How do I meet EU AI Act Article 12 record-keeping requirements?

EU AI Act Article 12 requires that high-risk AI systems technically allow for the automatic recording of events (logs) across the lifetime of the system, to a level appropriate to the intended purpose, so that operation stays traceable and auditable. To meet it you need automatic, append-only logs whose integrity can be independently verified and which are retained for the period the regulation requires. AlgoVoi gives you tamper-evident, independently timestamped, self-hosted audit logs that satisfy the record-keeping and traceability obligation without trusting a vendor.

Last updated 21 August 2026

What Article 12 actually asks for

Article 12 ("Record-keeping") of the EU AI Act (Regulation (EU) 2024/1689) is about logging. A high-risk AI system must be designed so that it automatically records events over its lifetime, at a level of detail appropriate to the system's intended purpose. The point of those logs is traceability: being able to reconstruct what the system did, identify situations that could make it risky, and support post-market monitoring and audits.

These obligations are in force now: since 2 August 2026 the Annex III high-risk duties apply, including Article 12 automatic record-keeping. Article 12 does not sit on its own. Providers (Article 19) and deployers (Article 26) must keep those automatically generated logs under their control for a period appropriate to the system's purpose and at least six months, alongside the technical documentation duties in Article 11 and Annex IV. Read together, the requirement is not just "produce logs" but "produce logs a competent authority can later rely on." Non-compliance carries penalties up to EUR 15 million or 3 percent of worldwide annual turnover.

What separates a compliant record from "we store the logs"

Most systems already write application logs. That is not the same as a record you can stand behind in an audit. To support Article 12 traceability, the record needs to be:

• Automatic: written by the system as events happen, not assembled by hand afterwards.
• Tamper-evident: any later alteration, insertion, or deletion is detectable, so an administrator cannot silently rewrite history.
• Independently timestamped: each entry is anchored to a time that does not depend on trusting the server clock alone.
• Integrity-verifiable: a third party can check the record is intact without access to your production system and without trusting you.
• Retained and exportable: kept for the required period and producible for a competent authority in a form they can verify.

Plain database rows or rotating text logs fail the second and fourth tests: whoever holds the database can change them, and no one outside can prove they were not changed.

How to meet it with AlgoVoi

AlgoVoi's audit-log and evidence tooling is built for exactly this record-keeping obligation, and it runs on your own infrastructure so the logs never leave your control:

• Append-only, hash-chained log: every entry is chained to the previous one, so removing or editing any entry breaks the chain and is immediately detectable.
• Independent timestamping: entries are anchored so their time can be verified without trusting a single server clock.
• Post-quantum sealing: the record is sealed with signatures that stay verifiable long after today's RSA and ECDSA are broken, so a log written now is still provable years into a retention window.
• Offline, vendor-independent verification: an auditor runs the open verifier against the exported record and gets a pass or fail without contacting AlgoVoi and without trusting you.

Verify it, the way an auditor would

The whole point is that someone else can check the record. Verification runs offline against the exported receipts and the log's public key, with no call back to AlgoVoi and no trust in whoever holds the log:

from algovoi_audit_log import verify_chain

# `receipts` are the exported, signed log entries; `public_key`
# is the log's Falcon-1024 public key. No network, no vendor.
result = verify_chain(receipts, public_key)
assert result.valid   # fails the moment any entry is altered,
                      # inserted, removed, reordered, or back-dated

A competent authority can run the same check against the same exported receipts and reach the same verdict. That reproducibility is what turns "we kept logs" into evidence.

DIY logging vs SaaS logging vs AlgoVoi

Do it with AlgoVoi

The self-hosted Verifiable Audit Log produces the tamper-evident record. It ships standalone and inside the Verifiable Compliance Suite, runs entirely on your own infrastructure, and is air-gap capable (no PyPI). Anyone you hand an exported record to can verify it offline, no licence and no AlgoVoi account needed.

• Get the log: Suite Store (Verifiable Audit Log, or the full Compliance Suite)
• Related answer: tamper-evident, timestamped audit logs for AI systems
• Related answer: immutable audit logs on your own infrastructure
• Product: Regulatory evidence · Evidence Auditor
• Full regulatory mapping (Articles 12/19/26): docs EU AI Act record-keeping

Start with the docs: docs.algovoi.co.uk/audit-log