AI Systems
Applies to Provider; High-Risk AI.
- Actors
- Provider
- AI class
- High-Risk AI
- Themes
- Data, Privacy & InformationMonitoring, Reporting & Improvement
Tracker Guidance
Design the high-risk AI system with logging capabilities that automatically record relevant events over the system's lifetime to the extent appropriate for its intended purpose and support traceability.
Official text
1. High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system. 2. In order to ensure a level of traceability of the functioning of a high-risk AI system that is appropriate to the intended purpose of the system, logging capabilities shall enable the recording of events relevant for: (a) identifying situations that may result in the high-risk AI system presenting a risk within the meaning of Article 79(1) or in a substantial modification; (b) facilitating the post-market monitoring referred to in Article 72; and (c) monitoring the operation of high-risk AI systems referred to in Article 26(5). 3. For high-risk AI systems referred to in point 1 (a), of Annex III, the logging capabilities shall provide, at a minimum: (a) recording of the period of each use of the system (start date and time and end date and time of each use); (b) the reference database against which input data has been checked by the system; (c) the input data for which the search has led to a match; (d) the identification of the natural persons involved in the verification of the results, as referred to in Article 14(5).
Timing depends on the system
- 2 Dec 2027 — Article 6(2) / Annex III high-risk AI
- 2 Aug 2028 — Article 6(1) / Annex I Section A high-risk AI
- 2 Dec 2027 — Pre-existing Annex III high-risk AI type/model first placed on the market or put into service before 2027-12-02
- 2 Aug 2028 — Pre-existing Article 6(1) / Annex I high-risk AI type/model first placed on the market or put into service before 2028-08-02
- 2 Aug 2030 — Pre-existing high-risk AI intended to be used by public authorities
Sub-obligations
These are independently assessable parts of the parent requirement.
Article 12(1)-(2)
UpcomingEnsure Logs Support Risk Detection, Post-Market Monitoring and Deployer Monitoring
Tracker Guidance
Ensure the logging capabilities support identification of situations that may result in a relevant risk or substantial modification, support post-market monitoring, and enable deployers to monitor system operation where required.
Official text
Article 12(1)-(2)Official source 1. High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system. 2. In order to ensure a level of traceability of the functioning of a high-risk AI system that is appropriate to the intended purpose of the system, logging capabilities shall enable the recording of events relevant for: (a) identifying situations that may result in the high-risk AI system presenting a risk within the meaning of Article 79(1) or in a substantial modification; (b) facilitating the post-market monitoring referred to in Article 72; and (c) monitoring the operation of high-risk AI systems referred to in Article 26(5).
Article 12(3)
UpcomingProvide Required Logging Capabilities for Annex III Remote Biometric Identification
Tracker Guidance
For the specified Annex III remote biometric identification systems, ensure the logs capture the minimum information required by Article 12(3), including relevant use periods, reference database information, input data that produced a match, and identification of the people involved in verifying results where required.
Official text
Article 12(3)Official source 3. For high-risk AI systems referred to in point 1 (a), of Annex III, the logging capabilities shall provide, at a minimum: (a) recording of the period of each use of the system (start date and time and end date and time of each use); (b) the reference database against which input data has been checked by the system; (c) the input data for which the search has led to a match; (d) the identification of the natural persons involved in the verification of the results, as referred to in Article 14(5).