The AI Record Keeping Agent
Define EU AI Act Article 12 record-keeping for a high-risk AI system — what gets logged, the event schema, retention period, access control, tamper-evidence, and review cadence — on infrastructure you control.
High-risk AI must keep records — but which, how, and for how long?
EU AI Act Article 12 requires high-risk AI systems to log automatically so their operation is traceable. The hard part isn’t enabling logs — it’s specifying what to capture, in what schema, how long to keep it, who can read it, and how to prove it wasn’t tampered with.
Vague logging
Most systems log for debugging, not traceability — the wrong events, no schema, no retention policy.
No tamper-evidence
An audit trail that can be quietly edited isn’t an audit trail. Article 12 expects records you can trust.
Undefined retention
Keep logs too briefly and you can’t reconstruct an incident; too long and you create privacy and cost risk.
Unclear access
Without access control on the logs, the record-keeping itself becomes a confidentiality problem.
A record-keeping specification you can implement
Schema
What to Log, and How
Events and an explicit schema.
The agent specifies exactly which events a high-risk system should record for traceability and defines the event schema — fields, structure, and meaning — so engineering implements logging that satisfies Article 12, not just debugging logs.
- Events to capture for traceability
- Explicit event schema
- Aligned to Article 12 intent
- Implementation-ready spec
Events + fields
Integrity
Retention, Access & Tamper-Evidence
A trail you can stand behind.
It defines the retention period, who may access the records, and how tamper-evidence is achieved — turning "we have logs" into a defensible record-keeping regime an auditor will accept.
Retention + access
Operate
Review Cadence, On-Premise
Records that stay maintained — and private.
The spec includes a review cadence so records stay meaningful over time, and runs on-premise so the logging design and the sensitive operational data it describes stay inside your perimeter.
On-prem · reviewed
Where record-keeping pays back
Article 12 Logging Spec
Produce the record-keeping specification a high-risk AI system needs to be traceable under Article 12.
Audit-Trail Design
Define a tamper-evident audit trail that an auditor or regulator will actually accept.
Retention Policy
Set a defensible retention period that balances traceability against privacy and cost.
Access Control Design
Specify who can read the records so the audit trail isn’t itself a confidentiality risk.
Incident Reconstruction
Ensure the right events are captured to reconstruct what a system did during an incident.
Logging Review
Assess existing logging against Article 12 and specify the gaps to close.
What changes after rollout
Questions about the AI Record Keeping Agent
What is an AI record-keeping agent?
It is an AI governance agent that specifies EU AI Act Article 12 record-keeping for a high-risk AI system: what events to log, the event schema, retention period, access control, tamper-evidence, and review cadence. VDF’s agent runs on your own infrastructure so the design and the data it describes stay private.
What does EU AI Act Article 12 require?
Article 12 requires high-risk AI systems to log automatically throughout their lifecycle so their operation is traceable. The agent translates that into a concrete, implementable logging and retention specification.
Does it produce logs, or a specification?
A specification. It defines what your system should log and how — the events, schema, retention, access, and tamper-evidence — which engineering then implements. That separation keeps the design reviewable and auditable.
Why does tamper-evidence matter?
An audit trail that can be silently altered provides no assurance. The spec defines how tamper-evidence is achieved so the records are trustworthy enough to put in front of a regulator.
Is it part of the EU AI Act toolkit?
Yes — it complements VDF’s risk classification, governance policy, Annex IV documentation, transparency, training, and code-scanning agents. See the AI Governance Agents hub.
Agents that work well alongside this one
Related resources
Turn "we have logs" into Article 12 record-keeping
See the AI Record Keeping Agent specify the schema, retention, and tamper-evidence your system needs.