In short
- Article 12 requires high-risk systems to allow automatic recording of events across their lifetime. Articles 19 and 26(6) set the retention floor at at least 6 months for providers and deployers.
- The Act sets duration, not content. A log that satisfies the 6 month floor and records nothing about which tool was called cannot answer the first question an investigator asks.
- Article 73 gives as little as 2 days to notify, and Article 73(6) requires an investigation afterwards. Both assume the evidence already exists.
- The reconstruction needs 5 things: the input that arrived, the identity that acted, the tools called, the output returned, and the version of everything involved.
- Model version is the field teams forget. Without it, a finding from March cannot be tested against the system running in September.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
Retention is the part of logging that gets budgeted, because it appears in the text of the law.
Content is the part that decides whether an incident can be explained, and the law is close to silent on it.
01What does the AI Act actually require?
Duration, and traceability appropriate to purpose.
Article 12 requires that high-risk systems technically allow the automatic recording of events over their lifetime, at a level of traceability appropriate to the intended purpose. The deadlines that consume those logs are set out in Article 73. Article 19 requires providers to keep those logs for at least six months. Article 26(6) puts the same floor on deployers.
Six months is a floor, not a target, and it is the only number in the regime. Everything else is left to whoever designs the schema, which in practice means it is decided by an engineer optimising for storage cost.
02Which five fields make a reconstruction possible?
| Field | Question it answers | Cost of omitting it |
|---|---|---|
| Triggering input | What did the system receive? | Injection cannot be distinguished from error |
| Acting identity | Who did it act as? | Agent actions blend into 1 shared account |
| Tool or endpoint called | What did it reach? | Blast radius unknown, so scope is guessed |
| Returned output | What came back? | Data exposure cannot be quantified |
| Versions in effect | Which model, prompt and tool? | Findings cannot be reproduced or retested |
The second row is the one that turns a short investigation into a long one. When an agent uses a shared service identity, every action it took is indistinguishable from every scheduled job using the same credential, and the first day of the investigation is spent separating them.
03How does the deadline change what you log?
| Trigger | Deadline | What must already exist |
|---|---|---|
| Critical infrastructure disruption | 2 days | Queryable logs, no reindexing time |
| Possible death | 10 days | Full trace including versions |
| All other serious incidents | 15 days | Enough to state a reasonable likelihood |
| Post-report investigation, Article 73(6) | Ongoing | Retained 6 months minimum |
Two days is the number that should drive the design, and it is not even the shortest clock an incident can start. It is not enough time to restore an archive, join three systems by hand, or ask a vendor for logs under a support ticket. Whatever the two day case needs has to be queryable at the moment the phone rings.
04Where does prompt content fit?
In a shorter retention tier than everything else.
Prompts contain whatever a user typed. In an enterprise deployment that includes customer names, case details, and occasionally credentials pasted in by someone in a hurry. Keeping that for the full window creates a data protection problem in order to solve a traceability one.
The workable split is to keep the structural fields, identity, tool calls, versions and outcomes, for the full retention period, and to keep raw prompt and completion text for a shorter window with tighter access. That keeps the reconstruction possible while shrinking the sensitive surface.
What does not work is logging the prompt and nothing else, which is the common starting point because it is what the provider SDK writes by default.
05What should be tested before you need it?
One query, run quarterly, against production data.
Pick an agent action from three months ago and answer four questions from the logs alone: what triggered it, what identity it used, what it called, and which model version was live. If any answer requires asking a person, the log is not evidence, it is telemetry.
The distinction matters because Article 73(6) does not end at the notification. It requires the provider to investigate, assess the risk and take corrective action, in cooperation with the authority. An organisation that can notify inside two days but cannot explain the cause inside two months has met the deadline and failed the obligation.
06Frequently asked questions
How long must AI system logs be kept in the EU?
At least six months. Article 19 sets that floor for providers of high-risk systems and Article 26(6) sets it for deployers, in each case unless a longer period applies under other Union or national law.
Does the AI Act say what has to be in the log?
Only in general terms. Article 12 requires automatic recording of events over the system's lifetime with a level of traceability appropriate to the intended purpose, which leaves the field list to the operator and makes the design decision yours.
What is the minimum useful record for an agent action?
Five fields: the input that triggered the step, the identity the agent acted as, the tool or endpoint it called, what came back, and the version of the model, prompt and tool at that moment. Without the last one the other four cannot be reproduced.
Why is prompt logging controversial?
Because prompts contain whatever the user typed, which routinely includes personal data. The usual resolution is to log the prompt for a shorter period than the metadata, and to keep the structural fields, such as tool calls and identities, for the full retention window.
07References and method
- Regulation (EU) 2024/1689, Article 12, for the automatic recording of events requirement, and Article 19 and Article 26(6) for the retention floor of at least six months applying to providers and deployers respectively.
- Regulation (EU) 2024/1689, Article 73, for the reporting deadlines and for the obligation in Article 73(6) to investigate and take corrective action.
- Anthropic, Countering misuse of AI: September 2026, for the description of agent frameworks operating unattended for hours or days, which sets the volume of events an investigation has to traverse.
- The five field reconstruction set is editorial, prepared by The Guardrail from ordinary incident response practice. It is not drawn from a published standard.