Builds on AR-000200 (The EU AI Act Explained) and AR-000210 (High-Risk AI Systems) — none of their content is re-derived here. Article 12 is one of seven Chapter III Section 2 requirements for high-risk systems; Article 19 (automatically generated logs) and Article 26(5) (deployer log-keeping duties) are closely related and referenced throughout.
Executive summary
What this means
Who this applies to
Regulatory context
The three logging purposes
The Annex III point 1(a) enhanced requirements
Relationship with Articles 19 and 26(5)
Digital Omnibus status
Requirements
What organizations must do
- Build automatic logging capability into the system at design time — Article 12(1) is a technical design obligation on the provider, not a configuration instruction to deployers.
- Design logging to cover the three statutory purposes: risk-triggering events (Article 79(1)), post-market monitoring evidence (Article 72), and deployer operational monitoring (Article 26(5)).
- Calibrate logging depth to the system’s intended purpose — the Article 12(2) traceability standard is “appropriate to the intended purpose,” which implies proportionality but not minimalism: a system with high fundamental-rights impact warrants more granular logging than a narrow procedural system.
- For remote biometric identification systems (Annex III point 1(a)): ensure the system captures all four Article 12(3) minimum-content categories per use period — timestamps, reference database identity, matched input data, and verification personnel identification per Article 14(5).
- Document the logging capability in the Article 11/Annex IV technical documentation (Item 3 covers monitoring and control; Item 2(h) covers cybersecurity measures that protect log integrity).
Common mistakes
Treating Article 12 as an operational logging policy rather than a technical design requirement is a common mistake — the obligation is on the system itself to be capable of automatic logging, not on the deployer to configure logging after deployment.
Conflating Article 12 (logging capability) with Article 19 (provider log retention) and Article 26(5) (deployer log retention) is a second mistake — they are distinct obligations at different layers of the compliance chain.
Treating the Article 12(3) four-category list as applying to all high-risk systems is a third mistake — it applies only to Annex III point 1(a) remote biometric identification systems; other high-risk systems are governed by the general Article 12(2) purpose-based standard only.
Designing logging to capture maximum possible data rather than events appropriate to the system’s intended purpose is a fourth mistake — Article 12(2) sets a proportionality standard, and indiscriminate logging may create data protection issues without adding regulatory value.
Open questions
- Whether the Digital Omnibus has changed Article 12 — no disclaimer found on the Service Desk as of this verification pass; treated as clean pre-amendment text, not as confirmation of no amendment.
- How the Article 12(2) “appropriate to the intended purpose” traceability standard should be interpreted in practice — no Commission guidance specifically addressing the calibration question was identified on this research pass.
- What retention periods sectoral law sets for Article 26(5) purposes — these differ by Annex III category and sectoral legislation; not surveyed in this research pass.