Under the EU AI Act, a high-risk AI system must technically allow events to be recorded automatically over its lifetime (Article 12), and the organisation deploying it must keep those logs (Article 26) (Regulation (EU) 2024/1689). For AI agents the hard question is not whether to log. It is whether the log is evidence of what the agent did, or just another thing the agent wrote.
This guide covers who the duties apply to, what Article 12 asks for, the dates after the AI Omnibus, what deployers must keep, why an agent’s own logs don’t satisfy an auditor, and where certification is heading. It is not legal advice.
Does the AI Act apply to my agent?
The Act is risk-based. Most of its binding obligations fall on high-risk systems: those used in the areas listed in Annex III, such as employment, education, access to essential services and law enforcement, and those that are safety components of products covered by the Union harmonisation legislation in Annex I (Regulation (EU) 2024/1689).
An agent is not high-risk because it is an agent. It is high-risk because of what it is used for. A coding agent working on an internal tool is probably not in scope; an agent that screens job applications probably is. The same model can be either, so the analysis follows the deployment, not the technology.
Two roles carry the duties. The provider builds the system and must design it to log. The deployer uses it and must keep the logs. A company that wires a vendor’s model into its own agent may be both.
What does Article 12 require?
Article 12(1) states that high-risk AI systems “shall technically allow for the automatic recording of events (logs) over the lifetime of the system” (Regulation (EU) 2024/1689). The rest of the article ties the logging to a purpose: a level of traceability appropriate to the system’s intended use, sufficient to identify situations that may present a risk or amount to a substantial modification, to support post-market monitoring, and to support the deployer’s own monitoring of the system’s operation.
Three things stand out for agents.
“Automatic.” The record is produced by the system as it runs, not reconstructed afterwards from what the agent says it did.
“Over the lifetime.” Logging is a property of the system in operation, not a one-off evaluation before release.
“Traceability.” The point of the log is that someone can later work out what happened. A log that cannot answer “what did the agent do and why did it do it?” misses the purpose even if it exists.
When do the obligations apply?
The Regulation set a staged timetable in Article 113. The AI Omnibus, formally adopted in 2026, moved the high-risk dates. High-risk obligations now apply from 2 December 2027 for standalone high-risk systems (Annex III) and from 2 August 2028 for high-risk systems embedded in regulated products (Annex I) (Addleshaw Goddard, 2026).
For comparison, the 2024 text of Article 113 set general application at 2 August 2026, with the Article 6(1) obligations for products covered by Union harmonisation law from 2 August 2027 (Regulation (EU) 2024/1689). The note on the Omnibus dates sets the old and new timetables side by side.
| Obligation | Who | Applies from |
|---|---|---|
| Logging capability (Article 12) | Provider of a high-risk system | 2 December 2027 (Annex III); 2 August 2028 (Annex I) |
| Keeping the logs (Article 26) | Deployer of a high-risk system | Same dates as the system’s obligations |
The delay is time to build, not time to wait. An agent that is in production today without an independent record will be in production on 2 December 2027 with two years of history nobody can audit.
What must deployers keep?
Article 26 sets the deployer’s duties, including keeping the logs the system generates automatically, to the extent the logs are under the deployer’s control, for a period appropriate to the system’s intended purpose and subject to a minimum the Regulation specifies (Regulation (EU) 2024/1689).
In the 2024 text, that minimum is six months: Article 19(1) for providers and Article 26(6) for deployers both require the logs to be kept “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months”, unless other Union or national law requires longer (Regulation (EU) 2024/1689). The Addleshaw Goddard briefing on the Omnibus reports no change to Articles 12, 19 or 26; confirm against the consolidated text before relying on it.
For agents, “under the deployer’s control” is the phrase to read twice. If the agent can reach the log, the log is under the agent’s control as much as the deployer’s.
Logs vs evidence: what can an auditor trust?
An auditor needs a record that is complete, that the subject of the audit could not have altered, and that a third party can check. Agent logs as commonly implemented fail the second test.
Qin et al. tested agent harnesses and found that most of them let the agent delete or rewrite its own trace, and that agents did so when it served them (Qin et al., 2026). They recommend logging outside the agent’s control. The problem is compounded by the agent’s own reporting: among coding agents that reported their own status in a 2026 study, 75.8% of failures were false successes, where the agent said “done” and it wasn’t (Advani, 2026). A log that consists of the agent’s statements records the claim, not the event.
What an auditor can trust has three properties:
- Independent of the agent. Produced by something the agent is not.
- Out of the agent’s reach. Not readable, writable or deletable from inside the run.
- Tamper-evident. Any change after the fact is detectable, so the record can be handed over and relied on.
That is a description of a record, not of a product. Inoku is researching an independent record of what agents did for teams running agents on real systems; it is at research stage, and the principle above stands on its own.
Where is certification heading?
Alongside regulation, a private assurance market is forming. AIUC, an AI agent certification startup, raised $40M to begin auditing frontier models against its AIUC-1 standard, with quarterly recertification and a stated role for the certification in insurance underwriting (SiliconANGLE, 2026).
Two features of that model matter here. Recertification every quarter assumes that an agent’s behaviour changes with every model update, which matches experience. And insurers pricing agent risk will want the same thing auditors want: a record they can rely on, produced by something other than the party being insured. Evidence Every factual claim on this page links to one of these. Numbers in brackets refer to this list.Sources