What the EU AI Act Requires From Your Logging Infrastructure

The EU AI Act's Article 12 requires providers of high-risk AI systems to enable "automatic recording of events" over the lifetime of the system.

The three things regulators ask about

• What did the model decide, and why? Inputs, model version, output, confidence, and code path.
• Can you prove the record has not been altered? Cryptographic evidence, not "it's in Postgres."
• Can you produce this on demand for a specific decision, months later? Retrieval as a query, not a project.

Why standard application logs fall short

Structured JSON logs shipped to your observability stack were built for debugging. They are typically retained for 14–30 days, mutable by anyone with write access, and stripped of the inputs that made the decision reproducible. High-risk systems need retention measured in years and tamper-evident storage. That is a different system, not a bigger log bucket.

A minimum viable audit record

{
  "decision_id": "dec_01HR9F...",
  "timestamp": "2026-06-24T10:14:22.481Z",
  "model": { "id": "risk-scorer", "version": "3.2.1", "hash": "sha256:..." },
  "inputs_hash": "sha256:...",
  "output": { "score": 0.82, "label": "review" },
  "explanation_ref": "s3://.../explanations/dec_01HR9F.json",
  "chain_hash": "sha256:..."
}